Terminal Key Management via Local Security Zone
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management methods require device manufacturers to establish separate servers for key management, leading to complex and inefficient processes during data interactions, as devices need to request public keys from these servers for authentication.
Innovation Solution
A key management method where a terminal generates a device key including a public and private key locally, transmits parameters to a certificate authentication server, and stores the private key and certificate in a secure zone, allowing for local generation and storage of application keys and certificates, reducing the need for external server interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device manufacturers establish separate servers for key management, then key management can be performed, but the process becomes complex and inefficient requiring external server interactions
Solution Approach 1:
The terminal performs key management operations autonomously using a local security zone. The device generates its own device key pair, stores the private key locally in the security zone, and uses the public key for authentication without requiring external server interactions. This self-service approach eliminates the complexity of separate key management servers and makes the key management process simpler and more efficient.
2Reliability
If device public key is uploaded to external server before device leaves factory, then key management is established, but security risks increase due to external storage
Solution Approach 1:
The private key is extracted from external storage systems and kept exclusively within the local security zone of the terminal. Only the public key, which does not compromise security, is used for external authentication. This extraction of the sensitive private key from external servers eliminates security risks associated with external storage while maintaining reliable key management functionality.
Solution Approach 2:
The public key acts as an intermediary between the terminal and external systems. Instead of storing or transmitting the private key externally, the public key mediates authentication processes, allowing external systems to verify the terminal's identity without accessing the sensitive private key. This intermediary approach maintains security while enabling reliable key management.
3Reliability
If separate key management servers are established for each manufacturer, then key management is possible, but management costs increase
Solution Approach 1:
The local security zone in each terminal serves multiple functions: key generation, key storage, and authentication. This multi-functional local system eliminates the need for separate dedicated key management servers for each manufacturer. The universal application of this self-contained approach across all terminals reduces the total quantity of server resources required while maintaining reliable key management.
Data Source
AI summary
In a key management method performed by a terminal, a device key including a device public key and a device private key is generated in a security zone. A local device parameter and the device public key are transmitted to a certificate authentication server. A device certificate fed back by the certificate authentication server is received by the terminal. The signature data of the device certificate is generated by signing the device parameter and the device public key by using an authentication private key of the certificate authentication server. The terminal then stores the device private key and the device certificate in the security zone.