Secure moving of secret data from an enclave to another enclave

Abstract

A method for securely moving secret data from a first enclave (8; 108) to a second enclave (10) comprises a first procedure and a second procedure. The first procedure includes, within the first enclave (8; 108), encrypting secret data using an administrator encryption key (12a; 112) and sending the encrypted secret data to an administrator system. The administrator system decrypts the encrypted secret data using an administrator decryption key (12b; 113) corresponding to the administrator encryption key (12a; 112), and re-encrypts the secret data using a destination encryption key (14a) received from the second enclave (10). The second procedure includes the administrator system sending the re-encrypted secret data to the second enclave (10) and, within the second enclave (10), decrypting the re-encrypted secret data using a destination decryption key (14b) corresponding to the destination encryption key (14a), and storing the secret data in the second enclave (10).

Description

[0001] Secure Data Storage

[0002] TECHNICAL FIELD

[0003] This invention relates to a system for securely storing secret data and methods of operating the same.

[0004] BACKGROUND

[0005] In a computer system, an enclave is a hardware-protected, private region of memory within which confidential data can be stored and within which software can be stored and securely executed. The enclave is isolated from other regions of memory, including those regions of memory storing an operating system or other application software. In order to avoid leakage of confidential data, all sensitive data crossing the boundary into and out of the enclave must be encrypted. Incoming data may be decrypted and processed within the enclave.

[0006] Enclaves may be provided by trusted execution environments (TEEs) such as Intel’s Software Guard Extensions (Intel SGX) or Advanced Micro Devices’ Secure Encrypted Virtualization (AMD SEV).

[0007] Certain secret data, such as a cryptographic private key, is conventionally stored only within a particular enclave in order to maintain the data’s confidentiality. If the enclave becomes unavailable, e g. due to hardware failure, then the secret data stored in the enclave is lost. The lifetime of the secret data is therefore tied to the lifetime of the enclave in which it is stored, and to the lifetime of the computing device hosting the enclave.

[0008] Some mechanisms exist for allowing secret data to persist across a restart of an enclave (e.g. Intel SGX Sealing). However, in such cases, the secret data remains bound to the particular processor that is operating the enclave. This means that, if the processor is rendered inoperable (e.g. due to hardware failure), then the secret data is lost. Thus, the lifetime of the secret data is still limited by the lifetime of the enclave or computing device in which it is stored.

[0009] Embodiments of the present invention seek to provide an improved method and system for securely storing secret data. SUMMARY OF THE INVENTION

[0010] From a first aspect, the invention provides a method for securely moving secret data from a first enclave to a second enclave, the method comprising: as a first procedure, i) within a first enclave, encrypting secret data stored in the first enclave using an administrator encryption key to create encrypted secret data; and ii) outputting the encrypted secret data from the first enclave and sending the encrypted secret data to an administrator system; the method further comprising: the administrator system receiving a destination encryption key from a second enclave; and the administrator system decrypting the encrypted secret data using an administrator decryption key, corresponding to the administrator encryption key, and re-encrypting the secret data using the destination encryption key to create reencrypted secret data; and the method further comprising: as a second procedure, i) the administrator system sending the re-encrypted secret data to the second enclave; and ii) within the second enclave, decrypting the re-encrypted secret data using a destination decryption key, corresponding to the destination encryption key, and storing the secret data in the second enclave.

[0011] When viewed from a further aspect, the invention provides a system for securely storing secret data, the system comprising: a first computing device hosting a first enclave storing secret data; a second computing device hosting a second enclave; and an administrator system; wherein: the first computing device is configured, within the first enclave, to encrypt the secret data using an administrator encryption key to create encrypted secret data; the first computing device is configured to output the encrypted secret data from the first enclave and to send the encrypted secret data to the administrator system; the administrator system is configured to: receive a destination encryption key from the second enclave; decrypt the encrypted secret data using an administrator decryption key, corresponding to the administrator encryption key; re-encrypt the secret data using the destination encryption key; and send the re-encrypted secret data to the second enclave; the second computing device is configured, within the second enclave, to decrypt the re-encrypted secret data using a destination decryption key, corresponding to the destination encryption key; and the second computing device is configured to store the secret data in the second enclave.

