Trusted Enclave Data Restoration with Segmented Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data platforms are vulnerable to system intrusion and privilege misuse, leading to unauthorized access and exfiltration of data, as traditional encryption methods do not provide sufficient protection against attacks that compromise data encryption keys.
Innovation Solution
Utilizing a trusted execution environment (TEE) with confidential computing to generate data encryption keys from multiple units of distinct key data, requiring collaboration from both the provider and owner to decrypt encrypted data, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption methods are used to protect data, then data can be decrypted with a single encryption key, but the system becomes vulnerable to system intrusion and privilege misuse attacks where unauthorized parties can access and exfiltrate data
Solution Approach 1:
The encryption key is segmented into multiple distinct key data units (first key data, second key data, etc.) that are stored separately. Each unit alone is insufficient to decrypt the encrypted data; all units must be combined to reconstruct the full encryption key. This segmentation prevents unauthorized access even if some key data units are compromised through system intrusion or privilege misuse attacks.
Solution Approach 2:
A trusted execution environment (TEE) acts as an intermediary that securely stores and manages the key data units. The TEE controls the combination of key data units and the decryption process, ensuring that even if external systems are compromised, the key material remains protected within the secure enclave. This intermediary layer adds a security boundary that prevents direct access to encryption keys.
2Ease of operation
If data encryption keys are stored centrally for easy access, then decryption is simple and fast, but unauthorized parties can confiscate or delete encryption keys once they gain access to the system
Solution Approach 1:
The encryption key material is divided into multiple distributed key data units stored in different locations or managed by different parties. This distribution ensures that no single point of failure exists where an attacker could confiscate or delete the entire key. The segmented structure maintains ease of operation because the system automatically manages the distribution and combination of key units without requiring manual intervention.
Solution Approach 2:
Key data units are pre-distributed and stored in secure locations before any potential attack occurs. The trusted execution environment is pre-configured with the necessary key management capabilities. This preliminary distribution and setup ensures that even if attackers gain system access later, they cannot access all key material in one location to confiscate or delete it.
3Reliability
If multiple units of distinct key data are required for decryption, then security against system intrusion and privilege misuse is improved, but the decryption process becomes more complex requiring collaboration from multiple parties
Solution Approach 1:
The trusted execution environment automatically manages the complex process of retrieving, combining, and using multiple key data units for decryption. Once authorized, the TEE self-services the key management operations without requiring manual coordination between parties. This automation maintains high security through multi-unit key requirements while reducing operational complexity by eliminating the need for manual key handling and collaboration protocols.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Techniques are described for protected data restoration using confidential computing. An example method comprises receiving, by a data platform implemented by a computing system, a request to restore an encrypted chunk of data, the encrypted chunk stored with first encrypted key data and second encrypted key data, receiving, by an enclave implemented in a trusted execution environment, first encrypted key data and second encrypted key data from the storage cluster, decrypting, by the enclave, the first encrypted key data to obtain the first key data and the second encrypted key data to obtain the second key data, generating, by the storage cluster, a derived data encryption key corresponding to the data encryption key based on the first key data and the second key data, and decrypting, by the storage cluster, the encrypted chunk with the derived data encryption key to generate a decrypted chunk.