Trusted Execution Environment for Secure Group File Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file sharing applications using cloud storage face challenges in ensuring end-to-end encryption and secure data sharing, particularly in protecting data from unauthorized access and internal attackers, while also requiring efficient management of permissions and revocations in dynamic groups.
Innovation Solution
The implementation of a trusted execution environment (TEE) using Intel SGX or similar technologies for secure group file sharing, which provides an isolated environment for encryption and decryption, enabling end-to-end encryption, immediate permission and membership revocations, and deduplication, while maintaining low latency and high throughput through optimized TLS and probabilistic authenticated encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based file sharing service is used, then cost is reduced and availability is increased, but data security is compromised due to unauthorized access and internal attackers
Solution Approach 1:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary layer between the cloud storage service and users. The TEE enclave acts as a mediator that performs encryption and decryption operations securely, isolating cryptographic operations from both untrusted cloud infrastructure and external attackers. This resolves the contradiction by providing strong security guarantees without requiring complex client-side encryption management, as the TEE handles security operations automatically.
Solution Approach 2:
The patent extracts cryptographic operations (encryption and decryption) from the untrusted cloud environment and places them inside a TEE enclave. By separating the security-critical functions from the general-purpose cloud infrastructure, the system achieves strong security guarantees while maintaining the simplicity of cloud-based file sharing. The TEE enclave is the extracted secure component that handles all sensitive operations.
2Productivity
If traditional encryption methods are used for file sharing, then data confidentiality is protected, but permission management and revocation become inefficient requiring re-encryption
Solution Approach 1:
The patent implements preliminary action by pre-establishing encrypted file shares with the TEE enclave before permission changes are needed. The initial encryption setup creates a secure foundation that allows for efficient permission management. When permission changes or revocations are needed, the system can update access controls within the TEE without requiring time-consuming re-encryption operations, as the TEE enclave maintains secure state and can revoke permissions immediately.
3Reliability
If end-to-end encryption is implemented, then data protection is improved, but computational overhead and latency increase
Solution Approach 1:
The TEE enclave provides self-service by automatically managing encryption and decryption operations without requiring external intervention or complex client-side processing. The enclave handles cryptographic operations internally using its secure state, reducing the computational burden on client devices and minimizing latency. The self-contained nature of the TEE allows for efficient encryption/decryption cycles that maintain high file access speeds while providing strong security.
4Ease of operation
If cloud storage is used for group file sharing, then accessibility and availability are improved, but control over permissions and access rights becomes difficult
Solution Approach 1:
The TEE enclave provides universal permission management that handles multiple functions (encryption, decryption, permission granting, revocation) within a single secure environment. This multi-functional approach simplifies group file sharing by providing a unified interface for managing access rights across multiple users and devices. The enclave's secure state maintains permission information, allowing for easy granting and revoking of access rights without complex client-side permission management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure is directed to secure group file sharing. An architecture for end-to-end encrypted, group-based file sharing using a trusted execution environment (TEE) is provided to protect confidentiality and integrity of data and management of files, enforce immediate permission and membership revocations, support deduplication, and mitigate rollback attacks. In particular, a method is disclosed that includes establishing, by an enclave (220) executed by the TEE a trusted relationship with a user, associating, by the enclave, access control permissions (262) to a file (261) linked from the user application (202) to a remote file system at the untrusted provider, the control permissions are defined for individual users and/or groups of users, and providing, by the enclave, access to the file, after verification that a request for the file satisfies the access control permissions, by decrypting the encrypted file and sending the file.