[0012] Thus it will be seen that, in accordance with embodiments of the invention, secret data, stored in a first enclave, may be transferred securely to a second enclave by first being backed-up to an administrator system, using the first procedure, and then subsequently being restored to the second enclave, using the second procedure. The first procedure may be performed as a backup procedure (optionally in combination with one or more further steps). The second procedure may be performed as a restore procedure (optionally in combination with one or more further steps). During the backup procedure, the secret data is encrypted within the first enclave using an administrator encryption key before the encrypted secret data is output from the first enclave and sent to the administrator system. The administrator system may be a trusted system, and has access to an administrator decryption key with which the encrypted secret data can be decrypted.

[0013] During the restore procedure, the administrator system receives, from a second enclave, a destination encryption key. Immediately or at a later time, the administrator system re-encrypts the decrypted secret data using the destination encryption key and sends the re-encrypted secret data to the second enclave. The re-encrypted secret data is decrypted in the second enclave using a destination decryption key.

[0014] In this way, the secret data can be protected from loss if the first enclave ceases to be available (e.g. through being erased or damaged, or due to a hardware or software failure of the first computing device, or a network error). In such a situation, the second procedure can be initiated to restore (i.e. clone) the secret data to the second enclave. In some embodiments, the secret data may always be encrypted whenever it is outside the first enclave or the second enclave or the administrator system, thereby helping to ensure the confidentiality of the secret data during the backup and restore procedures. Furthermore, the secret data may be, and preferably is, encrypted using different cryptographic keys depending on where it is being sent. This means that it is not required for cryptographic decryption keys to be send from one enclave to another. Instead, the secret data is decrypted by the administrator system using the administrator decryption key and is re-encrypted by the administrator system using the destination encryption key. As a result, the administrator decryption key need not be provided to the second enclave, which might otherwise risk compromising the security of data stored in the first enclave.

[0015] The administrator system may receive the destination encryption key from the second enclave before, during, or after the first procedure. Moreover, the administrator system need not decrypt the encrypted secret data or re-encrypt the secret data immediately after receiving the destination encryption key. The administrator system may decrypt the encrypted secret data or re-encrypt the secret data in response to receiving an initiation signal (e.g. indicating that the first enclave and / or the first computing device is unavailable).

[0016] The first computing device, hosting the first enclave, is preferably different from the second computing device, hosting the second enclave. In some embodiments, the first computing device and / or the second computing device comprises a respective processor configured to provide a respective trusted execution environment (TEE), e.g. using Intel SGX, or AMD SEV, or Arm TrustZone. The TEE is preferably configured to implement the respective enclave of the first computing device or the second computing device. Each of the first computing device, the second computing device and the administrator system may comprise a respective processor and a memory storing software for execution by the processor, wherein the software comprises instructions which, when executed by the processor, cause the processor to perform any of the method steps disclosed herein. At least some of the software instructions may be for execution within an enclave of the respective device or system. The administrator encryption key is preferably different from the destination encryption key. The administrator decryption key is preferably different from the destination decryption key.

[0017] The administrator key could be a symmetric key; however, preferably, the administrator encryption key and the administrator decryption key together form a first cryptographic key pair. The first cryptographic key pair is preferably an asymmetric key pair. The administrator encryption key may correspond to a public key of the first cryptographic key pair. The administrator decryption key may correspond to a private key of the first cryptographic key pair. The destination key could be a symmetric key; however, preferably, the destination encryption key and the destination decryption key together form a second cryptographic key pair. The second cryptographic key pair is preferably an asymmetric key pair. The destination encryption key may correspond to a public key of the second cryptographic key pair. The destination decryption key may correspond to a private key of the second cryptographic.

[0018] In some embodiments, the method comprises generating the destination encryption key (and, optionally, the destination decryption key). The destination encryption key is preferably generated in the second enclave.

[0019] In some embodiments, a plurality of administrator decryption keys is required in order for the administrator system to decrypt the encrypted secret data. Preferably each of the plurality of administrator decryption keys corresponds to a respective administrator encryption key of a plurality of administrator encryption keys. Preferably each of the plurality of administrator encryption keys is used to encrypt the secret data in the first enclave. The secret data may be encrypted in the first enclave using a secret sharing algorithm, e.g. Shamir’s secret sharing algorithm. The plurality of administrator encryption keys (e.g. and the plurality of administrator decryption keys) are preferably different to one another.

[0020] In some embodiments, the system comprises a repository for storing data, e.g. encrypted secret data. The repository preferably comprises a database. The system may comprise a server configured to host the repository. In some embodiments, the method comprises outputting the secret data from the first enclave to the administrator system via the repository. The method preferably further comprises the administrator system receiving the encrypted secret data from the repository.

