Attested end-to-end encryption for transporting sensitive data

A device, comprising:

• a memory comprising computer-executable instructions;
• and
• one or more processors in communication with the memory and configured to access the memory and execute the computer-executable instructions to perform, at least:
• receiving, in a secure environment, a policy profile from a data transfer service, including:
• (1) an origination key and (2) a destination key, the destination key corresponding to a public transfer key of a destination device that is associated with a transfer of particular sensitive data from the device to the destination device;
• verifying, in the secure environment, the policy profile based at least in part on determining that the origination key corresponds to a public transfer key of the device;
• generating, in the secure environment, a data encryption key;
• sealing, in the secure environment, the data encryption key based at least in part on a characteristic of the secure environment;
• encrypting, in the secure environment, the sealed data encryption key with the public transfer key of the destination device to form an encrypted data encryption key;
• signing, in the secure environment, the encrypted data encryption key with a private attestation identity key previously generated by the device in the secure environment, the private attestation identity key attesting to an identity of the device;
• encrypting, in the secure environment, the particular sensitive data with the sealed data encryption key to form encrypted data;
• transmitting the signed encrypted data encryption key to the destination device;
• and
• transmitting the encrypted data to the destination device for subsequent decryption of the encrypted data.

One or more non-transitory computer-readable storage media comprising computer-executable instructions that, when executed by one or more processors of a device, cause the one or more processors to perform, at least:

• receiving, in a secure environment of the device, a policy profile from a data transfer service, including:
• (1) an origination key and (2) a destination key, the destination key corresponding to a public transfer key of a destination device that is associated with a transfer of particular sensitive data from the device to the destination device;
• verifying in the secure environment, the policy profile based at least in part on determining that the origination key corresponds to a public transfer key of the device;
• generating, in the secure environment, a data encryption key;
• sealing, in the secure environment, the data encryption key based at least in part on a characteristic of the secure environment;
• encrypting, in the secure environment, the sealed data encryption key with the public transfer key of the destination device to form an encrypted data encryption key;
• signing, in the secure environment, the encrypted data encryption key with a private attestation identity key previously generated by the device in the secure environment, the private attestation identity key attesting to an identity of the device;
• encrypting, in the secure environment, the particular sensitive data with the sealed data encryption key to form encrypted data;
• transmitting the signed encrypted data encryption key to the destination device;
• and
• transmitting the encrypted data to the destination device for subsequent decryption of the encrypted data.