Remote Cryptographic Key Export via Proxy and Secure Enclaves
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic key management systems face challenges in enterprises with many client devices, including poor security due to centralized storage, management burdens, and vulnerabilities from compromised devices, as well as the risk of proxy servers storing sensitive key information.
Innovation Solution
A system that leases cryptographic keys to secure enclaves on client devices, with a proxy server managing requests and enforcing security controls, including split secret models and secure enclaves to protect key information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cryptographic keys are stored on client devices, then key access is fast and available offline, but security is poor and management is difficult
Solution Approach 1:
The patent extracts the cryptographic keys from client devices and stores them in a remote cryptographic device. The keys are wrapped and transmitted to the client device only when needed, rather than being permanently stored locally. This extraction principle resolves the contradiction by maintaining fast access through local wrapping operations while improving security through remote storage.
Solution Approach 2:
The patent introduces a proxy server as an intermediary between client devices and the cryptographic device. The proxy server manages key wrapping requests, handles authentication, and coordinates key distribution. This intermediary resolves the contradiction by enabling fast local access through the proxy while maintaining secure remote storage and management controls.
2Reliability
If cryptographic keys are stored remotely in a cryptographic device, then security is improved, but management complexity increases significantly
Solution Approach 1:
The patent makes the cryptographic device and proxy server serve multiple client devices simultaneously with a single configuration. The cryptographic device stores keys for multiple clients, and the proxy server manages wrapping requests from any authorized client without requiring individual device-to-device configuration. This universality resolves the contradiction by maintaining high security through centralized storage while reducing management complexity through multi-functionality.
3Ease of operation
If a central proxy server manages cryptographic operations, then client configuration is simplified, but the proxy server becomes a target for hackers seeking key information
Solution Approach 1:
The patent extracts sensitive key information (unwrapped keys, PINs) from the proxy server's persistent storage. The proxy server only temporarily holds wrapped keys in memory during active operations and does not store plaintext key material. This extraction of sensitive data from the proxy server reduces the hacker target vulnerability while maintaining the configuration simplicity benefits.
Solution Approach 2:
The patent changes the state of key information from plaintext to wrapped/encrypted form in the proxy server. Keys are transmitted to the proxy server in wrapped form, processed in wrapped form, and only unwrapped temporarily in memory for cryptographic operations. This parameter change from plaintext to encrypted form reduces the vulnerability to hackers while preserving the operational simplicity.
4Reliability
If multiple cryptographic devices are provisioned for different client devices, then key security is maintained, but configuration becomes error-prone and burdensome
Solution Approach 1:
The patent makes a single cryptographic device serve multiple client devices through the proxy server. The cryptographic device stores keys for multiple clients and processes wrapping requests from any authorized client without requiring separate device configurations. This universality resolves the contradiction by maintaining key security through centralized cryptographic operations while dramatically simplifying configuration management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for exporting remote cryptographic keys are provided. In one technique, a proxy server receives, from a secure enclave of a client device, a request for a cryptographic key. The request includes a key name for the cryptographic key. In response to receiving the request, the proxy server sends the request to a cryptographic device that stores the cryptographic key. The cryptographic device encrypts the cryptographic key based on an encryption key to generate a wrapped key. The proxy server receives the wrapped key from the cryptographic device and sends the wrapped key to the secure enclave of the client device.