Confidential Computing With Security-Core Decryption Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant environments, existing systems face challenges in maintaining data confidentiality as encrypted data is decrypted and stored in plaintext form, making it vulnerable to malicious attacks.
Innovation Solution
A method and system for confidential computing that involves encrypting data with tenant-specific keys, using a security core to manage and store encrypted data, and decrypting only when authorized, ensuring data is maintained in an encrypted form within a secure domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the system decrypts encrypted data and stores it in plaintext form in memory for processing, then data accessibility and processing efficiency are improved, but data confidentiality is compromised and vulnerability to malicious attacks increases
Solution Approach 1:
The patent introduces a security core as an intermediary component between the main core and memory. The security core manages encryption keys and controls decryption operations, acting as a mediator that allows the main core to process data while preventing unauthorized access to plaintext data in memory. This intermediary structure resolves the contradiction by enabling efficient processing through the main core while maintaining confidentiality through the security core's key management capabilities.
Solution Approach 2:
The system is divided into two distinct segments: a main core responsible for data processing and a security core responsible for key management and decryption control. This segmentation allows each component to perform its specialized function - the main core achieves high processing efficiency while the security core ensures data confidentiality by controlling when and how decryption occurs, thus resolving the contradiction between productivity and security.
2Adaptability or versatility
If multiple tenants share a single system for computing services, then resource utilization and cost efficiency are improved, but maintaining data confidentiality across tenants becomes more difficult
Solution Approach 1:
The security core is designed as a universal component that serves multiple tenants simultaneously. It manages multiple encryption keys and handles decryption requests from different tenants, providing multi-tenant support while maintaining individual data confidentiality. The single security core performs multiple functions - key management for different tenants, authorization control, and decryption operations - thus enabling multi-tenant versatility without compromising reliability of data protection.
Solution Approach 2:
Each tenant's data is protected with tenant-specific encryption keys managed by the security core. This local quality approach ensures that while the system provides universal multi-tenant support, each tenant's data maintains its own security characteristics through dedicated key management, allowing the system to be versatile across tenants while reliable in protecting each tenant's confidential information.
Data Source
AI summary
A method for confidential computing is provided, which is performed by a security core including one or more processor, and includes storing first encrypted data associated with a first tenant in a first memory, in which the first encrypted data is obtained by performing encryption of the first plaintext data using a first encryption key associated with the first tenant, in response to receiving a request to access the first plaintext data, decrypting the first encrypted data using the first encryption key so as to generate the first plaintext data, and providing the first plaintext data to a main core that processes data stored in the first memory.