Binding Trusted Input and Output Sessions to Prevent Replay Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems, such as Software Guard Extensions (SGX), face vulnerabilities in maintaining end-to-end security for user interactions, particularly in scenarios where trusted input and output sessions are independent and require simultaneous activation, making them susceptible to unbinding attacks where encrypted output from previous sessions can be reused to compromise user input.
Innovation Solution
The solution involves binding a trusted input session to a trusted output session by generating a unique session identifier and using a trusted I/O session indicator to ensure that both sessions are closed together, preventing unauthorized access and misuse of encrypted data. This is achieved through a Converged Security Engine (CSE) and a cryptographic module that verifies and manages encryption keys, ensuring secure communication channels for input and output operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If trusted input session and trusted output session are maintained as independent sessions, then each session can be managed separately, but the system becomes vulnerable to unbinding attacks where encrypted output from previous sessions can be reused
Solution Approach 1:
The patent merges the management of trusted input session and trusted output session by binding them together through a shared session identifier. When an unbinding attack is detected (encrypted output from previous session is presented), the system closes both the trusted input session and trusted output session simultaneously, preventing the attacker from reusing encrypted output while maintaining operational simplicity through unified session management.
2Productivity
If encrypted output from previous sessions can be stored and reused, then output generation is efficient, but the system becomes susceptible to replay attacks
Solution Approach 1:
The patent implements preliminary detection by checking whether presented encrypted output corresponds to an active trusted output session before allowing decryption and display. The session identifier in the encrypted output is verified against the currently active trusted output session, preventing replay attacks while allowing efficient reuse of encryption keys during legitimate active sessions.
Solution Approach 2:
The system continuously monitors the relationship between trusted input session and trusted output session states. When encrypted output is presented, the system provides feedback by verifying the session identifier and detecting unbinding conditions, then responds by closing both sessions to prevent replay attacks, creating a closed-loop security mechanism.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an embodiment provided herein, there is provided a system that binds a trusted output session to a trusted input session. The system includes a processor to execute an enclave application in an architecturally protected memory. The system includes at least one logic unit forming a trusted entity to, responsive to a request to set up a trusted I/O session, generate a unique session identifier logically associated with the trusted I/O session and set a trusted I/O session indicator to a first state. The system includes at least one logic unit forming a cryptographic module to, responsive to the request to set up the trusted I/O session, receive an encrypted encryption key and the unique session identifier from the enclave application; verify the unique session identifier; and responsive a successful verification, decrypt and save the decrypted encryption key in an encryption key register.