Trusted Key Access Broker for Edge IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management systems (KMS) face challenges in secure key distribution and access control due to proprietary APIs, vendor lock-in, and latency issues, particularly in edge computing and IoT scenarios, where caching keys is not guaranteed to be isolated and protected from system software and rogue administrators.
Innovation Solution
A Trusted Key Access Broker (TKAB) service is introduced, providing a unified API for disparate key stores and KMS, running in a Trusted Execution Environment (TEE) to enforce attestation-based access control, verify trustworthiness, and cache keys in a distributed Hardware Security Module (HSM) close to workloads, ensuring secure and isolated key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a unified API is provided for disparate key stores and KMS, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The patent introduces a Trusted Key Access Broker (TKAB) service that acts as an intermediary between clients and disparate key management systems. The TKAB provides a unified API that translates client requests into appropriate operations on different KMS, eliminating the need for clients to directly interact with multiple proprietary APIs while managing the complexity of interoperability within the broker itself.
2Speed
If keys are cached close to workloads, then speed is improved, but reliability deteriorates
Solution Approach 1:
The patent implements different security properties at different locations in the system. Keys are cached locally at edge nodes or workloads for fast access, but the TKAB service maintains centralized control and security policies. The system provides both local speed benefits and centralized reliability through the broker's attestation-based access control and its role in key distribution and rotation.
3Reliability
If attestation-based access control is enforced, then reliability is improved, but device complexity increases
Solution Approach 1:
The TKAB service serves as an intermediary that handles the complexity of attestation verification and access control decisions. Clients simply provide their attestation evidence to the TKAB, which then determines whether to grant key access based on configured policies. This moves the complexity of security evaluation into the broker rather than requiring clients to implement sophisticated attestation verification themselves.
Data Source
AI summary
Various systems and methods for providing a trusted key access broker are described herein. A system may be configured to receive, at a trusted key access broker, from a requestor via a broker application programming interface, a request for a cryptographic key operation, the request associated with attestation evidence data; use the attestation evidence data to validate the requestor; in response to validating the requestor, translate and transmit the request for the cryptographic key operation to one of the plurality of key management systems; receive a response from the one of the plurality of key management systems; and transmit the response to the requestor.