Secure Enclave Cloud Processing for Shared-Resource Key Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based systems face challenges in securely managing and distributing digital credentials due to shared processing and memory resources, which increase the risk of exposure and are limited by generic cryptographic operations, and existing secure solutions are either insecure or prohibitively expensive.
Innovation Solution
A secure enclave is generated on a publicly accessible server with isolated memory and processing resources, installing a virtual machine with cryptographic processes and serverless functions to manage and distribute secure credentials, ensuring secure storage and distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If cloud-based systems use shared processing and memory resources, then operational costs are reduced and resource utilization is improved, but security is worsened due to increased risk of exposure and limited cryptographic operations
Solution Approach 1:
The patent segments the cloud server into multiple isolated secure enclaves, each with dedicated cryptographic processing capabilities. Each enclave is separated by hardware-based isolation boundaries that prevent other processes from accessing its memory or processing resources, thus providing strong security while sharing the overall server infrastructure.
Solution Approach 2:
The patent introduces secure enclaves as intermediary components between the untrusted shared cloud environment and the cryptographic operations. These enclaves act as trusted execution environments that mediate all cryptographic processes, ensuring that even though the underlying hardware is shared, the cryptographic operations remain secure and isolated.
2Ease of operation
If generic cryptographic operations are used on shared cloud resources, then device complexity is reduced and ease of operation is improved, but security is worsened due to exposure risks
Solution Approach 1:
The patent applies local quality by providing each secure enclave with specialized cryptographic processing capabilities tailored to its specific security requirements. Each enclave can be configured with specific cryptographic algorithms and key management processes appropriate to its function, rather than using generic cryptographic operations across the entire system.
3Reliability
If dedicated secure resources are allocated to each entity, then security is improved through isolation, but operational costs increase and resource utilization decreases
Solution Approach 1:
The patent merges multiple secure enclaves onto a single shared cloud server infrastructure. By combining the computational resources of the server with the security isolation of individual enclaves, the system achieves both strong security through isolation and cost efficiency through shared hardware resources, eliminating the need for completely dedicated secure hardware for each entity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems are provided for performing operations comprising: generating, on a publicly accessible server, a secure enclave, the secure enclave having isolated memory and processing resources of the server; installing, on the secure enclave, a virtual machine comprising a guest operating system of a first entity; installing, by the virtual machine, one or more cryptographic processes associated with the first entity; and encrypting and decrypting cryptographic keys associated with the first entity using the one or more cryptographic processes.