Trusted Execution Environment for Secure Group File Sharing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current file sharing applications using cloud storage face challenges in ensuring end-to-end encryption and secure data sharing, particularly in protecting data from unauthorized access and internal attackers, while also requiring efficient management of permissions and revocations in dynamic groups.

Innovation Solution

The implementation of a trusted execution environment (TEE) using Intel SGX or similar technologies for secure group file sharing, which provides an isolated environment for encryption and decryption, enabling end-to-end encryption, immediate permission and membership revocations, and deduplication, while maintaining low latency and high throughput through optimized TLS and probabilistic authenticated encryption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cloud-based file sharing service is used, then cost is reduced and availability is increased, but data security is compromised due to unauthorized access and internal attackers

Engineering Contradiction:
Improvedata securityVSAvoidencryption management complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a Trusted Execution Environment (TEE) as an intermediary layer between the cloud storage service and users. The TEE enclave acts as a mediator that performs encryption and decryption operations securely, isolating cryptographic operations from both untrusted cloud infrastructure and external attackers. This resolves the contradiction by providing strong security guarantees without requiring complex client-side encryption management, as the TEE handles security operations automatically.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent extracts cryptographic operations (encryption and decryption) from the untrusted cloud environment and places them inside a TEE enclave. By separating the security-critical functions from the general-purpose cloud infrastructure, the system achieves strong security guarantees while maintaining the simplicity of cloud-based file sharing. The TEE enclave is the extracted secure component that handles all sensitive operations.

Inventive Principle:
Principle #2Taking out (Extraction)

2Productivity

If traditional encryption methods are used for file sharing, then data confidentiality is protected, but permission management and revocation become inefficient requiring re-encryption

Engineering Contradiction:
Improvepermission management efficiencyVSAvoidtime for re-encryption operations
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The patent implements preliminary action by pre-establishing encrypted file shares with the TEE enclave before permission changes are needed. The initial encryption setup creates a secure foundation that allows for efficient permission management. When permission changes or revocations are needed, the system can update access controls within the TEE without requiring time-consuming re-encryption operations, as the TEE enclave maintains secure state and can revoke permissions immediately.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If end-to-end encryption is implemented, then data protection is improved, but computational overhead and latency increase

Engineering Contradiction:
Improvedata protectionVSAvoidfile access speed
Core Design Contradiction:
ReliabilityVSSpeed

Solution Approach 1:

The TEE enclave provides self-service by automatically managing encryption and decryption operations without requiring external intervention or complex client-side processing. The enclave handles cryptographic operations internally using its secure state, reducing the computational burden on client devices and minimizing latency. The self-contained nature of the TEE allows for efficient encryption/decryption cycles that maintain high file access speeds while providing strong security.

Inventive Principle:
Principle #25Self-service

4Ease of operation

If cloud storage is used for group file sharing, then accessibility and availability are improved, but control over permissions and access rights becomes difficult

Engineering Contradiction:
Improvegroup file sharing easeVSAvoidpermission control complexity
Core Design Contradiction:
Ease of operationVSDevice complexity

Solution Approach 1:

The TEE enclave provides universal permission management that handles multiple functions (encryption, decryption, permission granting, revocation) within a single secure environment. This multi-functional approach simplifies group file sharing by providing a unified interface for managing access rights across multiple users and devices. The enclave's secure state maintains permission information, allowing for easy granting and revoking of access rights without complex client-side permission management.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3866041B1Secure group file sharing
Publication Date: 2024.02.07 SAP SE
  • EP3866041B1 patent drawingFigure 1
  • EP3866041B1 patent drawingFigure 2
  • EP3866041B1 patent drawingFigure 3

AI summary

The disclosure is directed to secure group file sharing. An architecture for end-to-end encrypted, group-based file sharing using a trusted execution environment (TEE) is provided to protect confidentiality and integrity of data and management of files, enforce immediate permission and membership revocations, support deduplication, and mitigate rollback attacks. In particular, a method is disclosed that includes establishing, by an enclave (220) executed by the TEE a trusted relationship with a user, associating, by the enclave, access control permissions (262) to a file (261) linked from the user application (202) to a remote file system at the untrusted provider, the control permissions are defined for individual users and/or groups of users, and providing, by the enclave, access to the file, after verification that a request for the file satisfies the access control permissions, by decrypting the encrypted file and sending the file.