Multiple-Key Encryption Using TEE-Mediated Key Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Concentrating access to critical security components like Hardware Security Modules (HSMs) and encryption keys in a single application creates a single point of failure, limits redundancy and fault tolerance, complicates segregation of duties, and hampers monitoring and auditing efforts in digital assets platforms.
Innovation Solution
Implementing a system that generates a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE), encrypts a data encryption key (DEK) with the public KEK, and distributes the encrypted DEK to multiple actors using ephemeral keys, ensuring secure access and segregation of duties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access to critical security components is granted to a single application, then ease of operation is improved, but reliability deteriorates due to single point of failure
Solution Approach 1:
The patent divides access to critical security components into multiple segments by introducing multiple applications (first application and second application) that can independently access the HSM. Each application has its own credentials and access paths, eliminating the single point of failure while maintaining operational capability through distributed access
2Device complexity
If access to critical security components is granted to a single application, then device complexity is reduced, but reliability deteriorates due to lack of redundancy
Solution Approach 1:
The system is segmented into multiple independent access paths through different applications, each with separate credentials stored in the HSM. This segmentation provides redundancy without significantly increasing overall system complexity, as the HSM manages all credentials centrally
Solution Approach 2:
The HSM serves multiple functions by storing credentials for multiple applications and providing authentication services to different applications. This multi-functionality enables redundancy without requiring separate hardware modules for each application, thus limiting complexity increase
3Ease of operation
If a single application has high-level privileges, then ease of operation is improved, but object-generated harmful factors increase due to lack of segregation of duties
Solution Approach 1:
The patent segments the high-level privileges by creating separate credentials for different applications within the HSM. Each application has its own authenticated access path, implementing segregation of duties while maintaining operational simplicity through centralized credential management
Solution Approach 2:
The HSM acts as an intermediary that mediates access between multiple applications and critical security components. It enforces authentication and authorization policies, providing segregation of duties while maintaining ease of operation through automated credential verification
4Device complexity
If access is consolidated in a single application, then device complexity is reduced, but difficulty of detecting and measuring increases due to monitoring challenges
Solution Approach 1:
The patent segments access control into distinct credential-based access paths for different applications. Each access attempt is independently authenticated and logged by the HSM, improving audit visibility without significantly increasing access control complexity through centralized management
Data Source
AI summary
Systems and methods for providing multiple key encryption may generate a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE); provide the public KEK to a key generator; generate, by the key generator, a data encryption key (DEK) and encrypt the DEK with the public KEK; obtain, by a key processor, an ephemeral public key and the encrypted DEK, and send the ephemeral public key and the encrypted DEK to the TEE; decrypt, by the TEE, the encrypted DEK using the private KEK, and re-encrypt the decrypted DEK with the ephemeral public key; obtain, by the key processor, the re-encrypted DEK from the TEE and pass the re-encrypted DEK to a signing service; decrypt, by the signing service, the re-encrypted DEK using a corresponding ephemeral private key; and encrypt, by the signing service, data using the DEK.