Secure Enclave Database Verification for Customer-Controlled Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems lack customer visibility and control over security protocols, leading to minimal flexibility and increased risk of security breaches, as customers cannot independently verify the secure operation of these systems.
Innovation Solution
Implementing a secure database system that allows customers to use their own encryption keys and utilizes hardware protections to secure data across components, with confidential compute primitives and trusted execution environments (TEEs) to ensure data integrity and confidentiality, enabling independent attestation and secure boot for the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional database systems are used, then data storage and access functionality is provided, but customer visibility and control over security protocols is lacking
Solution Approach 1:
The patent introduces an attestation verification system as an intermediary between the database system and the customer. This mediator receives attestation information from the database system, verifies it against expected values, and provides verification results to the customer. This intermediary enables customer visibility and control over security protocols without requiring the customer to directly manage the complex database security infrastructure.
2Reliability
If conventional database systems are used, then data storage is provided, but independent verification of secure operations is not possible
Solution Approach 1:
The patent segments the security verification function into distinct components: (1) an attestation information generation component within the database system that creates cryptographic proofs of security state, (2) an attestation verification system that independently validates these proofs, and (3) a result reporting mechanism that communicates verification status to customers. This segmentation enables independent verification while maintaining manageable system architecture through clear separation of concerns.
3Reliability
If encryption keys are managed by the database system, then data encryption is provided, but customer control over key management is limited
Solution Approach 1:
The patent implements dynamic key management where the customer can choose different key management approaches based on their needs. The system supports both customer-managed keys and database-system-managed keys, allowing flexible adaptation to different security requirements. The attestation verification system dynamically adjusts its verification process based on which key management mode is active, providing both confidentiality and management flexibility.
Data Source
AI summary
Systems and methods are provided for creating a secure database execution environment. The system generates, by a database system executing on a secure enclave, attestation information. The system transmits the attestation information to a remote entity. The system obtains, by the database system executing on the secure enclave, one or more encryption keys in response to the remote entity authenticating the attestation information. The system performs, by the database system executing on the secure enclave, one or more database operations on encrypted data stored on the database system using the one or more encryption keys.