[0021] Preferably the first computing device is configured to encrypt periodically the secret data stored in the first enclave. This may generate a plurality of versions of encrypted secret data.

[0022] Each version of encrypted secret data may be output from the first enclave and sent to the administrator system. Preferably each version of encrypted secret data is output from the first enclave and sent to the repository. The repository may be configured to store only the most recent version of the encrypted secret data. Preferably, however, the repository is preferably configured to store a plurality of versions (e.g. each version) of the encrypted secret data. The administrator system may receive each version of the encrypted secret data from the repository, or may receive only a subset of the versions of encrypted secret data (e.g. the most recent version of the encrypted secret data at the time). Each version of encrypted secret data may be timestamped.

[0023] By periodically sending versions of the encrypted data stored within the first enclave to the administrator system and / or the repository, the secret data can be securely backed up. This can help to ensure that a recent version of the secret data is available for storing in the second enclave, and can also allow previous versions of the secret data to be stored in the second enclave, as necessary. This may be helpful in the event that it is determined that the secret data stored in the second enclave has become corrupted, for example.

[0024] In some embodiments, all of the plurality of administrator decryption keys (e.g. each of the administrator decryption keys that corresponds to an administrator encryption key used to encrypt the secret data in the first enclave) are required in order to decrypt the encrypted secret data.

[0025] In some embodiments, a threshold number of the plurality of administrator decryption keys is required in order to decrypt the encrypted secret data. The threshold is preferably lower than the number of administrator decryption keys. This may allow the encrypted secret data to be decrypted only once a quorum of administrators has provided their respective decryption keys, which may increase security. Preferably, any combination of administrator decryption keys that reaches or exceeds the threshold number may allow the encrypted secret data to be decrypted. This may improve the flexibility of the decryption process.

[0026] In some embodiments, the administrator system comprises an administrator computing device. Preferably, the administrator system comprises a plurality of administrator computing devices. Preferably, each of the administrator computing devices stores a respective administrator decryption key of the plurality of administrator decryption keys.

[0027] Preferably one or more (e.g. all) of the first computing device, the second computing device, the administrator system, and the repository are configured to communicate with each other over a (e.g. wired and / or wireless) network.

[0028] In some embodiments, the method comprises detecting that the first enclave is unavailable. Preferably the method comprises, in response to detecting that the first enclave is unavailable, performing the second procedure. The method may comprise, in response to detecting that the first enclave is unavailable, the administrator system decrypting the encrypted secret data using an administrator decryption key. The method may comprise, in response to detecting that the first enclave is unavailable, the administrator system re-encrypting the secret data using the destination encryption key.

[0029] The administrator system and / or the second computing device and / or a further component of the system may be configured to detect that the first enclave is unavailable. The administrator system and / or the second computing device and / or the further component may be configured to output an initiation signal in response to detecting that the first enclave is unavailable. In some embodiments, the step of detecting unavailability of the first enclave is performed by a user.

[0030] The administrator system and / or the second computing device and / or a further component of the system may comprise an interface for a user to initiate the second procedure. The interface may be configured to output an initiation signal in response to a user interaction.

[0031] The administrator system preferably comprises a cryptographic engine for decrypting and re-encrypting the secret data. Preferably each of the administrator devices has access to the cryptographic engine.

[0032] The administrator system is preferably configured to provide the administrator decryption key to the cryptographic engine. Each of the administrator devices is preferably configured to provide, to the cryptographic engine, their respective administrator decryption key. The administrator system (e.g. one or more or all of the administrator devices) is preferably configured to provide some or all of the encrypted secret data to the cryptographic engine for decryption using the administrator decryption key(s).

[0033] The administrator system (e.g. one or more or all of the administrator devices) is preferably configured to retrieve, from the cryptographic engine, some or all of the decrypted secret data.

[0034] The administrator system (e.g., one or more of the administrator devices) is preferably configured to provide the destination encryption key to the cryptographic engine. In some embodiments, each of the one or more administrator devices is configured to receive, from the second enclave, a respective copy of the destination encryption key. In some embodiments, each of the one or more administrator devices is configured to receive, from the second enclave, a respective portion of the destination encryption key. The administrator system (e.g. one of the administrator devices) is preferably configured to generate the destination encryption key from one or more of the portions of the destination encryption key. For example, the portions of the destination encryption key may be shares of the destination encryption key obtained using a secret sharing algorithm, e.g. Shamir’s secret sharing algorithm.

