Trusted Platform Module Key Isolation for Remote Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storing sensitive information on remote computing systems poses risks due to potential unauthorized access or compromise by operators or malicious actors, compromising security and confidentiality.
Innovation Solution
Encrypting sensitive information using a cryptographic key and storing the encrypted data and key in a remote system while keeping the decryption key within a trusted platform module internal to the computing device, ensuring only the device can decrypt the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If sensitive information is stored on a remote computing system, then storage capacity and accessibility are improved, but security and confidentiality deteriorate due to potential unauthorized access
Solution Approach 1:
The system segments the cryptographic key management by separating the decryption key from the encrypted data. The encrypted data is stored remotely while the decryption key remains locally within the TPM, creating distinct storage locations for different components of the security system.
Solution Approach 2:
The TPM acts as an intermediary between the remote storage system and the local computing device. It securely holds the decryption key and controls access to the encrypted data without exposing the key to the remote system, thereby mediating the security conflict between remote storage and local protection.
2Reliability
If the decryption key is stored locally in the computing device, then security is improved, but data accessibility and remote retrieval capability deteriorate
Solution Approach 1:
The system extracts the decryption key from the general storage system and places it specifically within the TPM's secure enclave. This extraction allows the key to remain protected locally while the encrypted data can be freely stored and retrieved from remote systems.
Solution Approach 2:
The solution adds a new dimension to key storage by utilizing the TPM's secure hardware environment. Instead of storing the key in conventional memory or file systems, the TPM provides a separate security dimension that maintains local control while enabling remote data accessibility.
3Quantity of substance
If encrypted data and key are both stored remotely, then storage efficiency is improved, but vulnerability to unauthorized access increases
Solution Approach 1:
The system creates an encrypted copy of the data for remote storage while maintaining the original decryption capability locally through the TPM. This copying approach allows efficient remote storage without compromising security, as the encrypted copy cannot be accessed without the locally-held key.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Sensitive information can be managed using a trusted platform module. For example, a system can encrypt target information using a cryptographic key to generate encrypted data. The system can also receive an encrypted key from a trusted platform module, where the encrypted key is a version of the cryptographic key that is encrypted using a public key stored in the trusted platform module. The system can then transmit the encrypted data and the encrypted key to a remote computing system, for example to store the encrypted data and the encrypted key on the remote computing system. Using these techniques, the target information may be secured and stored in remote locations.