Secure Enclave Key Generation for Container Data Protection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing data management systems are vulnerable to offline attacks, where unauthorized entities can extract and decrypt data encryption keys, compromising the security of encrypted data stored within containers on computing devices.

Innovation Solution

The method involves a computing device with a security module and a crypto-processor that authenticates users, generates a hardened user key using a key agreement protocol, and constructs an unencrypted data encryption key for accessing and decrypting data within a container, thereby thwarting offline attacks by keeping critical cryptographic components secure within the security module.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If data encryption keys are stored and processed in standard computing devices, then data access and processing efficiency is improved, but security against offline attacks deteriorates

Engineering Contradiction:
Improvedata access efficiencyVSAvoidsecurity against offline attacks
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The system separates cryptographic operations into two distinct components: a secure enclave processor that generates and protects cryptographic keys, and a main processor that handles data processing. This segmentation ensures that sensitive key operations occur in a secure environment while maintaining efficient data access through the main processor.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The secure enclave acts as an intermediary between the main processor and encrypted data. It generates hardened user keys and data encryption keys, then provides authorized access to the main processor without exposing the actual keys. This intermediary role protects against offline attacks while enabling efficient data access.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If cryptographic keys are generated and stored in secure hardware, then security against offline attacks is improved, but device complexity increases

Engineering Contradiction:
Improvesecurity against offline attacksVSAvoidhardware architecture complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The secure enclave is implemented as a nested security module within the computing device architecture. It contains its own processor and memory resources, creating a protected nested environment that adds security without requiring a completely separate hardware system. This nested structure provides enhanced security while controlling overall device complexity.

Inventive Principle:
Principle #7Nested doll (Nesting)

3Reliability

If data is encrypted using hardened user keys generated in secure enclaves, then security is improved, but data processing speed may deteriorate

Engineering Contradiction:
Improvedata securityVSAvoiddata processing speed
Core Design Contradiction:
ReliabilityVSSpeed

Solution Approach 1:

The system performs preliminary key generation and encryption setup within the secure enclave before main data processing operations. Hardened user keys are generated in advance, and data encryption keys are derived beforehand, allowing the main processor to efficiently access and process encrypted data without repeated key generation overhead.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3739489B1Devices and methods of managing data
Publication Date: 2022.04.06 BLACKBERRY LTD
  • EP3739489B1 patent drawingFigure 1
  • EP3739489B1 patent drawingFigure 2
  • EP3739489B1 patent drawingFigure 3

AI summary

Devices and methods of managing data stored within a container. The container may be associated with at least one registered user. The data within the container may be encrypted by a data encryption key (DEK). A computing device includes: a security module including a crypto-processor, a main processor, and memory. The memory stores instructions that, when executed, configure a processor to: authenticate a user based on a user secret associated with the container and generate a soft key based on the user secret. The instructions cause a crypto-processor to generate a secure generator output including a crypto key component and generate a hardened user key based on a key agreement protocol using the soft key and the crypto key component. The instructions cause a processor to construct an unencrypted DEK associated with the hardened user key and decrypt the subset of data using the unencrypted DEK.