Priva Security Corporation: Secure Key Storage Solution

• Home
• Company
  • Overview
  • Careers
  • Contact
  • News Room
  • Investor Relations
• Platform
  • Overview
  • Access Control
  • Cleared One-Time-Password
  • Cleared Security Platform
  • Trust Model
  • White Papers
• Solutions
  • Enterprise
  • Financial
  • Secure Key Storage

Secureing data at rest...

Securing “data-at-rest” with the same interoperability and data security available behind a firewall is essential to overall system security. The PDS8006 is specifically designed to provide a cryptographic system with secure key storage. When used in conjunction with a host processor and/or a cryptographic module, the PDS8006 will authenticate the client and calculate a 1024-bit response that can be used to unlock a proprietary code, a cryptographic library, a virtual machine layer or a cryptographic key. The security features of the PDS8006 combined with its long unattended shelf life makes it an ideal building block for security solutions.

Description...

The PDS8006 is a Secure Key Storage Integrated Circuit (SKSIC) designed to Department of Defense (DoD) specifications for the protection and security of data-at-rest. The tamper-reactive memory/security processor has been shown to provide secure storage for cryptographic keying material while combining tamper-reactive features with a battery-backed memory lifetime exceeding seven years when used with a 128mAh battery.

The PDS8006 contains a configurable secure processor, internal tamper detection, three battery-backed RAMs, and tamper-detect logic inputs for interface to external sensors, interlocks, or anti-tamper mesh. Access to all functions is accomplished through a command set that communicates to the PDS8006 via a four-wire Serial Peripheral Interface (SPI). The onboard security processor algorithmically combines the previously stored battery-backed RAM values with an entered authentication value to generate a 1024-bit output. The device must successfully pass the authentication function prior to releasing this output value. Successive attempts to generate an output with an invalid authentication value will clear one of the battery-backed RAM stored values. In the event of a primary power disruption, the external battery source is automatically switched on to maintain the internal memory contents. Additionally, a system interrupt signal and status register is provided to flag and identify a tamper event.

The PDS8006 vastly simplifies security integration for key storage and processing for embedded or PC-based security systems by integrating secure key storage, tamper-reaction, and authentication within a single battery-backed ultra-low-power device.

Tamper Response And Security...

There are two types of tamper events: those detected by the on-chip tamper detection circuits and those events detected by off-chip tamper detectors. For all tamper detected events the content of battery-backed RAMs will be zeroized.

Apart from informing the host of an existing tamper condition, the PDS8006 also logs the number of tamper attempts that have occurred. This is a cumulative number that the host controller can use to analyze abnormally high tamper activity.

Application Information...

The PDS8006 provides a cryptographic system with secure storage of keys. In a typical application, two types of keys are stored. One key is used to encrypt data common to similar systems. This key can be the same for all similar units which have the same security policy. Using the same key can simplify the production and distribution of updates. A second key is used to protect keying material which is unique to an individual unit or group of units. It is important that this key be different for each unit so that compromising one unit does not lead to the compromise of other units. The PDS8006 stores this keying material in battery backed SRAM, performs an authentication function, and, if successful, releases the authentication result. The authentication data input is sent as part of the authenticate command formed by the system processor from a user PIN input, from a Cryptographic Ignition Key (CIK), from data derived from a biometric measurement, or from a combination of these sources.

Battery-Backed Ram Operation...

The first time the battery is connected to the PDS8006, the device goes through an initialization state and is ready for Vcc to be supplied. The PDS8006 detects the presence of all power supplies and will automatically switch to the proper operational mode. When in the battery-backed RAM mode of operation, the current draw of the PDS8006 is less than 500nA, allowing for a seven-year unattended shelf life when used with a 128mAh battery.

Maintenance Mode...

Systems that use the PDS8006 may be designed so that the battery that maintains the contents of the battery-backed RAMs can be replaced without affecting the contents of the battery-backed RAMs. This can be done by applying Vcc to the PDS8006 while the battery is being changed. Additionally, the tamper input can be disabled through an authentication controlled maintenance mode. The input can be re-enabled once the maintenance is completed. This allows systems to be maintained without causing an intrusion detection and Zeroization of the battery backed SRAM variables.