Secure Enclave Processor Multi-User Storage Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing device security measures are inadequate in preventing unauthorized access, especially when physical access is gained, as data can still be extracted from unencrypted storage, and existing encryption methods rely on user-provided entropy, which may not be sufficient against evolving cryptographic and cryptanalysis techniques.
Innovation Solution
Implementing a secure enclave processor that generates and manages volume encryption keys without user-provided entropy, using a non-volatile memory controller to access encrypted data, and enabling multi-user storage volume encryption, along with passcode throttling to limit brute-force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in unencrypted manner to enable easy access, then ease of operation is improved, but security against physical access attacks deteriorates
Solution Approach 1:
The system performs preliminary encryption of data before storage, and pre-generates encryption keys through the secure enclave processor. This allows data to be automatically decrypted during normal operation without user intervention, maintaining ease of access while ensuring security against physical attacks.
Solution Approach 2:
The secure enclave processor acts as an intermediary between the storage system and the main processor. It securely generates and manages encryption keys, and performs decryption operations without exposing sensitive cryptographic material to the main system, thus preventing unauthorized extraction while enabling legitimate access.
2Reliability
If user-provided entropy is used for encryption key generation to enhance security, then reliability is improved, but ease of operation deteriorates due to requiring user credentials
Solution Approach 1:
The secure enclave processor performs self-service by automatically generating high-quality entropy and deriving encryption keys without requiring user-provided credentials. This eliminates the need for users to enter passcodes or credentials for decryption, improving ease of operation while maintaining strong security through hardware-based random number generation.
3Reliability
If multiple encryption layers are implemented to defend against physical access, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent combines multiple security functions into a single secure enclave processor: entropy generation, key derivation, key encryption/decryption, and secure key storage. This consolidation provides multi-layer encryption protection while reducing overall system complexity by centralizing cryptographic operations in a dedicated security module rather than distributing them across multiple components.
Data Source
AI summary
Embodiments described herein enable multi-user storage volume encryption via a secure enclave processor. One embodiment provides for a computing device comprising a first processor to execute a first operating system having one or more user accounts; a second processor to execute a second operating system, the second processor to receive a first encrypted key from the first processor and decrypt a volume encryption key via a key encryption key derived from the first encrypted key, the first encrypted key derived via the secure enclave without user-provided entropy; and a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.