Trusted Execution Environment Root Key Deletion Against Rollback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in securing sensitive data due to the vulnerability of immutable root keys, which can be compromised and rolled back by malicious software, allowing unauthorized access to encrypted data.
Innovation Solution
Implementing a deletable root key within a trusted execution environment (TEE) that is inaccessible to a second execution environment, enabling secure operations and automatic deletion upon detection of security events, thereby preventing rollback of encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an immutable root key is used for securing data, then data can be encrypted and accessed, but the key can be compromised and rolled back by malicious software allowing unauthorized access
Solution Approach 1:
The root key is made dynamic rather than immutable. The system implements a deletable root key that can be permanently removed from storage in response to security events, preventing malicious software from performing rollback attacks. The key transitions from a static state to a dynamic one where its persistence is controlled by security conditions.
Solution Approach 2:
The system performs preliminary actions by establishing a deletable root key mechanism before security breaches can occur. Security events are pre-configured to trigger key deletion, and the system is prepared to permanently remove the root key if compromise is detected, preventing unauthorized access before it can happen.
2Reliability
If a deletable root key is implemented in a trusted execution environment, then rollback attacks are prevented, but the system complexity increases
Solution Approach 1:
A trusted execution environment (TEE) is introduced as an intermediary layer between the root key and the rest of the system. The TEE provides a secure enclave that manages the deletable root key, isolating it from malicious software in the rich execution environment. This intermediary handles the complexity of key management and deletion logic, protecting the main system from direct exposure to these complex security mechanisms.
3Reliability
If the root key is made accessible only to the trusted execution environment, then security is improved, but the ease of operation for key management decreases
Solution Approach 1:
The system is segmented into two distinct execution environments: a trusted execution environment (TEE) for secure key management and a rich execution environment (REE) for general operations. The root key is segregated and stored exclusively in the TEE, which provides hardware-enforced isolation. This segmentation allows the key to be protected while still enabling operation through controlled interfaces between the TEE and REE.
Data Source
Figure 1
Figure 2~3
Figure 4A
AI summary
A computing device includes: a trusted execution environment with access to a memory storing a deletable root key, the memory inaccessible by a second execution environment; and at least one processor operable in the trusted execution environment, wherein when operating in the trusted execution environment, the at least one processor is configured for: based on requests from the second execution environment, performing a root key operation on an encryption key utilized by the second execution environment to secure data the second execution environment; and deleting the root key after detection of a security event.