Cloud-Based Secure Enclave for WebAuthn Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
WebAuthn authentication systems relying on general-purpose computing devices lack robust security, as they cannot provide the same level of protection as on-device secure enclaves, leaving secret keys vulnerable to theft when the device is compromised, especially since not all devices have built-in secure enclaves.
Innovation Solution
Implementing a cloud-based secure enclave that stores and manages secret keys, using secure tunnel communication to protect against unauthorized access, ensuring the secret key cannot be stolen even if the user computing device is compromised, by encrypting and decrypting the key within the cloud-based secure environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If WebAuthn authentication uses general-purpose computing devices, then ease of operation is improved, but security is worsened as secret keys become vulnerable to theft when the device is compromised
Solution Approach 1:
The system segments the authentication functionality by separating the secret key storage and cryptographic operations from the general-purpose computing device. A dedicated secure enclave is introduced as a separate security module that handles sensitive operations, while the general-purpose device handles user interaction and application logic. This segmentation allows the system to maintain ease of operation on general-purpose devices while achieving security comparable to specialized hardware through the isolated secure enclave.
2Reliability
If on-device secure enclaves are used, then security is improved, but device complexity increases and not all devices can support them
Solution Approach 1:
The patent introduces a cloud-based secure enclave as an intermediary service that provides secure key management functionality without requiring built-in secure enclave hardware in user devices. The cloud-based secure enclave acts as a mediator between the WebAuthn protocol and devices lacking hardware security features, performing cryptographic operations remotely while maintaining security standards. This approach enables devices of varying complexity to access secure authentication without requiring sophisticated local security hardware.
3Ease of operation
If secret keys are stored in general RAM, then ease of operation is improved, but security is worsened as keys become accessible to attackers
Solution Approach 1:
The system extracts the secret key material from the general-purpose computing device's memory space and relocates it to a secure enclave environment. By taking out the sensitive cryptographic material from the vulnerable general RAM and placing it in an isolated secure environment with controlled access, the system maintains operational convenience while eliminating the security vulnerability of exposed memory storage.
4Reliability
If cloud-based secure enclave is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The cloud-based secure enclave implements self-service capabilities by automatically managing cryptographic key pairs, performing cryptographic operations, and handling security protocols without requiring complex local security infrastructure on user devices. The service autonomously manages its own security posture, key lifecycle, and operational parameters, reducing the complexity burden on client devices while maintaining high security standards through centralized, professionally managed infrastructure.
Data Source
AI summary
Examples of the present disclosure provide an authenticator system that protects secret authentication keys associated with relying parties to which a user is authenticating. Present systems and methods allow cross-platform and cross-device WebAuthn usage. Example systems employ a server-based secure enclave and secure tunnel communication between the browser application or mobile application and the secure enclave server. A user of a service provider of the authenticator system owns the secret authentication key, which is stored in an encrypted vault protected by a user secret and hosted by the service provider. Decrypting the secret key may be based on a key arrangement, where keys from the user, the service provider, and the secure enclave are used to successfully decrypt the secret authentication key within the secure enclave.