Secure and auditable proxy technology using trusted execution environments
AssigneeNEC Corporation
InventorsClaudio Soriente, Hien Truong
Life of this patent
Estimating the term…
Abstract
A method for secure proxying using trusted execution environment (TEE) technology includes performing, using a TEE running on a proxy, an attestation with a TEE running on a client. The TEE running on the proxy receives from the TEE running on the client a request to fetch data from a remote server. The TEE running on the proxy fetches the data specified in the request from the remote server. The TEE running on the proxy forwards to the TEE running on the client the data fetched from the remote server.
Claims20
A method for secure proxying using trusted execution environment (TEE) technology, the method comprising:
- performing, using a TEE running on a proxy, an attestation with a TEE running on a client;
- receiving, at the TEE running on the proxy from the TEE running on the client, a request to fetch data from a remote server;
- fetching, by the TEE running on the proxy, the data specified in the request from the remote server;
- and
- forwarding, by the TEE running on the proxy to the TEE running on the client, the data fetched from the remote server, wherein:
- the request includes a public key of the client generated through initialization of the TEE on the client, the method further comprising receiving, by the TEE running on the proxy, the public key of the client and logging the public key together with information about the request to fetch data in the TEE running on the proxy, and/or
- the request is signed by the TEE running on the client to provide a signature using a private key generated through initialization of the TEE on the client, the method further comprising verifying the signature using a public key generated through initialization of the TEE on the client and included in the request to fetch the data.
A proxy comprising memory and one or more processors which, alone or in combination, are configured to provide for execution of a method using a trusted execution environment (TEE) running on the proxy, the method comprising:
- performing an attestation with a TEE running on a client;
- receiving, from the TEE running on the client, a request to fetch data from a remote server;
- fetching the data specified in the request from the remote server;
- and
- forwarding, to the TEE running on the client, the data fetched from the remote server, wherein:
- the request includes a public key of the client generated through initialization of the TEE on the client, the method further comprising receiving, by the TEE running on the proxy, the public key of the client and logging the public key together with information about the request to fetch data in the TEE running on the proxy, and/or
- the request is signed by the TEE running on the client to provide a signature using a private key generated through initialization of the TEE on the client, the method further comprising verifying the signature using a public key generated through initialization of the TEE on the client and included in the request to fetch the data.
A client comprising memory and one or more processors which, alone or in combination, are configured to provide for execution of the following steps using a trusted execution environment (TEE) running on the client:
- performing an attestation with a TEE running on a proxy;
- creating and signing a request to fetch data from a remote server;
- sending the request to fetch data to the TEE running on the proxy;
- and
- receiving the data specified in the request from the remote server via the TEE running on the proxy,
- wherein the request to fetch the data is signed using a private key generated through initialization of the TEE on the client, wherein a public key which serves as an identity of the client is generated through initialization of the TEE on the client and is sent to the TEE running on the proxy with the request to fetch the data, the private key and the public key each being stored in the TEE running on the client, and wherein the request to fetch the data is sent to the TEE running on the proxy over a secure channel established based on successful attestation using a shared secret.
Dependencies are inferred from the claim text.