Using secure enclaves for decryption in unsecured locations

A method comprising:

• receiving, by a webserver in an unsecured physical location from a client device, a client hello message indicative of a request to initiate a secure session using Transport Layer Security (TLS), the client hello message comprising a first random value and a set of key exchange encryption algorithms supported by the client device;
• sending, by the webserver to the client device, (i) a server hello message comprising a second random value, and (ii) a server digital certificate for authentication of the webserver by the client device, wherein the server digital certificate comprises a server public key;
• receiving, by the webserver from the client device, an encrypted session key for the secure session, wherein the encrypted session key is encrypted using the server public key;
• sending, by the webserver to a key server that is physically separated from the webserver, the encrypted session key and a key identifier associated with the server public key for decryption by the key server;
• sending, by the key server to a decryption application executing on a secure enclave at the key server, the encrypted session key and the key identifier for decryption, wherein the secure enclave is configured to operate in a protected area of execution in memory of the key server, and wherein the secure enclave is inaccessible by an operating system of the key server, and wherein the decryption application decrypts the encrypted session key by:
• transitioning execution from an untrusted portion of the decryption application to the secure enclave;
• determining, by the key server, that an encrypted private key associated with the webserver is unavailable in secure cache memory;
• sending, by the key server, a request for the encrypted private key to an external secure datastore that is in communication with the key server;
• receiving, by the key server, the encrypted private key from the secure datastore, wherein the encrypted private key is encrypted using a public key associated with the secure enclave;
• and
• determining the decrypted session key using a trusted decryption function and the encrypted private key;
• receiving, by the key server from the decryption application, a decrypted session key;
• sending, by the key server to the webserver, the decrypted session key, wherein the decrypted session key is used for encryption and decryption of communication between the webserver and the client device;
• and
• sending, by the webserver to the client device, a confirmation message indicating that the decrypted session key will be used for subsequent communication.