Cloud Key Access via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-hosted key management systems face security risks due to the transportation of cryptographic keys and incur latency issues when accessing keys from remote services, particularly in hybrid cloud environments.
Innovation Solution
Implementing a hybrid cloud key access system that redirects key access requests to a local trusted execution environment (TEE), where keys are stored after initial provisioning from a remote key vault, minimizing subsequent remote access and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If keys are stored in cloud key vault service, then key management is centralized and secure, but key access latency increases and attack surface expands
Solution Approach 1:
The system segments key storage into two locations: cloud key vault for centralized management and local TEE for cached access. This allows the application to access keys locally for frequent operations while maintaining the ability to retrieve from cloud for fresh keys, thereby reducing latency without sacrificing security.
Solution Approach 2:
The system performs preliminary action by caching keys in the local TEE after initial retrieval from the cloud key vault. This preliminary caching of frequently accessed keys eliminates the need for repeated remote requests, significantly reducing access latency while maintaining security through the TEE's protected storage.
2Ease of operation
If keys are transported to application, then key access is simplified, but security attack surface increases
Solution Approach 1:
The TEE acts as an intermediary between the cloud key vault and the application. Keys are not directly transported to the application but are instead cached in the TEE's protected environment. The TEE mediates key access by providing secure local storage while maintaining the security benefits of cloud-based key management.
Solution Approach 2:
The system creates a copy of the key in the local TEE after initial retrieval from the cloud. This copy allows the application to access the key locally without the key being permanently stored in the application or transmitted over the network repeatedly, thereby simplifying access while maintaining security through the TEE's protected copying mechanism.
3Reliability
If fresh keys are retrieved from cloud every time, then key freshness is maintained, but system performance decreases
Solution Approach 1:
The system dynamically determines where to retrieve keys from: locally from TEE cache for frequently accessed keys (improving performance) or from cloud key vault for fresh keys (maintaining security). This dynamic key retrieval strategy balances performance and security based on access patterns and requirements.
Solution Approach 2:
The system implements local quality by caching keys in the local TEE for applications that require frequent access. This local caching mechanism improves performance for repeated operations while the system maintains the option to retrieve fresh keys from the cloud when necessary, thus balancing local performance needs with remote security requirements.
Data Source
AI summary
An apparatus comprising one or more processors to receive a first request from an application to access one or more cryptographic keys from a cloud key vault, transmit the first request to the cloud key vault, receive the cryptographic keys from the cloud key vault, provide access to the one or more cryptographic keys to the application and store the one or more cryptographic keys within a trusted execution environment.