Tamper-Resistant Module for Encrypted File System Key Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system security methods are vulnerable to attacks, especially when an attacker gains physical access or exploits security flaws, as master secrets used for encryption and decryption can be compromised, and encrypted data can be accessed by attaching a stolen hard drive to another system.
Innovation Solution
A system that uses a tamper-resistant module (TRM) to decrypt file keys with an external master secret, ensuring that encryption and decryption operations occur outside the file system, providing secure access to encrypted files by maintaining the master secret and file keys in a safer location, and using class keys and ephemerizer-class keys for additional protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If master secrets are maintained outside the file system to prevent compromise, then security against file system attacks is improved, but the master secret becomes vulnerable when sent to the file system for encryption/decryption operations
Solution Approach 1:
The patent introduces a secure communication channel as an intermediary between the TRM and file system. This channel encrypts all communications using file system keys, preventing attackers from intercepting or monitoring master secrets during transmission. The TRM sends file keys to the file system through this protected channel, resolving the vulnerability that would otherwise exist during key transmission.
2Ease of operation
If the file system maintains master secrets to enable file access, then ease of operation is improved, but the master secrets become vulnerable to theft by malicious processes
Solution Approach 1:
The patent extracts the master secret from the file system and places it in a separate TRM. The file system no longer stores or handles master secrets directly. Instead, it receives only the decrypted file keys from the TRM through secure communication, enabling file access while eliminating the security risk of master secret exposure to malicious processes.
Solution Approach 2:
The system segments the security functions by separating the master secret storage (in TRM) from the file system operations. The TRM handles only key decryption, while the file system handles only file access. This segmentation ensures that even if the file system is compromised, the master secret remains protected in the isolated TRM.
3Device complexity
If encryption operations are performed within the file system for simplicity, then device complexity is reduced, but security is compromised when the file system is attacked
Solution Approach 1:
The patent extracts the critical encryption/decryption operations from the file system and places them in a separate TRM. The TRM performs file key decryption using master secrets, while the file system performs only file data decryption using file keys. This extraction maintains operational simplicity at the file system level while securing the most vulnerable operations in a protected environment.
Data Source
AI summary
One embodiment of the present invention provides a system for accessing an encrypted file through a file system. During operation, the system receives a request to access the encrypted file. In response to the request, the system sends an encrypted file key for the encrypted file from the file system to a tamper-resistant module. Next, the tamper-resistant module uses a master secret to decrypt the encrypted file key to restore the file key, wherein the master secret is obtained from an external source by the tamper-resistant module. The system then uses the file key to access the encrypted file.