Trusted Execution Environment for Remote Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote data storage systems face security risks due to vulnerabilities in encryption key management, as both local and remote storage solutions are susceptible to malicious attacks that can access encryption keys, compromising data security.
Innovation Solution
Implementing a trusted execution environment (TEE) with an encryption service that utilizes secure enclave technology to generate and manage encryption keys within a virtual machine, ensuring that only verified programs can access and use these keys for encrypting and decrypting data, thereby protecting both the data and the encryption tools from unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted prior to storage on a remote resource, then data security is improved, but encryption keys stored on the user's device become vulnerable to rootkits and high-privilege attacks
Solution Approach 1:
The patent extracts the encryption key storage and management functionality from the user's device and relocates it to a remote server. The encryption keys are generated, stored, and managed entirely on the remote server, while the user's device only holds encrypted data and encryption/decryption applications. This extraction eliminates the vulnerability of local key storage to rootkits and high-privilege attacks on the user's device.
Solution Approach 2:
The patent introduces a remote server as an intermediary between the user's device and the encrypted data. The server acts as a mediator that securely manages encryption keys and performs encryption/decryption operations. The user's device communicates with the server through authenticated sessions, and the server mediates all key-related operations, preventing direct exposure of keys to potential attacks on the user's device.
2Reliability
If encryption keys are stored on the remote resource, then local device security is improved, but the remote resource becomes a target for attacks to access encryption keys
Solution Approach 1:
The patent applies different security qualities to different locations in the system. The remote server implements enhanced security measures specifically for key storage and management, including secure enclaves, hardware security modules, and restricted access controls. The user's device implements security focused on data protection and authenticated communication. This localized quality approach optimizes security for each component's specific requirements.
Solution Approach 2:
The patent implements preliminary security measures on the remote server to prevent attacks before they can compromise encryption keys. These include pre-configured firewalls, intrusion detection systems, secure enclave initialization, and authentication mechanisms that prevent unauthorized access attempts. The server proactively defends against potential attacks rather than reacting to them.
3Reliability
If a trusted execution environment is implemented with secure enclave technology, then encryption key security is improved, but system complexity increases
Solution Approach 1:
The patent uses virtualization to create a virtual copy of a secure execution environment within the remote server. Instead of requiring physical secure hardware at every client device, the system creates a virtual trusted execution environment that can be replicated and distributed. This virtual copy provides the same security guarantees as physical secure hardware while being easier to deploy and manage across distributed systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure is directed to a protection scheme for remotely-stored data A system may comprise, for example, at least one device including at least one virtual machine (VM) and a trusted execution environment (TEE)The TEE may include an encryption service to encrypt or decrypt data received from the at least one VM. In one embodiment, the at least one VM may include an encryption agent to interact with interfaces in the encryption service. For example, the encryption agent may register with the encryption service, at which time an encryption key corresponding to the at least one VM may be generated. After verifying the registration of the encryption agent, the encryption service may utilize the encryption key corresponding to the at least one VM to encrypt or decrypt data received from the encryption agent. The encryption service may then return the encrypted or decrypted data to the encryption agent.