SPDM Key Distribution for Low-End Devices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing SPDM-based attestation systems face challenges in securely distributing and managing Pre-Shared Keys (PSKs) for low-end devices with limited computing power, which can lead to compromised security and trust issues.

Innovation Solution

A dynamic key distribution system that encrypts the original PSK with the SPDM identity certificate of a first SPDM-enabled device and provisions it to a second SPDM-enabled device, ensuring that only the first device can authenticate the second device by decrypting the encrypted PSK using an SPDM protocol.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If PSK is distributed in plaintext or weakly encrypted form to low-end SPDM devices, then device authentication can be established, but security is compromised and key exposure risk increases

Engineering Contradiction:

Improveauthentication securityVSAvoidkey exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of the PSK with the requester's public key before the key is transmitted to the responder device. This advance security measure ensures that the PSK remains confidential during distribution, eliminating the need for post-distribution key management and preventing key exposure risks entirely.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a cryptographic intermediary mechanism where the PSK is encrypted using the requester's public key as a mediator. This intermediary encryption layer protects the PSK during transmission and storage, allowing secure key distribution without requiring direct trusted channels between devices.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If complex key management protocols are implemented to enhance security, then authentication reliability improves, but device complexity increases which is problematic for low-end devices

Engineering Contradiction:

Improvekey distribution securityVSAvoidprotocol complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex cryptographic operations from the responder device and concentrates them in the requester device. The responder only needs to store and use the encrypted PSK, while the requester handles the computationally intensive decryption and authentication operations, significantly reducing the complexity burden on low-end devices.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the operational parameters of key management by using asymmetric encryption for key distribution rather than symmetric key exchange protocols. This parameter change allows the PSK to be securely distributed without requiring the responder to perform complex key agreement calculations, reducing computational requirements.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12265632B2Systems and methods for key distribution of low end SPDM devices

Publication Date: 2025.04.01 DELL PROD LP

AI summary

According to embodiments of the present disclosure, a dynamic key distribution system is provided. The dynamic key distribution includes computer-executable instructions to encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device. The instructions are also configured to provision the encrypted PSK in the second SPDM-enabled device, and authenticate the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.