System and method for managing key based on trusted execution environment for comprehensive state protection of key data

Abstract

This invention discloses a key management system and method for comprehensive state protection of key data based on a Trusted Execution Environment (TEE). According to one embodiment, the key management system may include: a key management server, which encrypts user keys using a root key stored in a Hardware Security Module (HSM) and manages them by storing them in a permanent key repository; and a key processing cluster, which implements and runs a user-specific encryption / decryption processing system using a virtual machine or container based on a TEE, decrypts the encrypted user keys stored in the permanent key repository using the root key, and uses the decrypted user keys within the TEE to perform encryption / decryption functions on the user-specific encryption / decryption processing system.

Images