Techniques for key provisioning in a trusted execution environment
AssigneeIntel Corporation
InventorsMic Bowman, Andrea Miele
Life of this patent
Estimating the term…
Abstract
Techniques for securely provisioning a set of enclaves are described. A contract owner may register with a shared registry. A subset of enclaves may be selected to be provisioned from among a plurality of enclaves. A keyshare may be requested from one or more provisioning services for each of the subset of enclaves to be provisioned. The requested keyshares may be received from each provisioning service for each of the subset of enclaves to be provisioned. For each of the selected enclaves, the received keyshares may be sent for verification by the enclave. Each of the selected enclaves may send an authenticated and encrypted key derived from the received keyshares.
Claims22
A computer-implemented method for enclave provisioning, comprising:
- requesting, for each of one or more enclaves to be provisioned, a keyshare from a plurality of provisioning services;
- receiving the requested keyshares from the plurality of provisioning services, the received keyshares randomly generated portions of an encryption key, each of which is signed by a private key of the provisioning service that generated the keyshare;
- sending, to each of the one or more enclaves to be provisioned, the received keyshares for the respective one or more enclaves;
- and
- receiving, from each of the one or more enclaves, an authenticated and encrypted key derived from the received keyshares for the respective one or more enclaves.
A system for enclave provisioning, comprising:
- a contract owner device including one or more processor circuits and memory comprising instructions, which when executed by the one or more processor circuits cause contract owner device to:
- register the contract owner device with a shared registry;
- request a keyshare from a plurality of provisioning services;
- receive the requested keyshares from each of the plurality of provisioning services, the received keyshares randomly generated portions of an encryption key, each of which is signed by a private key of the provisioning service that generated the keyshare;
- send the received keyshares to the enclave for verification by the enclave;
- and
- receive, from the enclave, an authenticated and encrypted key derived from the received keyshares.
An article comprising a non-transitory computer-readable storage medium that stores instructions for execution by processing circuitry of a contract owner device, the instructions to cause the contract owner device to:
- request a keyshare from a plurality of provisioning services;
- receive the requested keyshares from each of the plurality of provisioning services, the received keyshares randomly generated portions of an encryption key, each of which is signed by a private key of the provisioning service that generated the keyshare;
- send the received keyshares to an enclave for verification by the enclave;
- and
- receive, from the enclave, an authenticated and encrypted key derived from the received keyshares.
Dependencies are inferred from the claim text.