Enclave Pool Key Ledger for Secure Cryptlet Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack secure and dynamic solutions for managing transactions within a pool of secure execution environments, known as enclaves, which are essential for ensuring the integrity and security of cryptographic operations, particularly in applications involving smart contracts and blockchain technology.
Innovation Solution
The formation of an enclave pool with a shared key ledger system, where each enclave has a key pair and the public keys are registered, allowing for dynamic allocation and validation of enclaves based on changing membership, ensuring secure and efficient execution of cryptlet code across multiple enclaves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If enclaves are dynamically added or removed from the enclave pool, then the system's adaptability and scalability are improved, but the complexity of managing key validation and membership changes increases
Solution Approach 1:
The system pre-generates multiple enclave keys and stores them in the enclave pool before they are needed. When an enclave is required, a pre-existing key is selected and activated rather than generating keys dynamically, which simplifies the management of key validity periods and membership changes.
Solution Approach 2:
The patent introduces an intermediary validation mechanism that checks whether selected enclave keys are within their validity period and properly registered in the enclave pool. This intermediary layer handles the complexity of key management, membership validation, and timestamp verification, isolating these complexities from the core transaction processing logic.
2Productivity
If multiple enclaves are pooled together for shared use, then resource utilization and efficiency are improved, but the security risk and complexity of validating outputs from multiple sources increase
Solution Approach 1:
The system segments the enclave pool into individual enclave key entries, each with its own validity timestamp and registration status. This segmentation allows the system to validate each enclave's output independently against its specific validity period and registration state, maintaining security while enabling resource sharing.
Solution Approach 2:
The system implements a feedback mechanism where the validity of enclave keys is continuously monitored and updated based on timestamps and registration status. The validation process provides feedback by checking whether selected keys are currently valid and properly registered, ensuring that only authenticated enclaves can contribute to transactions.
3Speed
If enclave keys are pre-generated and stored in a pool, then key generation time and transaction processing speed are improved, but the risk of key compromise and the complexity of key rotation increase
Solution Approach 1:
The system changes the parameter of key validity by introducing time-based expiration and registration status. Pre-generated keys are not permanently valid but have limited validity periods and must be registered in the enclave pool to be usable. This parameter change allows fast transaction processing with pre-generated keys while mitigating security risks through temporal and contextual validation constraints.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The public enclave key of each enclave in an enclave pool may be registered in an enclave pool registry, and the registry updated each time there is an enclave pool membership change. A shared enclave pool key may be derived from the public enclave key of each enclave of the enclave pool. The shared enclave pool key may be stored, in a shared key ledger, as a first version of the shared enclave key, and an updated version of the shared key may be generated and stored as another version each time there is an enclave pool membership change. The output of a cryptlet that executed in multiple enclaves may be signed with the enclave private key of each enclave in which the cryptlet executed. Each enclave signature may be compared against each version of the shared enclave pool key in the shared key ledger.