Key Hierarchy Design for TPM Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
TPM devices in computing systems have limited computing resources, leading to increased latency in user processes or applications that interact with them due to the need for key management and cryptographic operations.
Innovation Solution
A key hierarchy design that allows authorization data associated with a key to be decrypted outside of the TPM device, enabling faster decryption and authorization processes, thereby reducing latency and improving system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed within the TPM device using traditional key management, then security is maintained, but processing speed decreases and latency increases
Solution Approach 1:
The patent divides the cryptographic processing into two segments: security-critical key management operations remain within the TPM device, while authorization data decryption is extracted and performed outside the TPM using the unbound authorization key. This segmentation allows speed-critical operations to occur outside the resource-constrained TPM while maintaining security through the key hierarchy.
Solution Approach 2:
The authorization key is extracted from the TPM device and stored externally, allowing decryption operations to be performed outside the TPM. The authorization key can decrypt authorization data for cryptographic keys, enabling faster processing while the TPM retains control over the actual cryptographic keys through the key hierarchy structure.
2Reliability
If key management operations are performed within the TPM device, then security is ensured, but processing latency increases
Solution Approach 1:
The authorization key is pre-configured outside the TPM device and pre-bound to the TPM's key hierarchy. This preliminary setup allows the authorization key to be readily available for decrypting authorization data without requiring time-consuming key management operations within the TPM during actual cryptographic operations, thus reducing latency.
3Reliability
If cryptographic keys are managed entirely within the TPM device, then security is maximized, but system performance decreases
Solution Approach 1:
The authorization key acts as an intermediary between the external system and the TPM device's internal key hierarchy. It enables decryption of authorization data outside the TPM, facilitating faster key loading and cryptographic operations while the TPM maintains security control through the hierarchical key structure and authorization verification.
Data Source
AI summary
Aspects of the subject technology relate to systems, methods, and machine-readable media for performing a cryptographic operation. A system can be configured to submit a request, to a security device, for a decrypted user encryption key, wherein the security device is configured to decrypt the user encryption key by unbinding the user encryption key using a user authorization key. The system can receive, in response to the submitted request, the decrypted user encryption key and decrypt authorization data for a cryptographic key using the decrypted user encryption key. The system can submit a request for the security device to load the cryptographic key, wherein authorization data is used to authorize the request, and submit a request for the security device to perform a cryptographic operation using the loaded cryptographic key.