Trusted Execution Environment Private Key Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional server-side symmetric key generation techniques are vulnerable to unauthorized access due to exposure of symmetric keys during storage and transmission, posing a risk to encrypted data.
Innovation Solution
Implementing a cryptographic method that generates and secures an asymmetric key pair within a trusted execution environment, using a processor to create an application password with entropy, derive a symmetric key, and encrypt it, while keeping the private key isolated and accessible only through user entropy mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric keys are stored and transmitted between devices, then data encryption is enabled, but unauthorized access risk increases due to key exposure
Solution Approach 1:
The patent extracts the private key from the symmetric key system and stores it separately in a secure element or trusted execution environment. The symmetric key is derived from the private key only when needed, rather than being stored and transmitted. This separation eliminates the exposure risk of symmetric keys during transmission while maintaining data encryption capability.
Solution Approach 2:
The system segments the cryptographic functionality into distinct components: the private key is stored in a secure element, the symmetric key is derived on-demand, and the data encryption/decryption occurs in the application layer. This segmentation ensures that even if one component is compromised, the others remain protected.
2Reliability
If symmetric keys are encrypted for transmission, then security is improved, but complexity of key management increases
Solution Approach 1:
The patent eliminates the need to encrypt and transmit symmetric keys by extracting the private key management to a secure element. The symmetric key is derived locally from the private key using a key derivation function, removing the complex key management infrastructure required for secure key transmission.
3Reliability
If private key is stored in a secure area, then access security is improved, but accessibility for cryptographic operations becomes more restricted
Solution Approach 1:
The patent introduces a key derivation function as an intermediary between the stored private key and the cryptographic operations requiring symmetric keys. The private key remains securely stored, while the key derivation function mediates by generating symmetric keys on-demand without exposing the private key, thus maintaining both security and accessibility.
Data Source
AI summary
An asymmetric cryptographic method for securing access to a private key generated and stored in a device is provided. The method includes generating an application password relating to a predetermined level of entropy; generating, within a trusted execution environment relating to a key manager, a user private key secured by using the application password; receiving, from a user via an input device, user entropy relating to a unique identifier for the user; deriving, using a password derivation function, a symmetric key based on the user entropy; encrypting, using an encryption system, the application password by using the symmetric key; and storing, in a memory, a device payload component relating to the application password and the symmetric key in a password management system.