Secure Enclave Key Generation for Container Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems are vulnerable to offline attacks, where unauthorized entities can extract and decrypt data encryption keys, compromising the security of encrypted data stored within containers on computing devices.
Innovation Solution
The method involves a computing device with a security module and a crypto-processor that authenticates users, generates a hardened user key using a key agreement protocol, and constructs an unencrypted data encryption key for accessing and decrypting data within a container, thereby thwarting offline attacks by keeping critical cryptographic components secure within the security module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data encryption keys are stored and processed in standard computing devices, then data access and processing efficiency is improved, but security against offline attacks deteriorates
Solution Approach 1:
The system separates cryptographic operations into two distinct components: a secure enclave processor that generates and protects cryptographic keys, and a main processor that handles data processing. This segmentation ensures that sensitive key operations occur in a secure environment while maintaining efficient data access through the main processor.
Solution Approach 2:
The secure enclave acts as an intermediary between the main processor and encrypted data. It generates hardened user keys and data encryption keys, then provides authorized access to the main processor without exposing the actual keys. This intermediary role protects against offline attacks while enabling efficient data access.
2Reliability
If cryptographic keys are generated and stored in secure hardware, then security against offline attacks is improved, but device complexity increases
Solution Approach 1:
The secure enclave is implemented as a nested security module within the computing device architecture. It contains its own processor and memory resources, creating a protected nested environment that adds security without requiring a completely separate hardware system. This nested structure provides enhanced security while controlling overall device complexity.
3Reliability
If data is encrypted using hardened user keys generated in secure enclaves, then security is improved, but data processing speed may deteriorate
Solution Approach 1:
The system performs preliminary key generation and encryption setup within the secure enclave before main data processing operations. Hardened user keys are generated in advance, and data encryption keys are derived beforehand, allowing the main processor to efficiently access and process encrypted data without repeated key generation overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Devices and methods of managing data stored within a container. The container may be associated with at least one registered user. The data within the container may be encrypted by a data encryption key (DEK). A computing device includes: a security module including a crypto-processor, a main processor, and memory. The memory stores instructions that, when executed, configure a processor to: authenticate a user based on a user secret associated with the container and generate a soft key based on the user secret. The instructions cause a crypto-processor to generate a secure generator output including a crypto key component and generate a hardened user key based on a key agreement protocol using the soft key and the crypto key component. The instructions cause a processor to construct an unencrypted DEK associated with the hardened user key and decrypt the subset of data using the unencrypted DEK.