Password Triggered Encryption Key Deletion in Trusted Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack effective methods for secure deletion of data, especially under coercion and during device sleep/wake modes, with no existing solution providing verifiable and secure deletion of encryption keys across multiple devices without network access or technical verification.
Innovation Solution
A method involving two encrypted data storage systems within a computer system, with three associated passwords: one for retrieving and using encryption keys, another for retrieving decoy data, and a third for secure deletion of the preselected encryption key, along with symmetric key encryption during sleep mode that can only be decrypted with the correct password and deleted upon specific password entry.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored securely in the system, then data security is improved, but the system becomes vulnerable to coercion and physical attacks when the device is lost or stolen
Solution Approach 1:
The system pre-registers a deletion password during setup that can trigger immediate key deletion without requiring network access or user interaction. This preliminary action ensures that when coercion or loss occurs, the user can quickly delete encryption keys through a pre-configured mechanism, transforming the theoretical security risk into a controllable scenario where the user retains ultimate control over their data.
Solution Approach 2:
The patent introduces a trusted hardware module (such as a secure element or TPM) as an intermediary that stores encryption keys separately from the main system memory. This intermediary component provides a secure enclave that can detect coercion attempts and automatically delete keys under specific conditions, acting as a mediator between the user's data and potential threats without requiring constant user awareness or intervention.
2Use of energy by moving object
If the system enters sleep mode to save power, then energy efficiency is improved, but encryption keys remain vulnerable in memory during sleep-wake cycles
Solution Approach 1:
Before the system enters sleep mode, the encryption keys are automatically encrypted and stored in a protected state in memory. Upon waking, the system requires authentication before decrypting and loading the keys into active memory. This preliminary encryption action maintains security during the vulnerable sleep-wake transition while allowing the system to enter low-power mode without continuously exposing keys in plaintext.
Solution Approach 2:
The system dynamically adjusts the security state of encryption keys based on the power state. During active operation, keys are loaded into fast memory for performance; during sleep mode, keys are encrypted or moved to protected storage. This dynamic behavior allows the system to optimize between security and performance based on operational context, reducing energy consumption while maintaining security during vulnerable transitions.
3Device complexity
If traditional deletion methods are used, then implementation simplicity is maintained, but deletion cannot be verified and may not be complete
Solution Approach 1:
The system implements a feedback mechanism that generates cryptographic proof of key deletion. When encryption keys are deleted, the system creates a verifiable attestation (such as a hashed checksum or cryptographic signature) that can be independently verified to confirm the keys have been completely removed. This feedback loop transforms unverified deletion into a provably secure operation without significantly increasing implementation complexity.
Data Source
AI summary
A method of evaluating secrets in a computer system's trusted execution environment, wherein after evaluation of secrets, a securely stored encryption key is either retrieved or deleted upon entering corresponding secret (password, graphical password, biometric information, data sequence, security token, etc.) or secrets. Deletion of the encryption key can happen in a verifiable manner or in a non-verifiable manner. If a storage is encrypted with the encryption key, deletion of the encryption key makes the encrypted storage irreversibly undecryptable, while retrieval of the key permits decryption of the storage. Two encryption keys can be used to encrypt two separate storages, and then securely stored and processed in the trusted execution environment. Each of the two encryption keys can be retrieved using one or more associated secrets (passwords, etc.), and one or more other secrets would delete the encryption key associated with a preselected storage. During sleep-wake event a computer system's memory can be encrypted with a symmetric key, and the symmetric key can be secured by encrypting with a public encryption key. Corresponding private key is retrieved to decrypt the symmetric key upon evaluation of associated password (secret) in trusted execution environment, while the private key is deleted upon evaluation of one or many preselected deletion password (secret) leaving the encrypted memory undecryptable.