Group Key Generation in Protected Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for secure communication among trusted computing environments are inadequate in protecting against malware and do not eliminate the need for public-key or preshared key operations.
Innovation Solution
A method for generating and verifying a group key for encrypting and decrypting data in shared access memory using nonces provided by processes, where the nonces are encrypted and integrity-protected by a platform-provided hiding function, and verified using a platform-provided revealing function within protected containers signed by a single signing authority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods for secure communication are used, then communication can be established, but protection against malware is inadequate and public-key or preshared key operations are still required
Solution Approach 1:
The patent introduces a trusted hardware platform (such as Intel SGX enclaves) as an intermediary that provides cryptographic primitives and key management services. This mediator enables secure communication among containers without requiring each container to implement complex public-key or preshared key operations, thereby improving malware protection while reducing operational complexity.
Solution Approach 2:
The trusted hardware platform provides self-service cryptographic functions including key generation, encryption, and integrity protection directly within the hardware enclave. The platform automatically manages cryptographic operations for container communication, eliminating the need for containers to perform complex key operations themselves and enhancing security against malware.
2Reliability
If public-key or preshared key operations are used to establish secure communication, then security can be achieved, but the complexity of key management and operations increases
Solution Approach 1:
The trusted hardware platform acts as an intermediary that handles all cryptographic operations including key generation, distribution, and management. This mediator abstracts away the complexity of public-key or preshared key operations from the container level, enabling secure communication while significantly simplifying key management operations for the applications.
3Reliability
If containers need to communicate securely with integrity protection, then data security is improved, but the complexity of implementing encryption and verification increases
Solution Approach 1:
The trusted hardware platform serves as an intermediary that provides built-in encryption and integrity protection mechanisms. The platform handles all cryptographic operations for data protection, eliminating the need for containers to implement complex encryption schemes themselves while maintaining strong data integrity and security.
Solution Approach 2:
The patent replaces complex software-based encryption implementations with hardware-accelerated cryptographic primitives provided by the trusted platform. This substitution of mechanical (software) systems with hardware-based solutions significantly reduces the complexity of implementing encryption and integrity verification while improving performance and security.
Data Source
AI summary
There is provided a method of communication among at least two processes miming on the same computer. The method comprises: generating, by at least one process of the at least two processes, a group key usable for encrypting/decrypting a data unit retrieved from/stored to shared access memory, wherein the generating utilizes, at least, a nonce provided by each of the at least two processes, and wherein the nonces are provided as encrypted integrity-protected data according to, at least, a platform-provided hiding function, wherein each process executes in a protected container, the processes are signed by a single signing authority, and the protected container infrastructure enables use of encrypted, integrity-protected data according to a platform-provided hiding function and a platform-provided revealing function; and verifying, by at least one process of the at least two processes, that a data unit read from shared access memory is successfully decrypted using the group key.