US 10,833,858 B2Granted

Secure cryptlet tunnel

AssigneeMicrosoft Technology Licensing, LLC

InventorJohn Marley Gray

Life of this patent

Estimating the term…

Loading patent…

Abstract

The disclosed technology is generally directed to secure transactions. In one example of the technology, a secure encrypted communication tunnel between the enclave and a hardware security module (HSM) may be established and used. Establishing the tunnel includes the following steps. A session public/private enclave key pair, including a session enclave private key and a session enclave public key, may be derived from the public/private key pair of the enclave. The session enclave public key may be sent to the HSM. A session HSM public key may be received from the HSM. Additional information may be encrypted with the session HSM public key. The encrypted additional information may be sent to the HSM. Further encrypted information may be received from the HSM. The further encrypted information may be decrypted with the session enclave private key.

Claims23

Dependent claims

An apparatus for secure transactions, comprising:

a device including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the device to perform actions, including:
storing, in an enclave, an enclave key pair including an enclave private key and an enclave public key, wherein the enclave is a secure execution environment;
registering the enclave as a member of an enclave pool, such that members of the enclave pool act as pooled resources, provisionable on demand, for executing smart contract logic off of a blockchain;
establishing and using a secure encrypted communication tunnel between the enclave and a hardware security module (HSM), enabling persistence of secrets across multiple members of the enclave pool, establishing and using the secure encrypted communication tunnel including:
deriving a session public/private enclave key pair, including a session enclave private key and a session enclave public key, from the enclave key pair;
sending the session enclave public key to the HSM;
receiving, from the HSM, a session HSM public key;
encrypting additional information with the session enclave private key;
sending the encrypted additional information to the HSM;
receiving further encrypted information from the HSM;
and
decrypting the further encrypted information with the session enclave private key;
receiving, from a cryptlet fabric configured to manage the enclave pool, cryptlet code;
executing the cryptlet code in the enclave;
and
signing a payload of the cryptlet code with the enclave private key.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/592,697Filed 11 May 2017
Published: US 2018/0332011 A115 Nov 2018
Granted: 10 Nov 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification23 codes

H04L 9/0897
Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage: involving additional devices, e.g. trusted…
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06Q 20/065
Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme: using e-cash
G06Q 20/382
Payment protocols; Details thereof: insuring higher security of transaction