US 2016/0105430 A1 · SYSTEMS AND METHODS FOR DISTRIBUTED TRUST COMPUTING AND KEY MANAGEMENT

Abstract

Devices, systems, and methods for conducting trusted computing tasks on a distributed computer system are described. In some embodiments, a client device initiates a trusted task for execution within a trusted execution environment of a remote service provider. The devices, systems, and methods may permit the client to evaluate the trusted execution capabilities of the service provider via a planning and attestation process, prior to sending data/code associated with the trusted task to the service provider for execution. Execution of the trusted task may be performed while enforcing security and/or compartmentalization context on the data/code. Systems and methods for managing and exchanging encryption keys are also described. Such systems and methods may be used to maintain the security of the data/code before during, and/or after the execution of the trusted task.

Claims30

Dependent claims

1-28. (canceled)

A client device, comprising:

a processor;
communications circuitry;
a memory;
and
a client attestation module configured to cause the client device to:
output a trusted task initiation signal (TTIS) with said communications circuitry to a plurality of service provider devices of a distributed computing system, said TTIS specifying client defined characteristics of at least one trusted execution environment (TEE) and of at least one data compartment to be instantiated within said TEE for the execution of a trusted task;
and
cause a selected one of said plurality of service provider devices that is able to instantiate a TEE and at least one data compartment to instantiate said TEE and said at least one data compartment in accordance with said client defined characteristics.

5 more elements

A service provider device, comprising:

a processor;
communications circuitry;
a memory;
and
a service provider attestation module configured to cause the service provider device to:
output an attestation signal to said client device in response to receipt of a trusted task initiation signal (TTIS) from a client device of a distributed computing system, the TTIS specifying client defined characteristics of at least one trusted execution environment (TEE) and of at least one data compartment to be instantiated within said TEE for the execution of a trusted task, the attestation signal being configured to attest to the service provider device's ability to instantiate a TEE and at least one data compartment within said TEE in accordance with said client defined characteristics;
and
instantiate a TEE and at least one data compartment in accordance with said client defined characteristics in response to receiving a second signal from the client device that contains at least one of data and code associated with said trusted task.

5 more elements

At least one non-transitory computer readable medium comprising trusted task initiation module (TTIM) instructions stored therein, wherein said TTIM instructions when executed by a processor cause the processor to perform the following operations comprising:

output a trusted task initiation signal (TTIS) with said communications circuitry to a plurality of service provider devices of a distributed computing system, said TTIS specifying client defined characteristics of at least one trusted execution environment (TEE) and of at least one data compartment to be instantiated within said TEE for the execution of a trusted task;
and
cause a selected one of said plurality of service provider devices that is able to instantiate a TEE and at least one data compartment to instantiate said TEE and said at least one data compartment in accordance with said client defined characteristics.

At least one non-transitory computer readable medium comprising trusted task execution module (TTEM) instructions stored therein, wherein said TTEM instructions when executed by a processor cause the processor to perform the following operations comprising:

output an attestation signal to said client device in response to receipt of a trusted task initiation signal (TTIS) from a client device of a distributed computing system, the TTIS specifying client defined characteristics of at least one trusted execution environment (TEE) and of at least one data compartment to be instantiated within said TEE for the execution of a trusted task, the attestation signal being configured to attest to the service provider device's ability to instantiate a TEE and at least one data compartment within said TEE in accordance with said client defined characteristics;
and
instantiate a TEE and at least one data compartment in accordance with said client defined characteristics in response to receiving a second signal from the client device that contains at least one of data and code associated with said trusted task.

Dependencies are inferred from the claim text.

Facts

Application

14/883,756Filed 15 Oct 2015

Priority

29 Sep 2012

Published

14 Apr 2016

Term ends

Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/0853
For authentication of entities: using an additional device, e.g. smartcard, SIM or a different communication terminal
G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs
G06F 21/57
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: certifying or…

Systems and methods for distributed trust computing and key management

Life of this patent

Systems and methods for distributed trust computing and key management

Life of this patent

Abstract

Claims30