Cloud Key Management for AFU Security via Trusted Agent
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud Key Management Systems (KMS) do not support a secure mechanism to deploy Accelerator Functional Unit (AFU) related keys, leading to potential exposure of sensitive intellectual property, as these keys are typically in clear-text when used in server DRAM and/or CPU registers.
Innovation Solution
Implementing a scalable cloud key management system that includes a trusted agent, such as an integrated secure device manager (SDM) in accelerators like FPGAs, to securely provision and manage cryptographic materials, ensuring that AFU developers can control their encryption keys and maintain confidentiality, while the cloud service provider securely controls the deployment of AFUs within its infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud-based Key Management Service (KMS) is used to provision and store encryption keys, then key management capability is improved, but security is worsened because keys are exposed in clear-text in server DRAM and CPU registers
Solution Approach 1:
The system separates key management into two distinct components: a cloud-based KMS for key provisioning and storage, and a trusted agent (secure device manager) embedded in the accelerator for secure key usage. This segmentation allows the KMS to handle key lifecycle management while the trusted agent ensures keys never exist in clear-text form in server memory, resolving the contradiction between operational ease and security.
Solution Approach 2:
A trusted agent acting as an intermediary is introduced between the KMS and the accelerator. This intermediary receives encrypted key material from the KMS, securely manages the decryption and usage of keys within the accelerator hardware, and ensures keys are never exposed in clear-text form in server DRAM or CPU registers, thus maintaining both key management capability and security.
2Reliability
If encryption keys are stored in secure database in cloud KMS, then key storage security is improved, but key deployment security is worsened due to clear-text exposure during usage
Solution Approach 1:
The system extracts the key usage function from the general-purpose server environment into a dedicated trusted agent within the accelerator hardware. This extraction ensures that even though keys are stored securely in the cloud KMS database, their deployment and usage occur in an isolated, secure environment where clear-text exposure to server DRAM and CPU registers is prevented, eliminating the harmful exposure factor.
Solution Approach 2:
The trusted agent implements local security policies within the accelerator hardware, creating a secure enclave for key usage. This local quality approach ensures that key material is processed in a controlled, secure environment specific to the accelerator, preventing keys from being exposed in the broader server environment even during active usage, thus resolving the contradiction between storage security and usage security.
3Adaptability or versatility
If AFU developers share encryption keys with cloud service provider, then AFU deployment capability is improved, but intellectual property protection is worsened
Solution Approach 1:
The trusted agent serves as an intermediary that enables AFU deployment without requiring developers to share their encryption keys with the cloud service provider. The trusted agent securely manages the keys locally within the accelerator, allowing the CSP to deploy AFUs while maintaining developer control over key security, thus achieving both deployment capability and IP protection.
Solution Approach 2:
The trusted agent implements self-service key management within the accelerator hardware, allowing the system to autonomously manage encryption keys without requiring developer intervention or key sharing with the CSP. This self-service mechanism enables seamless AFU deployment while maintaining strong intellectual property protection, as the developer's keys never leave their secure storage in the trusted agent.
Data Source
AI summary
An apparatus for cloud key management may include a networking interface, a memory, and a processor, coupled to the memory and the networking interface, the networking interface to couple the apparatus to one or more endpoint servers (EPSs) of a cloud service provider (CSP), each EPS including a hardware accelerator, and a management node (MN) of the CSP. The apparatus may further include an accelerator functional unit (AFU) developer interface module operated by the processor to receive cryptographic material (CM) for each of one or more AFU developers (AFUDs) and store it into the memory, the CM includes a public key hash (PKH), and an encryption key (EK) to decrypt an AFU of the AFUD. The apparatus may also include an EK communication module operated by the processor to: receive, from the MN, a request to send to a targeted EPS an encrypted lookup table (LUT), the LUT including PKHs and associated EKs for a set of the one or more AFUDs from which the targeted EPS is authorized to receive AFUs, and in response to the request, send, to the targeted EPS, the LUT.