Containerized Key Protection Using Secure VM Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data encryption keys are vulnerable to exposure in system memory due to insecure processing environments, allowing hackers to access sensitive information.
Innovation Solution
Implement a key protection service within a secure virtual machine environment, such as Intel SGX or AMD SEV, to manage and use data encryption keys securely without storing them in client memory, ensuring attestation and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data encryption keys are loaded into system memory for use, then the keys become accessible to authorized processes, but the keys become vulnerable to unauthorized access by hackers who can read system memory
Solution Approach 1:
The system segments the memory space into secure and non-secure regions. The secure memory region is protected from general system memory access, allowing encryption keys to be stored and accessed only by authorized processes within that segmented space, thus maintaining accessibility while preventing unauthorized access.
Solution Approach 2:
The patent introduces a key management service as an intermediary between authorized processes and the encryption keys stored in secure memory. This mediator handles key access requests, verifying authorization and managing key lifecycle operations, thereby controlling accessibility while maintaining security through the intermediate layer.
2Object-affected harmful factors
If encryption keys are stored securely in hardware security modules, then key security is improved, but key accessibility to authorized processes is reduced
Solution Approach 1:
The key management service acts as an intermediary that bridges the secure hardware security module and authorized processes. It receives key usage requests from authorized processes, retrieves keys from the secure module, and provides them for authorized operations, thus maintaining both security and accessibility through the mediating service.
Solution Approach 2:
The system performs preliminary authorization verification through the key management service before keys are accessed from secure storage. Authorized processes are pre-validated and granted access rights, allowing them to retrieve and use keys from the hardware security module without compromising security, thus enabling smooth operations.
3Object-affected harmful factors
If system memory is made secure to prevent hacker access, then key security is improved, but system complexity and performance overhead increase
Solution Approach 1:
Instead of securing the entire system memory, the patent segments only the specific memory regions where encryption keys are stored. This selective segmentation approach provides the necessary security protection while minimizing the complexity overhead compared to securing the entire memory system.
Data Source
AI summary
Data encryption keys (and other sensitive data) can be secured during use by a key protection service that performs cryptographic operations on behalf of a client application. The key protection service can be implemented as a lightweight virtual machine that appears externally as a container and that can be executed in a secured environment. The lightweight virtual machine can include containerized processes to support an application program interface to interact with the client application and an attestation client to interact with a secured key storage system external to the secured environment.