Key Management Level

 EncryptionAlgorithmThe only purpose of all management principles of the key is to reduce the consequences for the application of the system and the key to the password if one or more secret keys are known by unauthorized persons. Because the password key can be taken home by anyone, it is analyzed in detail. Therefore, they are naturally exposed to the most severe attacks. The methods used include one-host-one-key (export Key), one-class-one-key (Key diversity), one-time-one-key (Session Key), and one-key-multiple-version.

Unique password per machine: the keys of each key are different. When a key is issued, the root key is distributed by the device number and then written to the device. Because the device number is unique in the system, the keys of each device are different and the attack on one key is successful, the loss is limited to a single device and does not constitute a threat to the system.

One-class-one password: to reduce the impact of key leakage, separate keys are often used for different purposes. common key types include: external authentication keys, application maintenance keys, password unlocking keys, password reinstallation keys, encryption and decryption keys, internal authentication keys, and password keys.

One-time password: for many applications, especially in the field of secure data transmission, session keys, also known as temporary keys, are usually used and destroyed immediately after they are used. The real random number generator of the password key makes the generated temporary key irregular, and the attack is basically hopeless.

One-key multi-version: assuming that one type of key for a password is frequently used and plays an important role in the system, it is most likely to become an attack object. If the attack succeeds, the entire application system will be disabled, and the password key publisher will replace all the password keys, resulting in serious harm. When an important key is released, multiple versions of the key are written. If a key of one version is successfully attacked, the application system can immediately enable the key of the next version without any need to replace all the password keys.