[0035] In some embodiments, the administrator system comprises an air-gapped device (i.e. a device not connected to any network, or not to any public network such as the Internet). The air-gapped device preferably comprises the cryptographic engine. The air-gapped device is preferably air-gapped from the network of the first and second computing devices and the administrator devices. This may help to reduce the vulnerability of the cryptographic engine to attacks that could compromise the confidentiality of the secret data. The secret data and / or the administrator decryption key(s) and / or the destination encryption key is preferably communicated to the air-gapped device by a non-network channel (e.g. by the movement of a physical storage medium). Preferably each of the plurality of administrator computing devices has access to the cryptographic engine.

[0036] In some embodiments, the method further comprises generating a first attestation report for the encrypted secret data. The first attestation report may be generated within the first enclave. It may attest software stored for execution within the first enclave The first attestation report preferably associates the encrypted secret data with an identity (e.g. a public key) of the first enclave. The first attestation report may associate the encrypted secret data with a public key of the first enclave. The first attestation report may comprise a certificate signed by the public key of the first enclave.

[0037] Preferably the method comprises outputting the first attestation report from the first enclave. The first attestation report may be sent to the administrator system (e.g. via the repository) together with the encrypted secret data, e.g. in a backup package.

[0038] The administrator system may receive the first attestation report (e.g. from the repository) together with the encrypted secret data, e.g. the administrator system may receive the backup package.

[0039] In some embodiments, the method further comprises the administrator system validating the first attestation report. Preferably, the administrator system validates the first attestation report before sending the re-encrypted secret data to the second enclave, e.g. before re-encrypting the secret data using the destination encryption key, e.g. before decrypting the encrypted secret data.

[0040] In some embodiments, the method further comprises generating a second attestation report for the destination encryption key. The second attestation report may be generated within the second enclave. It may attest software stored for execution within the second enclave. The second attestation report preferably associates the destination encryption key with an identity (e.g. a public key) of the second enclave. The second attestation report may associate the destination encryption key with a public key of the second enclave. The second attestation report may comprise a certificate signed by the public key of the second enclave.

[0041] Preferably the method comprises outputting the second attestation report from the first enclave. The second attestation report may be sent (e.g. to the repository and / or the administrator system) together with the destination encryption key, e.g. in a restore package.

[0042] The administrator system may receive the second attestation report (e.g. from the repository) together with the destination encryption key. The administrator system may receive the restore package.

[0043] In some embodiments, the method further comprises the administrator system validating the second attestation report. Preferably, the administrator system validates the second attestation report before sending the re-encrypted secret data to the second enclave, e.g. before re-encrypting the secret data using the destination encryption key, e.g. before decrypting the encrypted secret data. Preferably, if the administrator system fails to validate the second attestation report, the method is aborted.

[0044] Preferably, if the administrator system fails to validate the first attestation report and / or the second attestation report, the method is aborted. The administrator system may validate the first attestation report and / or the second attestation report using the air-gapped device. Validating the first attestation report and / or the second attestation report may help to maintain the integrity of the encrypted secret data and / or the destination encryption key, as it may be verified that the encrypted secret data and / or the destination encryption key has been provided by an expected trustworthy source, rather than by a potentially hostile unknown party.

[0045] In some embodiments, the method further comprises the administrator system determining whether the secret data differs from an earlier version of secret data. In some embodiments, the method comprises the administrator system comparing the secret data with the earlier version of secret data. The method may comprise the administrator system, in response to determining that the secret data differs from the earlier version of secret data, aborting the re-encryption of the secret data or the provision of the re-encrypted secret data to the second enclave. This can help to prevent secret data that is expected to be unchanged, e.g. a cryptographic key or a password, being stored in the second enclave in a modified, e.g. corrupted, state, which can help to maintain the integrity of the secret data.

[0046] In some embodiments, the method further comprises the administrator system signing the secret data before encrypting the secret data using the destination encryption key. The administrator system may sign the secret data using a public key of the administrator system. One or more, e.g. each, of the plurality of administrator computing devices may sign the secret data, e.g. using a respective public key of the administrator computing device.

[0047] In some embodiments, the method comprises the administrator system sending the re-encrypted data to the second enclave directly. However, the administrator system may send the re-encrypted data to the second enclave indirectly, i.e. via a further component of the system. The administrator system may send the reencrypted data to the repository. The re-encrypted data may be send to the second enclave from the repository.

