US 2020/0089872 A1Published application

Enclave pool shared key

AssigneeMicrosoft Technology Licensing, LLC

InventorJohn Marley GRAY

Life of this patent

Estimating the term…

Loading patent…

Abstract

In one example, an enclave pool is formed. The enclave pool may include a plurality of enclaves. Each enclave may have a private enclave key and a public enclave key. A shared enclave pool key may be generated from or otherwise based on the public enclave key of each enclave of the enclave pool. A first enclave may be allocated from the enclave pool to a first cryptlet. A payload of the first enclave is received. The payload of the first enclave may be signed with a first digital signature by the private enclave key of the first enclave. A payload of the second enclave may be received. The payload of the second enclave may be signed with a second digital signature by the private enclave key of the second enclave. The first digital signature and the second signature may be validated via the shared enclave pool key.

Claims20

Dependent claims

A device, comprising:

at least one memory and at least one processor, wherein the at least one memory and the at least one processor are respectively configured to store and execute processor-executable code for causing the device to perform operations, the operations including:
forming an enclave pool from at least a first enclave and a second enclave, wherein the first enclave and the second enclave are each a secure execution environment, and wherein the first enclave and the second enclave each have a private enclave key and a public enclave key;
deriving a shared enclave pool key from the public enclave key of the first enclave and the public enclave key of the second enclave;
allocating the first enclave to a first cryptlet;
receiving a payload of the first enclave, wherein the payload of the first enclave has a first digital signature that was signed using the private enclave key of the first enclave;
allocating the second enclave to the first cryptlet;
receiving a payload of the second enclave, wherein the payload of the second enclave has a second digital signature that was signed using the private enclave key of the second enclave;
and
validating the first digital signature and the second digital signature using the derived shared enclave key.

6 more elements

A method, comprising:

forming an enclave pool from at least a first enclave and a second enclave, wherein the first enclave is a secure execution environment that stores a first private key and a first public key, and wherein the second enclave is another secure execution environment that stores a second private key and a second public key;
generating a shared enclave pool key that is derived from the first public key and from the second public key;
allocating the first enclave to a first cryptlet;
receiving a payload of the first enclave, wherein the payload of the first enclave has a first digital signature of the first private key;
allocating the second enclave to the first cryptlet;
receiving a payload of the second enclave, wherein the payload of the second enclave has a second digital signature of the second private key;
and
validating, via the shared enclave pool key, the first digital signature and the second digital signature.

5 more elements

A processor-readable storage medium, having stored thereon processor-executable code for causing a computing device to perform operations, the operations comprising:

creating an enclave pool from at least a first enclave and a second enclave, wherein the first enclave is a secure execution environment that stores a first private key and a first public key, and wherein the second enclave is another secure execution environment that stores a second private key and a second public key;
receiving the first public key;
receiving the second public key;
generating a shared enclave pool key that is based upon the first public key and on the second public key;
assigning the first enclave to a first cryptlet;
receiving a payload of the first enclave, wherein the payload of the first enclave has a first signature that was signed using the first private key;
assigning the second enclave to the first cryptlet;
receiving a payload of the second enclave, wherein the payload of the second enclave has a second signature that was signed using the second private key;
and
validating the first signature and the second signature with the shared enclave pool key.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/693,701Filed 25 Nov 2019
Priority: 11 May 2017
Published: 19 Mar 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/71
Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer: to…
H04L 9/0861
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: generation of secret information…
H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…

Family

Application15/592,802Continuation · filed 11 May 2017
Application16/693,701Continuation
US 10,496,813 B2Related patent
US 10,528,722 B2Related patent
US 11,176,246 B2Related patent
US 2018/0330078 A1Published application
US 2020/0089872 A1This patent

From the US filing history. Foreign family members aren’t listed.