Personalized User Device Issuance via Encrypted Key Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for issuing personalized user devices, such as smart cards, fail to ensure that sensitive information like private cryptographic keys remains inaccessible to third parties during the issuance process, compromising security.

Innovation Solution

A method that initializes user devices by generating device and issuer authentication key pairs, encrypting user private keys, and digitally signing encrypted data, ensuring that only the user device can decrypt and access the keys, thereby preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If a third party provides and initializes the user device, then the device can be personalized and issued to the user, but the third party may gain access to sensitive information including private cryptographic keys

Engineering Contradiction:

ImproveDevice personalization capabilityVSAvoidSecurity risk from third-party access

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The patent segments the key generation process into distinct phases: the third party generates only public keys and device identifiers during initialization, while private cryptographic keys are generated separately by the user device itself using its secure enclave. This segmentation ensures that the third party never accesses sensitive private keys while still being able to personalize and issue the device.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a cryptographic intermediary mechanism where public keys serve as the intermediary between the third party's personalization needs and the user device's security requirements. The third party uses public keys for personalization operations, while private keys remain isolated in the secure enclave, acting as a mediator that enables device personalization without compromising security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the user device stores all necessary data including private keys, then the device is fully functional, but complete knowledge of all data may be accessible during provision

Engineering Contradiction:

ImproveDevice functionalityVSAvoidData confidentiality

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements a nested structure where the secure enclave (a protected subsystem) is embedded within the user device. The secure enclave stores and manages private cryptographic keys in isolation, while the rest of the device contains public keys and application data. This nested architecture allows the device to be fully functional while maintaining strict separation between sensitive and non-sensitive data.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent applies local quality by creating different security zones within the device: the secure enclave provides high-security storage for private keys with restricted access, while other portions of the device store public keys and personalization data with broader access permissions. This localized security approach ensures that sensitivity-appropriate protection is applied to different data types.

Inventive Principle:

Principle #3Local quality

3Productivity

If the third party initializes the device with all keys, then the process is simple and efficient, but the private keys are no longer secret

Engineering Contradiction:

ImproveIssuance process efficiencyVSAvoidSecret accessibility

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The patent applies preliminary action by having the third party perform all necessary device personalization, configuration, and public key setup during the initialization phase before the user device generates its private cryptographic keys. This preliminary personalization using public keys eliminates the need for later key installation while ensuring private keys are generated secretly within the device's secure enclave.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the traditional mechanical approach of physically loading private keys onto devices with a cryptographic substitution: public keys are used during the initialization and personalization process, and private keys are generated cryptographically within the secure enclave using seed values derived from secure random sources. This substitution eliminates the need for key transportation and loading operations that would compromise security.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250015978A1Method for issuance of a personalized user device

Publication Date: 2025.01.09 ARMLEDER SEBASTIEN

AI summary

A method for issuance of a personalized user device includes initializing a user device to provide an initialized user device, providing device initialization data to an issuer system, wherein the device initialization data comprises a public device key and a public issuer authentication key, calculating a user private key, encrypting the user private key and the public device authentication key with the public device key to provide encrypted data, digitally signing the encrypted data using a private issuer key to provide signed encrypted data, the issuer system providing the encrypted data and the signed encrypted data, injecting said data into the initialized user device to provide the personalized user device, and the personalized user device, conditional on successfully validating the signed encrypted data, decrypting the encrypted data to retrieve the user private key and the public device authentication key.