Trusted I/O Support for External Peripheral Devices

The patent applies preliminary action by encrypting I/O data before it leaves the secure enclave and establishing security credentials in advance. The cryptographic engine encrypts data with encryption keys stored in the secure enclave, and the external device stores security credentials (public keys, certificates) beforehand to enable verification. This pre-established security framework protects data during external transmission without limiting transfer capability.

The patent introduces cryptographic intermediaries to protect data transmission. A cryptographic engine acts as an intermediary between the secure enclave and external devices, encrypting data with encryption keys. Security credentials (public keys, certificates, digital signatures) serve as intermediaries to verify the authenticity and integrity of external devices and data, allowing secure communication without exposing sensitive keys or data.

The patent extracts cryptographic functions from the main processor into a dedicated secure enclave and cryptographic engine. The secure enclave contains encryption keys and security credentials separate from the main system, creating an isolated security domain. This extraction protects cryptographic materials while providing dedicated hardware acceleration for encryption/decryption operations, reducing the cryptographic processing burden on the main processor and simplifying the overall system architecture.

The patent implements self-service through automatic cryptographic operations. The cryptographic engine automatically encrypts I/O data using keys from the secure enclave without requiring manual intervention. The external device automatically verifies data integrity using stored security credentials (public keys, certificates). The system autonomously manages key storage, data encryption, and verification processes, reducing complexity by eliminating manual cryptographic management.