I'm setting up a system where devices are going to be tested right after production. Each device has an individually given AES-key, which must be known in order to communicate. Those individual keys are delivered by the device manufacturer in a shipment-file (one per ~1000 devices), which is itself RSA encrypted. Only the test authority has the private key to decrypt such shipment files.
The current plan was first to export the device keys from the shipment files into a central database. This will be done once for a delivery of ~1000 devices. The test application will then access this database to get out the individual device keys.
Putting all device keys directly into the database does work but isn't a very attractive solution: everybody gaining access to the database automatically gains access to the device keys.
Keeping in mind that this is very vulnerable, how can I improve security? I could AES encrypt the device keys before writing into the database, but then the test application has to know this private AES key. The problem just shifts to "how to keep this internal key secret". So it is a little better, but still unsatisfactory.
What else would be an acceptable solution? Maybe using a smart card?