Local Key Escrow Using Enclave Containers for Secure Key Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems rely on key storage schemes that expose ports to the outside, compromising security by allowing unauthorized access to encryption keys.
Innovation Solution
A trusted computing-based local key escrow method utilizing an enclave container to securely store and manage encryption keys, ensuring secure data communication through a trusted environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an extra encryptor is used to store the encryption key, then data encryption capability is improved, but security is worsened due to exposed ports
Solution Approach 1:
The system divides the encryptor into two distinct environments: a trusted environment (enclave) that securely stores the encryption key and an untrusted environment that handles data processing. This segmentation isolates the key storage from external access ports, resolving the contradiction between encryption capability and security.
Solution Approach 2:
The patent introduces an enclave container as an intermediary between the untrusted environment (data) and the trusted environment (key storage). This mediator enables secure key usage without direct exposure of the key to external ports, maintaining both encryption functionality and security.
2Ease of operation
If ports are exposed for key storage, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system creates separate trusted and untrusted environments with controlled interaction interfaces. The enclave container provides a secure boundary that maintains operational convenience for authorized access while blocking unauthorized access attempts, resolving the contradiction between ease of operation and security.
3Object-affected harmful factors
If a trusted environment is created using enclave container, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent implements a nested structure where the trusted environment (enclave) is embedded within the untrusted environment (host system). This nesting allows the complex secure environment to operate transparently within the existing system architecture, minimizing the perceived complexity while maintaining high security.
Solution Approach 2:
The enclave container creates a virtual copy of a secure environment within the host system. This copying approach allows the complex trusted computing functionality to be implemented as a software-based virtualization layer, reducing the need for additional physical hardware complexity.
Data Source
AI summary
This application provides a trusted computing-based local key escrow method, apparatus, device and medium. The method includes: determining an executable file associated with an untrusted environment and a dynamic link file associated with a trusted environment in response to acquiring an enclave interface definition file from a local internal memory; determining an environment access interface based on a container identifier indicated by the trusted environment in response to loading the dynamic link file based on the executable file; reading sealed data file obtained by encrypting serialized data based on a local key in the untrusted environment in response to accessing an enclave container in the trusted environment through the environment access interface; and decrypting the sealed data file using the local key and deserializing the decrypted sealed data file in the enclave container to obtain service data for loading into a trusted internal memory indicated by the enclave container.