Method and apparatus for hardware based file/document expiry timer enforcement

A memory comprising instructions to cause a machine to at least:

• cause transmission of a policy to a first remote device different from the machine, the policy to be used by a trusted execution environment of the first remote device to determine expiry information of an encryption key, the encryption key generated at the first remote device;
• after the first remote device has generated the encryption key, cause storage of a certificate from the first remote device, the certificate generated by the first remote device in accordance with the policy and including the expiry information, the encryption key associated with an encrypted file, the expiry information indicative of a period for which the encryption key is valid to decrypt the encrypted file, the certificate identifiable by a file identifier (ID) associated with at least one of the encrypted file, the expiry information, or the encryption key;
• and
• in response to a request for the certificate that includes the file ID, cause transmission of the certificate to a second remote device.

A method comprising:

• transmitting, to a first remote device via interface circuitry of a second device different than the first remote device, a policy according to which a trusted execution environment of the first remote device is to determine expiry information when the first remote device generates an encryption key;
• after generation of the encryption key by the first remote device, obtaining, via the interface circuitry, a certificate from the first remote device, the certificate generated at the first remote device in accordance with the policy from the second device, the certificate including the expiry information, the encryption key associated with a file, the expiry information indicative of a period for which the encryption key is valid to decrypt the file;
• storing the certificate such that the certificate is identifiable by a file identifier (ID) associated with at least one of the file, the expiry information, or the encryption key;
• and
• in response to a request for the certificate that includes the file ID, transmitting, via the interface circuitry, the certificate to a third remote device.