PKI Tools: Key Ceremony, Certificate Machine, Signing Machine
In today's regulatory landscape, achieving security by design is paramount. Security Pattern offers an in-house developed, mature toolkit that integrates seamlessly into your Secure Development LifeCycle (SDLC). Our PKI Tools provide the technical mechanisms and supporting tools needed to achieve high-level objectives like data integrity, secure updates, and protection from unauthorized access.
The PKI toolkit is composed of three core components (key ceremony, certificate machine, signing machine), designed to formalize workflows and enforce necessary security constraints across your organization.
Core Components
Key Ceremony
The Key Ceremony is the foundational step in establishing your PKI. This controlled procedure acts first to produce the system’s cryptographic material, including the Root and Intermediate Certification Authorities (CAs).
-
Secure Execution: Performed on-site with Security Pattern experts using dedicated, air-gapped hardware to ensure zero external communication during key generation.
-
Hardware Protection: All generated private keys are stored directly onto customer-kept Hardware Security Modules (HSMs), such as physical Secure Hardware Tokens or cloud-based HSMs.
-
Long-Term Governance: Structured to support a 20+ year lifecycle, defining the optimal balance between high-level key protection and robust disaster recovery.
Certificate Machine
The Certificate Machine leverages the material from the Key Ceremony to provide unique digital identities to each device during the manufacturing process.
-
Line Integration: A Python-based application or executable that your production team runs directly on the manufacturing line.
-
Identity Management: It generates compliant X.509 digital certificates and private keys for new entities, ensuring strict control over unique device identities.
-
Flexible Interface: Includes a comprehensive set of APIs to integrate smoothly with existing production software and hardware.
Signing Machine: Code Authenticity & Integrity
The Signing Machine secures your software by performing digital signatures and optional encryption on firmware binaries during the development phase.
-
R&D Empowerment: Used by development teams within their R&D environment to sign code before release.
-
Compatibility: Ensures cryptographic coherence and compatibility across diverse hardware platforms and secure boot mechanisms.
-
Workflow Integration: Provides APIs for seamless integration into your existing build machines and automated CI/CD pipelines.
PKI Tools: The Key Ingredients
PKI with dedicated CA
State-of-the-art PKI with X.509-v3 standard certificates
Secured procedure for Device certificates generation
CA’s Private keys securely stored
Benefits
Safe and reliable set up of PKI
State-of-the art support for Smartphone and PCs connections
Smart Key provisioning process
Each device is provisioned with a unique set of keys
• For secure communication
• For secure firmware upgrade
• Application-specific keys
The Key provisioning process is secured
Benefits
Ability to secure data exchange between devices and cloud
Fine-grained device identification
Secure Key storage architecture
Each device enables the use of a secure element
The SE safely stores secret and private data
The SE enables secure exchange with other system elements
Benefits
Non cloneable device
IP protection
Secure mutual authentication with other parties of infrastructure
Secure FOTA
The firmware is encrypted and signed
The devices can determine if firmware is genuine
Benefits
Firmware update accessible only for genuine devices
Only genuine firmware can be installed on devices
Why Choose Our Solution?
-
Mature & Validated: A solution shaped and validated by extensive deployment experience across different industrial environments.
-
Easy Integration: Designed to enhance control without disrupting established secure development processes.
-
Audit-Grade Traceability: Produces detailed logs for governance, supporting compliance with standards such as IEC 62443 and the Cyber Resilience Act (CRA).
