Learn how InferTrust™ uses device-bound cryptographic keys stored in TPMs and secure enclaves to prevent record fabrication.
Device-bound keys are a fundamental security mechanism in InferTrust™ (Patent Pending). They are cryptographic signing keys that are generated and stored within hardware security modules (HSMs), Trusted Platform Modules (TPMs), or secure enclaves on the device where AI inference occurs. The private key never leaves the hardware boundary.
If signing keys were stored in software, a malicious actor with administrative access could extract the key and fabricate decision records that appear authentic. By binding keys to hardware, InferTrust™ ensures that valid signatures can only be generated on the authorized device at the moment of inference. Even a system administrator with root access cannot extract the private key from the hardware module.
InferTrust™ supports automated key rotation where new keys are generated within the hardware module on a configurable schedule. Previous keys remain available for verification purposes, but new decisions are signed with the current key. Key rotation can occur without network connectivity using pre-provisioned rotation schedules.
The corresponding public key is distributed to verification systems, auditors,and regulators. Anyone with the public key can verify that a decision record was signed by the authorized device, but no one can use the public key to create new signatures. This enables independent verification without compromising signing capability.