Secure Enclave Application Data Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data center security measures only verify the application software code for execution within a secure enclave, leaving the application data unverified, which can compromise security if altered, potentially changing the application's operation or behavior.
Innovation Solution
Generating and verifying hash values for both the application software code and its associated data, including file systems or other application data, to ensure integrity by signing the combined hash values with a cryptographic key and comparing them upon access to ensure authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only application software code is verified before execution, then verification process is simple and fast, but security is compromised because application data can be altered without detection
Solution Approach 1:
The patent combines the verification of application code and application data into a unified process. A single hash value is generated that encompasses both the application code and its associated data, and this combined hash is then signed with a cryptographic key. This merging approach ensures that both code and data integrity are verified together, preventing security compromises from undetected data alterations while maintaining a streamlined verification process.
Solution Approach 2:
The patent performs preliminary verification of both application code and data by generating hash values and cryptographic signatures before the application executes. The data center verifies the signed hash value containing both code and data identifiers prior to allowing execution, ensuring that any alterations to either code or data are detected before they can impact application behavior.
2Reliability
If hash verification is performed only on application code, then processing time is reduced, but data integrity cannot be ensured
Solution Approach 1:
The patent merges code verification and data verification into a single hash computation and verification step. By creating one comprehensive hash value that represents both the application code and its data, and signing this combined hash with a cryptographic key, the system ensures data integrity is verified alongside code verification, eliminating the need for separate verification processes and associated time delays.
3Adaptability or versatility
If application data is allowed to be modified, then application functionality can be updated, but security is compromised as unauthorized changes may alter application behavior
Solution Approach 1:
The patent implements a feedback mechanism where the data center continuously verifies the integrity of application data by checking the signed hash value against the actual data during execution. This feedback loop ensures that any unauthorized modifications to application data are detected, allowing the system to maintain adaptability for legitimate updates while preventing security compromises from malicious alterations.
Data Source
AI summary
A request to provide an application at a secure enclave of a server may be received. A hash value of the application may be generated. Application data that is to be used with the application at the secure enclave of the server may be identified. Another hash value of the application data that is to be used with the application at the secure enclave of the server may be generated. The hash value of the application and the other hash value of the application data may be signed where the signed hash value and other hash are being used to execute the application with the application data at the secure enclave of the server.