Secure Enclave Encryption Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption technologies are not completely secure as they expose encryption keys in memory, making them vulnerable to attacks such as 'cold-boot' and 'evil maid' attacks, where unauthorized parties can obtain or intercept the keys, compromising data security.
Innovation Solution
Implementing a secure enclave that operates in user mode to perform encryption operations, which never exposes the encryption keys in memory, using a measurement of the enclave to wrap and unwrap the keys, ensuring that only authorized access is possible, and enabling the use of secure enclaves in pre-boot phases to protect encryption keys during boot processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption operations are performed by kernel mode programs, then encryption functionality is provided, but encryption keys are exposed in memory making them vulnerable to attacks
Solution Approach 1:
The patent introduces a secure enclave as an intermediary component that acts as a mediator between the kernel mode encryption software and the encryption keys. The enclave host module in user mode communicates with the secure enclave, which provides a protected environment for key storage and operations. This intermediary structure prevents direct exposure of keys in general memory while maintaining encryption functionality, thereby resolving the contradiction between providing encryption services and protecting against key exposure vulnerabilities.
Solution Approach 2:
The patent transitions from a traditional single-mode kernel space architecture to a multi-dimensional architecture that includes both user mode and kernel mode, with the secure enclave operating in a protected enclave space. By moving key management operations to this separate enclave dimension and enabling user mode applications to interact with encrypted data directly through the enclave host, the system eliminates the need for keys to reside in general memory, thus preventing exposure while maintaining encryption capabilities.
2Reliability
If encryption keys are protected by wrapping or sealing technologies, then key protection is improved, but keys are still exposed in memory during encryption operations
Solution Approach 1:
The secure enclave serves as an intermediary that holds and manages encryption keys in a protected environment. Instead of keys being sealed or wrapped in general memory and then exposed during operations, the enclave provides a dedicated secure space where keys remain protected even during active use. The enclave host module facilitates secure communication without requiring key exposure in the broader memory space, thus enhancing key protection while enabling operational use.
Solution Approach 2:
The patent applies local quality by creating a specialized secure enclave environment with distinct security properties compared to general memory. Within this localized enclave space, keys are protected with enhanced security measures while the rest of the system operates normally. This localized protection approach allows keys to be used for encryption operations without exposing them to the broader memory environment, resolving the contradiction between key protection and operational accessibility.
3Productivity
If user mode applications directly access encrypted data, then productivity is improved, but complex interface mechanisms are required
Solution Approach 1:
The enclave host module implements self-service by automatically managing the interface between user mode applications and the secure enclave. It handles encryption and decryption operations transparently, managing key protection, and facilitating data access without requiring complex manual intervention or sophisticated interface mechanisms from the application side. This automation reduces the effective complexity experienced by users while maintaining high productivity.
Solution Approach 2:
The enclave host module serves multiple functions: it manages secure enclave communication, handles encryption/decryption operations, protects encryption keys, and provides an interface for user mode applications. By consolidating these diverse functions into a single universal component, the system avoids the need for multiple separate complex mechanisms, thereby improving productivity while keeping the overall interface complexity manageable.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technologies for hardening encryption operations are disclosed. In some embodiments, the technologies harden encryption operations typically performed by kernel mode programs with a secure enclave that may run in user mode and/or in a pre-boot context. In some embodiments, the technologies leverage a shared buffer and a proxy to enable the use of a secure enclave hosted in user mode to perform encryption operations. In additional embodiments, the technologies utilize one or more pre-boot applications to enable the use of a secure enclave in a pre-boot phase, e.g., so as to enable the use of a secure enclave to decrypt data that may be needed to boot a computing device.