Techniques for key provisioning in a trusted execution environment
AssigneeIntel Corporation
InventorsMic Bowman, Andrea Miele
Life of this patent
Estimating the term…
Abstract
Techniques for securely provisioning a set of enclaves are described. A contract owner may register with a shared registry. A subset of enclaves may be selected to be provisioned from among a plurality of enclaves. A keyshare may be requested from one or more provisioning services for each of the subset of enclaves to be provisioned. The requested keyshares may be received from each provisioning service for each of the subset of enclaves to be provisioned. For each of the selected enclaves, the received keyshares may be sent for verification by the enclave. Each of the selected enclaves may send an authenticated and encrypted key derived from the received keyshares.
Claims20
A device within a distributed system, comprising:
- a member device comprising a processor circuit and memory, the memory comprising instructions that when executed by the processor circuit cause the processor circuit to:
- receive, from a contract owner device within a distributed community, a plurality of encrypted keyshares and a plurality of public signing keys associated with an encrypted enclave;
- send, to the encrypted enclave, a contract identifier associated with the encrypted enclave and an encrypted enclave key, the encrypted enclave key based in part on the plurality of encrypted keyshares and the plurality of public signing keys;
- and
- access the encrypted enclave.
At least one non-transitory computer-readable storage medium, comprising instructions for execution by processing circuitry of a device in a distributed system, the instructions to cause the processing circuitry to:
- receive, from a contract owner device within a distributed community, a plurality of encrypted key shares and a plurality of public signing keys associated with an encrypted enclave;
- send, to the encrypted enclave, a contract identifier associated with the encrypted enclave and an encrypted enclave key, the encrypted enclave key based in part on the plurality of encrypted keyshares and the plurality of public signing keys;
- and
- access the encrypted enclave.
A computer-implemented method for accessing an encrypted enclave, comprising:
- receiving, from a contract owner device within a distributed community, a plurality of encrypted keyshares and a plurality of public signing keys associated with an encrypted enclave;
- sending, to the encrypted enclave, a contract identifier associated with the encrypted enclave and an encrypted enclave key, the encrypted enclave key based in part on the plurality of encrypted keyshares and the plurality of public signing keys;
- and
- accessing, from the computer, the encrypted enclave.
Dependencies are inferred from the claim text.