Runtime Encryption Plugin for Secure Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management systems face security vulnerabilities when cryptographic keys are transmitted and used by applications, as they may be exposed to unauthorized entities, and intermediate data from sub-operations can be compromised, compromising the security of cryptographic operations.
Innovation Solution
The implementation of runtime encryption plugins within a secure enclave of the key management system, which operate with limited permissions and perform cryptographic operations on behalf of applications, ensuring that intermediate data is not transmitted and cryptographic keys are used only under specified conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are transmitted to applications for performing cryptographic operations, then the applications can perform cryptographic operations, but the cryptographic keys may be exposed to unauthorized entities
Solution Approach 1:
The patent introduces a key management system as an intermediary between applications and cryptographic operations. The system receives cryptographic operations from applications, executes them in a controlled environment, and returns results without exposing keys to the applications. This mediator architecture allows cryptographic functionality to be accessible while preventing direct key exposure to potential unauthorized entities.
Solution Approach 2:
The patent extracts the cryptographic key storage and execution environment from the application layer and places it within a secured key management system. By separating the key management function from application-level code, the system removes the vulnerability where applications could expose keys to unauthorized entities, while still enabling applications to perform cryptographic operations through the secured interface.
2Productivity
If intermediate data from sub-operations is transmitted, then the cryptographic operations can be completed, but the intermediate data can be compromised
Solution Approach 1:
The patent extracts intermediate data handling within the secured key management system environment. Sub-operations that generate intermediate data are executed inside the secure boundary, and only final results are transmitted to applications. This extraction of sensitive intermediate data handling from the application layer prevents compromise of intermediate data while maintaining operational completion.
Solution Approach 2:
The patent segments the cryptographic operation into two distinct phases: execution phase within the secured key management system where intermediate data is generated and handled securely, and result transmission phase where only final outputs are sent to applications. This segmentation isolates intermediate data within a secure boundary, preventing compromise while allowing operation completion.
3Adaptability or versatility
If cryptographic keys are stored and used by applications, then the applications can perform cryptographic operations, but the keys may be accessed by unauthorized entities
Solution Approach 1:
The key management system serves as a trusted intermediary that provides cryptographic functionality to applications without storing keys in application-accessible locations. The system mediates between applications needing cryptographic operations and the secure key storage, maintaining both adaptability for various operations and reliability through secured key access control.
Solution Approach 2:
The patent extracts key storage from application-level accessibility and relocates it within the secured key management system environment. By taking out key storage from the application layer and placing it in a protected system layer, the system maintains application versatility for cryptographic operations while improving key security against unauthorized access.
Data Source
AI summary
A request may be received from an application for a performance of an operation associated with a cryptographic key that is stored at a secure enclave. A plugin of the secure enclave may be identified from the request for performance of the operation. The operation associated with the cryptographic key may be performed by using the plugin of the secure enclave to generate an output within the secure enclave. The output generated within the secure enclave and based on the plugin may be provided to the application.