Software TPM Security via White Box Encryption and Hidden Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
When implementing TPM chip functions using software, the security of the system is relatively low, making it vulnerable to malicious tampering.
Innovation Solution
A network device employs a white box algorithm to encrypt permanent confidential data and stores it, along with refreshable confidential data, in a storage unit with a hidden address, ensuring that even if the address is found, the data cannot be easily accessed or cracked, thereby enhancing data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If TPM chip functions are implemented using software, then device complexity and cost are reduced, but system security and reliability deteriorate
Solution Approach 1:
The patent introduces a security module as an intermediary component that mediates between the software TPM implementation and the confidential data storage. This security module implements white box encryption algorithms and manages hidden address storage, providing enhanced security protection while maintaining the software-based TPM architecture. The security module acts as a trusted intermediary that ensures data protection without requiring hardware TPM changes.
2Ease of operation
If confidential data is stored in plaintext or with simple encryption, then access speed and operation ease are improved, but security against tampering deteriorates
Solution Approach 1:
The patent changes the encryption parameter by implementing white box encryption algorithms that are specifically designed to resist tampering and reverse engineering. The encryption parameters include using hidden storage addresses and secure encryption keys that are managed by the security module. This approach maintains fast access speeds while providing strong protection against tampering by making the encryption process opaque to external attackers.
Solution Approach 2:
The patent performs preliminary security actions by pre-establishing hidden storage addresses and pre-configuring white box encryption algorithms before data storage. The security module pre-processes the encryption keys and storage location information, ensuring that when confidential data needs to be stored or accessed, the security measures are already in place. This preliminary preparation ensures both fast access and strong security without compromising either aspect during actual data operations.
Data Source
Figure 1~2
Figure 3~4
AI summary
Disclosed are a security control method and a network device. The method includes: obtaining, by a network device, confidential data, where the confidential data is generated by a software trusted platform module TPM, the software TPM runs in the network device, and the confidential data includes permanent confidential data and refreshable confidential data (101), where the permanent confidential data is data that cannot be updated during a startup process of the network device and the refreshable confidential data is data that can be updated during a startup process of the network device; encrypting, by the network device, the permanent confidential data by using a white box algorithm (102); and storing, by the network device, the permanent confidential data encrypted by using the white box algorithm and the refreshable confidential data in a storage unit whose address is hidden (103). The method can improve system security when a TPM is implemented by using software.