Secure Enclave for One-Time Password Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for generating and using one-time passwords (OTPs) are inconvenient due to the need for physical devices, which can be lost or damaged, and raise security concerns about the security of personally owned computing devices.
Innovation Solution
A secure enclave is created within a computing device's storage to generate and use OTPs, ensuring secure access by provisioning the device with a seed value and re-encrypting it using a sealing key, while preventing unauthorized access through secure pathways and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OTP generation is performed on personally owned computing devices, then convenience is improved, but security deteriorates due to weak security levels of such devices
Solution Approach 1:
The computing device is divided into two distinct security zones: a secure enclave with high security for storing seed values and generating OTPs, and the general operating system with lower security for user interface and communication. This segmentation allows the system to leverage the convenience of personal devices while maintaining security through isolation.
Solution Approach 2:
The secure enclave acts as an intermediary component between the untrusted general-purpose operating system and the OTP generation process. It mediates the security requirements by providing a trusted execution environment that the rest of the system can rely on, enabling OTP generation on personal devices without compromising security.
2Reliability
If physical OTP generator devices are used, then security is improved, but convenience deteriorates due to risk of loss or damage
Solution Approach 1:
The functionality of physical OTP generator devices is copied into the personal computing device through a virtualized secure enclave. This allows the OTP generation capability to be replicated in software form while maintaining the security properties of hardware-based solutions, eliminating the need for separate physical tokens.
Solution Approach 2:
The OTP generation functionality is merged with the personal computing device itself, combining the convenience of having your personal device with you into the security system. The secure enclave within the device serves as both the storage medium and processing unit, eliminating the need for separate physical OTP generators.
3Ease of operation
If seed values are stored in general storage, then ease of access is improved, but security deteriorates due to potential compromise
Solution Approach 1:
Different storage locations within the computing device are assigned different security qualities. The secure enclave provides high-security storage specifically for the seed value, while other areas of the device have lower security. This local differentiation of security properties allows the seed to be protected while still being accessible when needed through proper authentication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments are generally directed to the provision and use of a secure enclave defined within a storage of a computing device by a processor element thereof to store executable instructions of an OTP component implementing logic to generate and use one-time passwords (OTPs) to enable access to services provided by another computing device. An apparatus includes a storage; a first processor element; and first logic to receive a one-time password (OTP) routine, store the OTP routine within a first secure enclave defined by the first processor element within the storage, obtain a measure of the contents of the first secure enclave with the OTP routine stored therein, transmit the first measure to a computing device, and receive an OTP seed. Other embodiments are described and claimed.