Software Key Management for Resource-Constrained Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded systems and small devices often lack dedicated hardware for secure key storage, making it difficult to persist encryption keys and certificates securely without relying on hardware-based solutions like TPMs.
Innovation Solution
A computing device implements a lightweight key and certificate management system that uses an obfuscated passphrase stored across multiple encoded segments, allowing secure persistence of encryption keys and certificates in a local keystore without requiring TPM hardware, by converting keystore commands into lower-level encrypted database commands and using a passphrase constructor to decode and compound segments for access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated hardware like TPM is used for secure key storage, then security reliability is improved, but device complexity and cost increase
Solution Approach 1:
The patent creates a software-based copy of TPM functionality through a virtual TPM driver that emulates hardware security operations in user mode. The key management system replicates the essential functions of hardware TPM including key generation, storage, and cryptographic operations using software structures and algorithms, thereby achieving similar security reliability without requiring physical hardware components.
Solution Approach 2:
The patent replaces the mechanical/hardware-based TPM system with a software-based key management system running in user mode. Instead of relying on physical hardware modules, the system uses software libraries, encoded segments stored in files, and cryptographic protocols to achieve the same security functions, substituting hardware mechanisms with software-based equivalents.
2Reliability
If hardware-based secure storage is implemented, then key protection is improved, but resource consumption and cost increase
Solution Approach 1:
The patent employs lightweight, software-based security mechanisms that consume minimal system resources compared to hardware TPM. The key management system uses efficient cryptographic algorithms, stores encoded segments in standard file systems, and operates with low memory and CPU overhead, providing adequate protection for resource-constrained embedded devices without the overhead of dedicated hardware.
3Ease of operation
If keys are stored as plain text files with access restrictions, then ease of operation is improved, but security against attacks deteriorates
Solution Approach 1:
The patent divides the encryption key into multiple encoded segments that are stored separately in the file system. Each segment alone is insufficient to reconstruct the original key, providing security against unauthorized access. The segmentation is achieved through cryptographic encoding where the key material is split and distributed across multiple file locations, requiring authorized combination to access the full key.
Solution Approach 2:
The patent combines multiple security mechanisms into a composite key management system: encoded segments, decryption functions, access control checks, and cryptographic protocols work together to provide layered security. This composite approach maintains ease of operation through automated management while significantly improving resistance to attacks compared to simple plain text storage.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Technologies for secure certificate management include a computing device that receives a keystore command related to an encryption key, converts the keystore command into an encrypted database command, unlocks an encrypted database stored by the computing device with an obfuscated passphrase, and executes the encrypted database command. The encrypted database includes a key table to store binary copies of encryption keys and a metadata table to store metadata related to the encryption keys. The computing device returns a response to the keystore command in response to executing the encrypted database command. The keystore command may be received and the response may be returned via a command-line interface or a machine-to-machine interface. The computing device may load multiple encoded passphrase segments from corresponding predetermined file system locations, decode the encoded passphrase segments, and compound the decoded passphrase segments to generate the passphrase. Other embodiments are described and claimed.