Secure Enclave Authentication Domain Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face vulnerabilities in data protection, as unauthorized access can occur even with passcode protection, especially when data is stored unencrypted, and existing security measures are not effective against evolving cryptographic and cryptanalysis techniques.
Innovation Solution
Implementing a secure enclave processor that receives credentials for authentication, tracks successive failed attempts, and throttles or blocks further attempts after a threshold, combined with system-managed encryption that generates and manages encryption keys transparently to users, ensuring secure data access and protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passcode protection is implemented to protect stored data, then data security is improved, but unauthorized access can still occur through brute-force attacks or physical access to storage devices
Solution Approach 1:
The patent segments the authentication system into multiple independent components: a secure enclave processor that maintains isolated authentication domains, a main processor that handles user interface, and separate authentication types (passcode, biometric, etc.). Each authentication type has its own domain within the secure enclave, preventing cross-contamination of security states and enabling granular control over authentication attempts.
Solution Approach 2:
The secure enclave processor acts as an intermediary between the main processor and stored credentials. It receives authentication requests from the main processor, performs verification in an isolated environment, and returns results without exposing credentials to the main processor or potential attackers. This intermediary layer prevents direct access to sensitive data even if the main system is compromised.
2Reliability
If the system blocks authentication attempts after failed attempts to prevent brute-force attacks, then security is improved, but legitimate users may be accidentally locked out
Solution Approach 1:
The authentication domain dynamically adjusts its state based on the type of authentication being performed. When a biometric authentication is attempted, the system enters a permissive state that allows multiple attempts without blocking. When a passcode authentication is attempted, the system enters a restrictive state that blocks after a threshold of failed attempts. This dynamic behavior enables the system to adapt security measures to the specific authentication context.
Solution Approach 2:
Different quality attributes (security restrictions) are applied to different parts of the authentication system based on authentication type. Biometric authentication domains have relaxed failure thresholds, while passcode authentication domains have strict failure thresholds. This local differentiation ensures that security measures are appropriately tailored to each authentication method's characteristics and risk profile.
3Adaptability or versatility
If multiple authentication types are supported to provide versatility, then user convenience is improved, but system complexity increases
Solution Approach 1:
The secure enclave processor provides universal authentication services that handle multiple authentication types (passcode, biometric, device unlock, app-specific authentication) through a unified interface. The main processor can request any authentication type through the same authentication API, and the secure enclave routes the request to the appropriate domain. This multi-functional design enables versatility without proportionally increasing complexity in the main system.
Solution Approach 2:
The complex authentication logic and credential verification processes are extracted from the main processor and placed into the secure enclave processor. This extraction removes the computational burden and security-critical complexity from the main system, allowing it to focus on user interface and application logic while the secure enclave handles authentication complexity in an isolated environment.
4Ease of operation
If encryption keys are managed transparently by the system, then ease of operation is improved, but security control may be reduced
Solution Approach 1:
The system automatically performs key generation, storage, and management operations without requiring user intervention. When a user sets up a new device or adds a user account, the system automatically generates the necessary encryption keys, stores them in the secure enclave, and configures authentication domains. This self-service approach maintains security control while eliminating the operational burden of manual key management.
Solution Approach 2:
Encryption keys and authentication domains are pre-configured and prepared in advance during system initialization and user account creation. The secure enclave pre-generates keys and sets up authentication domains before they are needed for actual authentication. This preliminary action ensures that security controls are already in place and configured correctly before users need them, maintaining both automation and security.
Data Source
AI summary
Embodiments described herein provide for a system, method, and apparatus to provision domains in a secure enclave processor to support multiple users. One embodiment provides for an apparatus comprising a first processor to receive a set of credentials associated with one of multiple user accounts on the apparatus and a second processor including a secure circuit to provide a secure enclave, the secure enclave to receive a request from the first processor to authenticate the set of credentials, the request including supplied credentials and an authentication type, where the secure enclave is to block the request from the first processor in response to a determination that the user account has exceeded a threshold number of successive failed authentication attempts for the authentication type.