[0048] Features of any aspect or embodiment described herein may, wherever appropriate, be applied to any other aspect or embodiment described herein. Where reference is made to different embodiments or sets of embodiments, it should be understood that these are not necessarily distinct but may overlap.

[0049] BRIEF DESCRIPTION OF DRAWINGS

[0050] Certain embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0051] Figure 1 is a schematic diagram of a computing system in accordance with an embodiment of the present invention; Figure 2 is a flow diagram showing a method for securely moving secret data from the first enclave of the system of Figure 1 to the second enclave in accordance with an embodiment of the present invention; and

[0052] Figure 3 is a schematic diagram of a computing system in accordance with a further embodiment of the present invention.

[0053] DETAILED DESCRIPTION

[0054] Figure 1 is a schematic of a system 2 in accordance with an embodiment of the present invention.

[0055] The system 2 includes a first computing device 4 and a second computing device 6, respectively comprising a first enclave 8 and a second enclave 10. Each enclave 8, 10 is a protected private region of memory that is operated by a respective trusted execution environment (TEE), e.g. implementing Intel Software Guard Extensions (SGX) or Advanced Micro Devices Secure Encrypted Virtualization (AMD SEV) or Arm Trustzone.

[0056] The first enclave 8 stores secret data X, a first ‘administrator’ encryption cryptographic key 12a, and a second ‘administrator’ encryption cryptographic key 12b. The first administrator encryption cryptographic key 12a and the second administrator encryption cryptographic key 12b are provisioned to the first enclave 8 via trusted configuration, and the first enclave 8 verifies the integrity of the configuration using a hardwired key.

[0057] The second computing device 6 is configured to generate and store a ‘destination’ encryption cryptographic key 14a within the second enclave 10 during a ‘restore’ procedure, as will be described in more detail below.

[0058] The system 2 further comprises an administrator system comprising two administrator devices 16a, 16b that are in communication with the second computing device 6 via a wired and / or wireless network. The administrator system further comprises an air-gapped (i.e. offline) device 18, to which the administrator devices 16a, 16b have physical access. The air-gapped device 18 comprises a cryptographic engine 19. The system 2 further comprises a server 22. The first computing device 4, the second computing device 6, and the administrator devices 16a, 16b are able to access a database 20, operated on the server 22, via the wireless network.

[0059] Operation of the system of Figure 1 will now be described with reference to the flow diagram of Figure 2.

[0060] In a first step S102, during operation of the first enclave 8, the secret data X stored within the first enclave 8 is periodically backed up by being encrypted and transmitted to the server 22 via the network for storage in the database 20 as part of a backup procedure. For example, an encrypted backup of the secret data X may be transmitted to the database 20 every ten minutes, although it could be more or less frequent, or may be irregular (e.g. being initiated by a human operator) rather than periodic. As part of this process, the secret data X is encrypted using both the first and second administrator encryption cryptographic keys 12a, 12b to generate encrypted secret data X . Any suitable encryption mechanism may be used to encrypt the secret data X using both keys 12a, 12b.

[0061] The first computing device 4 generates an attestation report 24 that links the encrypted secret data X±to a public key of the first enclave 8, and then, in a second step S104, sends a “backup package” 26, comprising the attestation report 24 and the encrypted secret data X , to the server 22 for storage in the database 20. The database 20 stores this latest version of the encrypted secret data Xltas well as one or more previous versions of encrypted secret data. The attestation report 24 may uniquely link the encrypted secret data A^to the first enclave 8 and / or to a CPU of the first computing device 4 in a way that can be remotely attested.

[0062] As part of a restore procedure, which will now be described, the secret data X is transferred from the database 20 to the second enclave 10. This procedure may be performed if the first enclave 8 becomes unavailable (e.g. long-term or permanently) for any reason — e.g. due to a failure or unavailability of the first computing device 4. It may be initiated automatically (e.g. in response to a system, such as the second computing device 6, detecting its unavailability) or by a human user. In some embodiments it is initiated by, or using, the second computing device 6. The restore procedure involves the second computing device 6 operating the second enclave 10 in a restore mode of operation.

