Secure Channel for Digital Currency Hardware Wallet Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Digital currency hardware wallets face security vulnerabilities during remote applet updates, including the risk of attacks, data theft, and authentication issues between mobile devices and servers, due to inadequate security channels.
Innovation Solution
A method and device for building a secure channel for updating digital currency hardware wallet applets, involving instruction processing, key management, certificate verification, and session key generation to ensure data integrity and privacy through MAC and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If remote applet update is implemented in digital currency hardware wallet, then the wallet can be updated remotely, but security vulnerabilities including attacks, data theft, and authentication issues occur
Solution Approach 1:
The system performs preliminary actions by establishing a secure communication channel before the actual applet update occurs. This includes mutual authentication between the upper computer and hardware wallet, and pre-sharding of the applet into multiple encrypted packages. These preliminary security measures are in place before the update data is transmitted, preventing attacks during the update process.
Solution Approach 2:
The applet update data is segmented into multiple sharded packages (first sharding, second sharding) that are transmitted separately through the secure channel. Each package contains only a portion of the complete applet, and they are reassembled only after verification. This segmentation prevents complete data theft if one package is compromised and ensures integrity through verification of all parts.
2Reliability
If security channel is established with mutual verification and encryption, then data privacy and integrity are maintained, but the complexity of the update process increases
Solution Approach 1:
A secure communication channel acts as an intermediary between the upper computer and hardware wallet. This channel incorporates mutual verification mechanisms (certificate authentication) and encryption (session keys) as mediating layers that protect data transmission without requiring changes to the core update functionality. The intermediary handles the complexity of security protocols while presenting a simple update interface to users.
Solution Approach 2:
Security protocols including mutual authentication and session key establishment are performed as preliminary actions before data transmission begins. The complex verification and encryption setup is completed once at the start of the communication session, then subsequent data transfers use the established secure channel without repeating the full authentication process, reducing perceived complexity.
3Reliability
If certificate verification and MAC completion are performed, then authentication and data completeness are ensured, but processing time increases
Solution Approach 1:
Certificate verification and session key establishment are performed as preliminary actions during the initial connection phase. Once these authentication mechanisms are in place, subsequent data packages use the established session keys for encryption and MAC verification, which is computationally faster than full certificate verification. The time-consuming authentication occurs once, not with every data packet.
Solution Approach 2:
Data is segmented into verified packages with individual MACs. Each package can be verified independently and quickly using pre-established session keys, rather than verifying the entire data set at once. This allows parallel processing of verification for multiple packages, reducing total processing time while maintaining completeness through MAC validation of all segments.
Data Source
AI summary
A method for creating a secure channel for updating a digital currency hardware wallet application: upon receiving a security operation execution instruction, obtaining a public key and a certificate number of a host computer from within the security operation execution instruction, obtaining a corresponding certificate of the host computer according to the certificate number, and verifying the certificate of the host computer using the public key of the host computer; when receiving a verification instruction, obtaining the public key of the host computer according to a key version number and a key ID in the verification instruction, generating a receipt according to a temporary public key of the host computer, the public key of the host computer and a generated session key which are in the verification instruction, and sending the receipt to the upper computer; upon receiving the application update instruction, using the session key to decrypt application data ciphertext in the application update instruction, and updating the saved application data using the successfully decrypted application data. By using the digital currency hardware wallet of the present invention, it is possible to prevent the wallet from being attacked, stolen or tampered with, mutual verification of communication parties may be carried out, and encryption and verification are carried out to ensure data privacy and integrity.