Local Key Escrow in Enclave Containers Without Exposed Key Ports
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems rely on key storage schemes that expose ports to the outside, compromising security by allowing unauthorized access to encryption keys.
Innovation Solution
A trusted computing-based local key escrow method utilizing an enclave container to securely store and manage encryption keys, ensuring data security by encrypting and decrypting data using a local key derived from a secure and trusted environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an extra encryptor is used to store the encryption key, then data encryption capability is improved, but security is worsened due to exposed ports
Solution Approach 1:
The system divides the encryptor into two distinct environments: a trusted environment (enclave) that securely holds the encryption key and performs encryption operations, and an untrusted environment that handles data storage and transmission. This segmentation prevents the key from being exposed to external ports while maintaining encryption capability.
Solution Approach 2:
The patent introduces an enclave container as an intermediary between the untrusted external environment and the trusted key storage. The enclave acts as a secure mediator that receives data from untrusted ports, encrypts it using the protected key, and returns encrypted data without exposing the key itself to external access.
2Ease of operation
If ports are exposed to the outside for normal operation, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent applies different security qualities to different parts of the system. The enclave container and its internal key storage operate in a high-security trusted environment with restricted access, while external service ports operate in a lower-security untrusted environment. This local quality differentiation allows ports to remain accessible for normal operations while the critical key storage maintains high security through environment isolation.
Data Source
AI summary
This application provides a trusted computing-based local key escrow method, apparatus, device and medium. The method includes: determining an executable file associated with an untrusted environment and a dynamic link file associated with a trusted environment in response to acquiring an enclave interface definition file from a local internal memory; determining an environment access interface based on a container identifier indicated by the trusted environment in response to loading the dynamic link file based on the executable file; reading sealed data file obtained by encrypting serialized data based on a local key in the untrusted environment in response to accessing an enclave container in the trusted environment through the environment access interface; and decrypting the sealed data file using the local key and deserializing the decrypted sealed data file in the enclave container to obtain service data for loading into a trusted internal memory indicated by the enclave container.