Secure Enclave Software Upgrades with Dual-Version Tenant Key Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems face challenges in efficiently upgrading software in secure enclaves for tenant-specific encryption workloads without causing downtime or compromising security, particularly when updating enclave software code that is used to access tenant keys.
Innovation Solution
A method and apparatus for automatically upgrading software in secure enclaves by generating an updated key policy that includes unique identifiers for both current and new versions of the software code, allowing both versions to access tenant keys during a transition period, thereby ensuring seamless software updates without downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software code in secure enclaves is updated, then software functionality and security are improved, but access to tenant keys is lost because the KMS cannot verify the authenticity of access requests from updated software
Solution Approach 1:
The system performs preliminary actions by generating an updated key policy before the software update takes effect. The key policy is updated to include the new software version's identifier, and the key management API is pre-configured to accept requests from both old and new versions. This preliminary configuration ensures that when the software updates, access to tenant keys is maintained without interruption.
Solution Approach 2:
The key policy serves as an intermediary between the KMS and the enclave software. It mediates access requests by containing a list of authorized software identifiers. When software updates, the key policy is updated to include the new identifier, allowing the KMS to verify and grant access to updated software without directly trusting the software itself.
2Productivity
If software code is modified or updated, then new functionality is achieved, but the KMS is unable to verify the authenticity of access requests and denies access to tenant keys
Solution Approach 1:
The system changes parameters by updating the key policy to include a new software identifier corresponding to the updated version. Instead of changing the verification mechanism itself, the system modifies the parameter (the list of authorized identifiers in the key policy) to accommodate the new software version, maintaining verification reliability while enabling functionality updates.
3Productivity
If traditional software update methods are used in secure enclaves, then software upgrades can be performed, but downtime occurs and continuous access to tenant secrets is interrupted
Solution Approach 1:
The system ensures continuity of useful action by maintaining access to tenant keys throughout the software update process. The key policy is updated to include both the old and new software identifiers, allowing the enclave to continue accessing keys during the transition. This eliminates downtime and ensures continuous operation of cryptographic workloads.
4Reliability
If access control is strictly enforced through KMS verification, then security is maintained, but legitimate software updates are blocked
Solution Approach 1:
The system introduces dynamics by making the key policy adaptable and changeable. Instead of a static access control list, the key policy can be dynamically updated to include new software identifiers. This allows the system to maintain strict security verification while accommodating legitimate updates through policy modification rather than blocking access.
Data Source
AI summary
Methods, systems, devices, and computer-readable media for automatically updating software in secure enclaves are described. A secrets management system may receive an indication that an updated version of software code to be executed in an isolated execution environment, e.g., an enclave, is available for deployment. An identifier associated with the updated version of the software code may be determined. Configuration data may be updated to indicate identifiers associated with the current and updated versions of the software code. The updated configuration data may be used to update a key policy to include the identifiers of the current and updated versions of the software code. The updated key policy may be applied to one or more managed keys and may be used to update a key management application programming interface (API) to enable both the current and updated versions of the software code to access the one or more managed keys.