Targeting Protocol Head for Trusted Execution Environment Key Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management systems (KMS) face security limitations when delivering secrets or keys to Trusted Execution Environments (TrEEs), as they often require secure channels that may not be feasible or secure, especially when dealing with untrusted requestors.
Innovation Solution
Implementing a targeting protocol head as an intermediary between the requestor and the KMS, which retrieves protected data, generates targeted protected data by encrypting it with a targeting key, and provides it to the requestor, ensuring the data is inaccessible to the requestor without the TrEE's private key for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure channel is established between the requestor and the KMS to deliver secrets, then the confidentiality of the secret is improved, but the device complexity and operational difficulty increase due to the need for secure channel management
Solution Approach 1:
The patent introduces a targeting protocol head as an intermediary component between the requestor and the KMS. This intermediary handles the secure channel establishment and secret delivery process, eliminating the need for the requestor to directly manage secure channels. The targeting protocol head receives requests from the requestor, establishes secure communication with the KMS, and delivers the secret through the TrEE, thereby resolving the complexity of secure channel management while maintaining confidentiality.
2Ease of operation
If direct access to the KMS is allowed from the requestor, then the ease of operation is improved, but the security is worsened because the requestor may be untrusted
Solution Approach 1:
The patent segments the system into distinct trust zones: the untrusted requestor, the trusted targeting protocol head, and the trusted KMS. The requestor can easily initiate requests without security concerns because the targeting protocol head acts as a trusted intermediary that validates and processes these requests. This segmentation allows ease of operation for untrusted requestors while maintaining security through the trusted intermediary layer.
Solution Approach 2:
The targeting protocol head serves as a trusted intermediary that sits between the untrusted requestor and the KMS. It receives requests from the requestor, verifies them through attestation, and communicates with the KMS on behalf of the requestor. This intermediary approach maintains security by preventing direct access from untrusted requestors while preserving ease of operation through a simplified request interface.
3Ease of operation
If the requestor can obtain the plaintext secret value directly from the KMS, then the ease of operation is improved, but the security is worsened due to potential unauthorized eavesdropping and tampering
Solution Approach 1:
The targeting protocol head acts as a trusted intermediary that receives the plaintext secret from the KMS and delivers it to the TrEE through a secure process. The requestor never receives the plaintext secret directly; instead, the secret is delivered to the TrEE which can then perform cryptographic operations. This intermediary approach maintains ease of operation for secret retrieval while eliminating the security risks of unauthorized eavesdropping and tampering by removing the requestor from the secret delivery path.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Methods, systems, and devices are described herein for delivering protected data to a trusted execution environment (TrEE) associated with a potentially untrusted requestor. In one aspect, a targeting protocol head may receive a request for protected data from a potentially untrusted requestor associated with a TrEE, and an attestation statement of the TrEE. The targeting protocol head may retrieve the protected data, and obtain a targeting key of the TrEE from, for example, the request in the case of clean room provisioning, or the attestation statement. The targeting protocol head may generate targeted protected data by encrypting the protected data with the targeting key, and provide the targeted protected data to the potentially untrusted requestor, where a private targeting key of the TrEE is required to decrypt the targeted protected data.