[0063] In a third step S106, a destination encryption cryptographic key 14a and a destination decryption cryptographic key 14b are generated within the second enclave 10, as well as an attestation report 28 that links the destination encryption cryptographic key 14a to a public key of the second enclave 10. The destination encryption cryptographic key 14a and the destination decryption cryptographic key 14b are respectively the public key and the private key of a key pair. The destination encryption cryptographic key 14a and the attestation report 28 are transmitted to and stored in the database 20 in a “restore package” 30. The attestation report 28 may uniquely link the destination encryption cryptographic key 14a to the second enclave 10 and / or to a CPU of the second computing device 6 in a way that can be remotely attested.

[0064] In a fourth step S108, once the restore package 30 has been stored in the database 20, the administrator devices 16a, 16b retrieve the restore package 30 and the backup package 26 from the database 20. If multiple backup packages are stored in the database (i.e. corresponding to previously-generated backup packages), then the administrator devices 16a, 16b retrieve the most recent backup package from the database 20.

[0065] Before decrypting the secret data X contained within the backup package 26, the administrator devices 16a, 16b use the offline device 18 to validate the respective attestation reports 24, 28 of the backup package 26 and the restore package 30 in order to verify the integrity of the backup package 26 and the restore package 30. The administrator devices 16a, 16b verify that the attestation reports 24, 28 are correct and that the backup package 26 is signed with the public keys of the first and second enclaves 8, 10. The administrator devices 16a, 16b also use the offline device 18 to determine whether the second enclave 10 is permitted to receive the secret data X according to a data flow policy. For example, the administrator devices 16a, 16b may use the offline device 18 to verify that both the first enclave 8 and the second enclave 10 have the same author (e.g. the same MRSIGNER value, in the case of Intel SGX enclaves). In a fifth step S110, once the validation steps have been completed, the administrator devices 16a, 16b use the cryptographic engine 19 of the offline device 18 to decrypt the secret data X stored in the backup package 26. The encrypted secret data Xtis decrypted using both a first administrator decryption key 13a, which is part of a key pair 12a, 13a also comprising the first administrator encryption key 12a, and a second administrator decryption key 13b, which is part of a key pair 12b, 13b also comprising the second administrator encryption key 13b.

[0066] The administrator devices 16a, 16b may additionally retrieve and decrypt a previous version of encrypted secret data from the database 20, and compare this previous version with the newly decrypted secret data X in order to determine whether the newly decrypted secret data X differs from the previous version of secret data. The previous version of encrypted secret data is the version of the secret data that was most recently restored to an enclave (e.g. the first enclave 8). In accordance with a ‘stage change policy’, the administrator devices 16a, 16b abort the restore procedure in response to determining that the newly decrypted secret data X differs from the previous version of secret data.

[0067] The administrator devices 16a, 16b then jointly sign the secret data X and, in a sixth step S112, use the cryptographic engine 19 of the offline device 18 to re-encrypt the secret data X using the destination encryption cryptographic key 14a, as provided by the second computing device 6 in the restore package 30. In a seventh step S114, the re-encrypted secret data X2is sent from the administrators 16a, 16b to the database 20 via the wireless network, and is retrieved from the database 20 by the second computing device 6 for storage in the second enclave 10.

[0068] In an eighth step, the re-encrypted secret data X2is decrypted within the second enclave 10 using the destination decryption cryptographic key 14b. The signature of the administrator devices 16a, 16b is verified within the second enclave 10 in order to validate the integrity of the secret data X received.

[0069] Figure 3 is a schematic of a system 102 in accordance with a further embodiment of the present invention. The system 102 is essentially the same as the system 2 of Figure 1 , except that the system 102 comprises four administrator computing devices 116a, 116b, 116c, 116d, rather than two 16a, 16b. Each of the administrator computing devices 116a, 116b, 116c, 116d stores a respective administrator decryption cryptographic key 113 that is part of a key pair that also comprises a corresponding administrator encryption key 112, stored in the first enclave 108.

[0070] Whereas, in the system 2 of Figure 1 , both of the administrator decryption cryptographic keys 13a, 13b are required in order to decrypt the encrypted secret data Xl tin the system 102 of Figure 3 a threshold of only three of the four administrator decryption cryptographic keys 113 are required. Any combination of three administrator decryption cryptographic keys 113 may be used with the cryptographic engine 119 of the offline device 118 to decrypt the encrypted secret data Xr.

[0071] It will be appreciated by those skilled in the art that the invention has been illustrated by describing one or more specific embodiments thereof, but is not limited to these embodiments; many variations and modifications are possible, within the scope of the accompanying claims.

