Addressing a trusted execution environment using encryption key

A method for delivering protected data to a nested trusted execution environment (TrEE) comprising a trustlet running on top of secure kernel, wherein both the trustlet and the secure kernel are associated with a potentially untrusted requestor, the method comprising:

• receiving, by at least one processor of a processor-based system, a request for protected data from the potentially untrusted requestor associated with the nested TrEE and an attestation statement of the secure kernel, wherein the trustlet is associated with a trustlet ID that includes at least one of (a) a service type that is based on at least one of the request or a configuration of the system or (b) an identifier related to at least one of information on which the trustlet is to operate or a user of the trustlet;
• encrypting a transfer encryption key with a second encryption key that is included in the attestation statement;
• retrieving, by at least one processor of the processor-based system, the protected data;
• encrypting the protected data with the transfer encryption key and an authentication tag, wherein the authentication tag binds the requestor with the trustlet ID;
• and
• providing the encrypted transfer encryption key, the encrypted protected data, and encrypted authentication tag to the requestor.

A computer readable storage medium comprising instructions for delivering protected data to a nested trusted execution environment (TrEE) comprising a trustlet running on top of secure kernel, the medium comprising instructions that, when executed on a computer system, cause the computer system to at least:

• receive a request for protected data from a potentially untrusted requestor associated with the nested TrEE and an attestation statement of the secure kernel, wherein the trustlet is associated with a trustlet ID;
• determine a service type of trustlet to target based on the request or based on a configuration of the system, wherein the trustlet that runs on top of the secure kernel is of the type;
• encrypt a transfer encryption key with a second encryption key that is included in the attestation statement;
• retrieve the protected data;
• encrypt the protected data with the transfer encryption key and an authentication tag, wherein the authentication tag binds the requestor with the trustlet ID;
• and
• provide the encrypted transfer encryption key, the encrypted protected data, and encrypted authentication tag to the requestor.