TEE Data Provenance Authentication for Delayed Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current attestation mechanisms are inadequate for determining the provenance of data generated by a trusted execution environment (TEE) across time spans, especially when data is consumed by an outside party at a later time.
Innovation Solution
Data is signed with a signing key, encrypted with an encryption key, and stored securely. Upon request, the encrypted data is provided to a data consumer who decrypts and authenticates it using corresponding keys, ensuring trust in the signing key through certificate verification or quote validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current attestation mechanisms are used for real-time data consumption, then data authenticity can be verified, but the mechanism cannot determine data provenance across time spans when data is accessed later
Solution Approach 1:
The patent applies preliminary action by signing data with a TEE-origin proof at the time of data generation, creating a time-invariant cryptographic signature that can be verified later. This pre-established signature mechanism allows data provenance verification across arbitrary time spans without requiring the TEE to be actively attested at verification time, thus resolving the contradiction between reliability and time-span adaptability
2Reliability
If data is signed and encrypted to ensure authenticity and integrity, then provenance verification is achieved, but system complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic operations (signing and encryption) to be performed only once at data generation time within the TEE, separating these from the verification process. The signature and ciphertext are stored with the data, allowing simple verification later without requiring the full cryptographic system to be present at verification time, thus reducing overall system complexity while maintaining authenticity
3Reliability
If cryptographic operations are performed on data, then security and authenticity are improved, but processing time and performance overhead increase
Solution Approach 1:
The patent performs cryptographic operations (signing and encryption) as preliminary actions at data generation time, so that when data is retrieved later, verification can proceed without repeating the full cryptographic transformation. This shifts the computational burden to data creation time, improving subsequent data access performance while maintaining security
Solution Approach 2:
The patent creates cryptographic copies (signatures and encrypted forms) of the original data that can be verified independently. These cryptographic copies serve as portable proofs of authenticity that can be validated quickly without reprocessing the original data through the full cryptographic pipeline, thus reducing verification overhead
Data Source
AI summary
Aspects of the subject disclosure may include, for example, capturing data by a first communication device associated with a data producer, signing the data with a signing key resulting in signed data, encrypting the signed data according to an encryption key resulting in encrypted signed data, and storing the encrypted data in a storage device. Further, the embodiments can include receiving, over a communication network, a request associated with the data from a second communication device associated with a data consumer, and providing, over the communication network, the encrypted signed data to the second communication device. The second communication device receives the encrypted signed data, decrypts the encrypted signed data according to a decryption key resulting in the decrypted signed data, and authenticates the decrypted signed data. Other embodiments are disclosed.