Claims

CLAIMS1. A method for securely moving secret data from a first enclave to a second enclave, the method comprising: as a first procedure, i) within a first enclave, encrypting secret data stored in the first enclave using an administrator encryption key to create encrypted secret data; and ii) outputting the encrypted secret data from the first enclave and sending the encrypted secret data to an administrator system; the method further comprising: the administrator system receiving a destination encryption key from a second enclave; and the administrator system decrypting the encrypted secret data using an administrator decryption key, corresponding to the administrator encryption key, and re-encrypting the secret data using the destination encryption key to create reencrypted secret data; and the method further comprising: as a second procedure, i) the administrator system sending the re-encrypted secret data to the second enclave; and ii) within the second enclave, decrypting the re-encrypted secret data using a destination decryption key, corresponding to the destination encryption key, and storing the secret data in the second enclave.

2. The method of claim 1, further comprising detecting that the first enclave is unavailable and, in response to detecting that the first enclave is unavailable: the administrator system receiving the destination encryption key from the second enclave; the administrator system decrypting the encrypted secret data using the administrator decryption key, and re-encrypting the secret data using the destination encryption key to create re-encrypted secret data; and performing the second procedure.

3. The method of claim 1 or 2, wherein a plurality of administrator decryption keys is required in order for the administrator system to decrypt the encrypted secret data.

4. The method of claim 3, wherein the administrator system comprises a plurality of administrator computing devices.

5. The method of claim 4, wherein each of the administrator computing devices stores a respective administrator decryption key of the plurality of administrator decryption keys.

6. The method of claim 4 or 5, wherein a threshold number of the plurality of administrator decryption keys is required in order to decrypt the encrypted secret data.

7. The method of any of claims 4 to 6, wherein the administrator system comprises an air-gapped device that comprises a cryptographic engine for decrypting and re-encrypting the secret data, and wherein each of the plurality of administrator computing devices has access to the cryptographic engine.

8. The method of any preceding claim, further comprising: generating a first attestation report for the encrypted secret data that associates the encrypted secret data with an identity of the first enclave; outputting the first attestation from the first enclave; sending the first attestation to the administrator system; and the administrator system validating the first attestation before decrypting the encrypted secret data.

9. The method of any preceding claim, further comprising: generating a second attestation report for the destination encryption key that associates the destination encryption key with an identity of the second enclave; outputting the second attestation from the second enclave; sending the second attestation to the administrator system; and the administrator system validating the second attestation before decrypting the encrypted secret data.

10. The method of any preceding claim, wherein the encrypted secret data is sent to the administrator system via a repository.11 . The method of any preceding claim, further comprising the administrator system determining whether the secret data differs from an earlier version of secret data.

12. The method of claim 11 , further comprising the administrator system aborting the re-encryption of the secret data or the provision of the re-encrypted secret data to the second enclave in response to determining that the secret data differs from the earlier version of secret data.

13. The method of any preceding claim, further comprising the administrator system signing the secret data before encrypting the secret data using the destination encryption key.

14. The method of any preceding claim, wherein the administrator encryption key and the administrator decryption key together form an asymmetric key pair and / or wherein the destination encryption key and the destination decryption key together form an asymmetric key pair.

15. A system for securely storing secret data, the system comprising: a first computing device hosting a first enclave storing secret data; a second computing device hosting a second enclave; and an administrator system; wherein: the first computing device is configured, within the first enclave, to encrypt the secret data using an administrator encryption key to create encrypted secret data; the first computing device is configured to output the encrypted secret data from the first enclave and to send the encrypted secret data to the administrator system; the administrator system is configured to: receive a destination encryption key from the second enclave; decrypt the encrypted secret data using an administrator decryption key, corresponding to the administrator encryption key; re-encrypt the secret data using the destination encryption key; and send the re-encrypted secret data to the second enclave;the second computing device is configured, within the second enclave, to decrypt the re-encrypted secret data using a destination decryption key, corresponding to the destination encryption key; and the second computing device is configured to store the secret data in the second enclave.

16. The system of claim 15, further comprising a repository, wherein the first computing device is configured to send the encrypted secret data to the administrator system via the repository.

17. The system of claim 16, wherein the first computing device is configured to encrypt periodically the secret data stored in the first enclave to generate a plurality of versions of encrypted secret data and to send each version of encrypted secret data from the first enclave to the repository.

Images