Software Keystore Integration for FIPS Compliance on Non-Hardware Devices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Devices not natively compliant with cryptographic standards, such as FIPS, face challenges in meeting security requirements due to lack of inherent hardware support, exemplified by many Android smartphone models.

Innovation Solution

A client device achieves compliance by integrating a standard-compliant software-based cryptographic library with a non-hardware-backed software keystore, where the software keystore is protected by a hardware-backed keystore, requiring user authentication via biometrics to unlock keypairs for cryptographic operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a device uses hardware-backed keystore, then security is improved, but compliance with cryptographic standards like FIPS cannot be achieved

Engineering Contradiction:

ImprovesecurityVSAvoidcompliance with cryptographic standards

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system divides the security architecture into two separate keystores: a hardware-backed keystore for secure key storage and a software-based keystore for cryptographic operations. This segmentation allows each component to fulfill its specific function - the hardware keystore provides security while the software keystore enables FIPS compliance through standard-compliant cryptographic libraries.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The software-based keystore acts as an intermediary between the hardware-backed keystore and the cryptographic library. It receives cryptographic operations from the library, retrieves protected keys from the hardware keystore, performs the operations using FIPS-compliant algorithms, and returns results, thereby enabling compliance without modifying the hardware security architecture.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If a software-based cryptographic library is added to achieve compliance, then standard compliance is improved, but device complexity increases

Engineering Contradiction:

Improvecompliance with cryptographic standardsVSAvoidsystem architecture complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The software-based keystore is designed to work with multiple cryptographic libraries and standards while maintaining a unified interface. It can support both FIPS-compliant operations and device-native cryptographic operations, reducing the need for separate implementation paths and minimizing overall system complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Adaptability or versatility

If a non-hardware-backed software keystore is used, then adaptability to cryptographic standards is improved, but security is worsened

Engineering Contradiction:

Improvecompatibility with cryptographic libraryVSAvoidsecurity of key storage

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The software-based keystore is nested within the hardware-backed keystore architecture. The software keystore stores references to cryptographic keys rather than the keys themselves, and these references are protected by the hardware-backed keystore. This nested structure allows the software keystore to provide adaptability while the hardware keystore provides the security foundation.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS12261950B2Implementing enhanced computer security standard for secure cryptographic key storage using a software-based keystore

Publication Date: 2025.03.25 OKTA INC

AI summary

A client device that is not originally compliant with a particular security standard (e.g., FIPS) is brought into compliance through the addition of a standard-compliant software-based cryptographic library. In order to adapt the cryptographic library to integrate with the hardware-backed keystore, a non-hardware-backed software keystore is used to store keys used by the cryptographic library. Additionally, in order to provide appropriate security for the software keystore, the software keystore (and/or the keypairs within the software keystore) is protected by a password, and the password is in turn protected by the hardware-backed keystore. Thus, to obtain the password needed to obtain a keypair from the software keystore that is in turn needed to use the cryptographic library, a user must authenticate with the operating system, e.g., by providing biometric credentials.