Distributed Secret Backup With Escrowed Keys for TPM Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely backing up and recovering secrets used by computing devices, particularly when hardware components like TPMs become inoperable, leading to potential data loss and compromised security.
Innovation Solution
A method involving multiple encryption layers and a protection pipeline is employed to securely backup and recover secrets, ensuring compliance with a security model that enforces separation of decryption keys and monitors for deviations, allowing for automatic remediation and secure deployment of secrets to target devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secrets are backed up in existing systems, then access to critical data can be maintained, but security is compromised when decryption keys are stored with the secrets
Solution Approach 1:
The system segments the secret backup process into separate components: secrets are encrypted and stored in a backup, while decryption keys are separately escrowed with escrow agents. This segmentation ensures that neither the secret nor the key alone can compromise security, yet both are available when needed for recovery.
Solution Approach 2:
Escrow agents act as intermediaries between the secret storage system and the decryption keys. The keys are escrowed with these agents who can release them under controlled conditions, providing a secure middle ground that maintains both security and accessibility.
2Object-affected harmful factors
If hardware components like TPMs are used to safeguard secrets, then security is improved, but system resilience decreases when hardware becomes inoperable
Solution Approach 1:
The system performs preliminary actions by creating encrypted backups of secrets and escrowing decryption keys before hardware failure occurs. This advance preparation ensures that even if TPMs or other hardware become inoperable, the secrets can be recovered using the pre-established backup and escrow mechanisms.
Solution Approach 2:
The system establishes protective measures in advance by implementing multiple encryption layers and distributing keys to escrow agents. This creates a cushion of security that protects against hardware failure, ensuring continuity of service even when primary hardware safeguards become inoperable.
3Object-affected harmful factors
If multiple encryption layers are implemented, then security is enhanced, but system complexity increases
Solution Approach 1:
The complex protection pipeline is segmented into distinct, manageable stages: initial secret encryption, backup creation, key escrow, and recovery procedures. Each stage handles a specific aspect of security, making the overall complex system easier to implement, maintain, and audit while preserving strong security.
4Object-affected harmful factors
If decryption keys are separated from secrets, then security is improved, but recovery difficulty increases when hardware fails
Solution Approach 1:
Escrow agents serve as mediators that simplify the recovery process. When hardware fails, the system can request keys from escrow agents through controlled procedures, avoiding the complexity of direct key management while maintaining security. The intermediaries handle the complexity of key release, making recovery easier for the end system.
Data Source
AI summary
Methods and systems for managing secrets are disclosed. To manage secrets, backups of the secrets may be obtained to facilitate future recoveries of the secrets. While backed up, the secrets may be secured with a security model. The security model may prescribe how entities that manage the backups are to operate, how encryption and decryption keys are maintained, and how various copies of the backed up secrets are to be distributed to manage potential loss of various backups of the secrets. When access to a secret is lost, a recovery may be performed using a corresponding backup of the secret.