Secure Enclave Cloud Processing for Shared-Resource Key Isolation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Cloud-based systems face challenges in securely managing and distributing digital credentials due to shared processing and memory resources, which increase the risk of exposure and are limited by generic cryptographic operations, and existing secure solutions are either insecure or prohibitively expensive.

Innovation Solution

A secure enclave is generated on a publicly accessible server with isolated memory and processing resources, installing a virtual machine with cryptographic processes and serverless functions to manage and distribute secure credentials, ensuring secure storage and distribution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of energy

If cloud-based systems use shared processing and memory resources, then operational costs are reduced and resource utilization is improved, but security is worsened due to increased risk of exposure and limited cryptographic operations

Engineering Contradiction:
Improveoperational costsVSAvoidsecurity
Core Design Contradiction:
Loss of energyVSReliability

Solution Approach 1:

The patent segments the cloud server into multiple isolated secure enclaves, each with dedicated cryptographic processing capabilities. Each enclave is separated by hardware-based isolation boundaries that prevent other processes from accessing its memory or processing resources, thus providing strong security while sharing the overall server infrastructure.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces secure enclaves as intermediary components between the untrusted shared cloud environment and the cryptographic operations. These enclaves act as trusted execution environments that mediate all cryptographic processes, ensuring that even though the underlying hardware is shared, the cryptographic operations remain secure and isolated.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Ease of operation

If generic cryptographic operations are used on shared cloud resources, then device complexity is reduced and ease of operation is improved, but security is worsened due to exposure risks

Engineering Contradiction:
Improveease of operationVSAvoidexposure risks
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by providing each secure enclave with specialized cryptographic processing capabilities tailored to its specific security requirements. Each enclave can be configured with specific cryptographic algorithms and key management processes appropriate to its function, rather than using generic cryptographic operations across the entire system.

Inventive Principle:
Principle #3Local quality

3Reliability

If dedicated secure resources are allocated to each entity, then security is improved through isolation, but operational costs increase and resource utilization decreases

Engineering Contradiction:
ImprovesecurityVSAvoidoperational costs
Core Design Contradiction:
ReliabilityVSLoss of energy

Solution Approach 1:

The patent merges multiple secure enclaves onto a single shared cloud server infrastructure. By combining the computational resources of the server with the security isolation of individual enclaves, the system achieves both strong security through isolation and cost efficiency through shared hardware resources, eliminating the need for completely dedicated secure hardware for each entity.

Inventive Principle:
Principle #5Merging (Combining)

Data Source

PatentEP4030320B1Secure cloud processing
Publication Date: 2025.11.05 ASSA ABLOY AB
  • EP4030320B1 patent drawingFigure 1
  • EP4030320B1 patent drawingFigure 2
  • EP4030320B1 patent drawingFigure 3

AI summary

Methods and systems are provided for performing operations comprising: generating, on a publicly accessible server, a secure enclave, the secure enclave having isolated memory and processing resources of the server; installing, on the secure enclave, a virtual machine comprising a guest operating system of a first entity; installing, by the virtual machine, one or more cryptographic processes associated with the first entity; and encrypting and decrypting cryptographic keys associated with the first entity using the one or more cryptographic processes.