Techniques for key provisioning in a trusted execution environment
AssigneeIntel Corporation
InventorsMic Bowman, Andrea Miele
Life of this patent
Estimating the term…
Abstract
Techniques for securely provisioning a set of enclaves are described. A contract owner may register with a shared registry. A subset of enclaves may be selected to be provisioned from among a plurality of enclaves. A keyshare may be requested from one or more provisioning services for each of the subset of enclaves to be provisioned. The requested keyshares may be received from each provisioning service for each of the subset of enclaves to be provisioned. For each of the selected enclaves, the received keyshares may be sent for verification by the enclave. Each of the selected enclaves may send an authenticated and encrypted key derived from the received keyshares.
Claims25
A computer-implemented method for enclave provisioning, comprising:
- registering a contract owner with a shared registry;
- selecting a subset of enclaves to be provisioned from among a plurality of enclaves;
- requesting a keyshare from one or more provisioning services for each of the subset of enclaves to be provisioned;
- receiving the requested keyshares from each provisioning service for each of the subset of enclaves to be provisioned;
- for each of the selected enclaves, sending the received keyshares for verification by the enclave;
- and
- receiving, from each of the selected enclaves, an authenticated and encrypted key derived from the received keyshares.
A system for enclave provisioning, comprising:
- a contract owner device including one or more processor circuits, the contract owner device configured to:
- register the contract owner device with a shared registry;
- select a subset of enclaves to be provisioned from among a plurality of enclaves;
- request a keyshare from one or more provisioning services for each of the subset of enclaves to be provisioned;
- receive the requested keyshares from each provisioning service for each of the subset of enclaves to be provisioned;
- for each of the selected enclaves, send the received keyshares for verification by the enclave;
- and
- receive, from each of the selected enclaves, an authenticated and encrypted key derived from the received keyshares.
An article comprising a non-transitory computer-readable storage medium that stores instructions for execution by processing circuitry of a contract owner device, the instructions to cause the contract owner device to:
- register a contract owner with a shared registry;
- select a subset of enclaves to be provisioned from among a plurality of enclaves;
- request a keyshare from one or more provisioning services for each of the subset of enclaves to be provisioned;
- receive the requested keyshares from each provisioning service for each of the subset of enclaves to be provisioned;
- for each of the selected enclaves, send the received keyshares for verification by the enclave;
- and
- receive, from each of the selected enclaves, an authenticated and encrypted key derived from the received keyshares.
Dependencies are inferred from the claim text.