Systems and methods for trusted execution environment group creation

A system for trusted execution environment formation, the system comprising:

• a first threshold device of a team of threshold devices of a trusted execution environment, the first threshold device configured to perform the following operations:
• obtain a team specification, the team specification identifying the team of threshold devices of the trusted execution environment, identifying the first threshold device as a team coordinator device, and identifying a second threshold device of the threshold devices as a team member device;
• receive, from the second threshold device, second threshold device identity evidence comprising:
• a second device identifier comprising a unique identifier of the second threshold device;
• and
• a second device attestation comprising an attestation of the second threshold device;
• determine member attributes for the trusted execution environment;
• generate, based on the member attributes, a team proposal comprising:
• a team proposal identifier;
• and
• the team attributes;
• send, to the second threshold device, the team proposal;
• receive, from the second threshold device, a team join pledge comprising:
• the team proposal identifier;
• and
• a public key corresponding to a private key of a cryptographic key pair of the second threshold device;
• generate a root secret for the team of threshold devices;
• generate shares of the root secret, each of the shares representing a portion of the root secret;
• generate a first subset of the shares of the root secret;
• encrypt, using the public key, the first subset of the shares of the root secret to generate a first encrypted set of shares of the root secret;
• and
• send, to the second threshold device, a team member certificate comprising the first encrypted set of shares of the root secret for storage by the second threshold device.

A non-transitory computer-readable storage medium storing programs instructions that are executable by a processor for performing the following operations for trusted execution environment formation:

• obtaining, by a first threshold device, a team specification, the team specification identifying a team of threshold devices of a trusted execution environment, identifying the first threshold device as a team coordinator device, and identifying a second threshold device of the threshold devices as a team member device;
• receiving, by the first threshold device from the second threshold device, second threshold device identity evidence comprising:
• a second device identifier comprising a unique identifier of the second threshold device;
• and
• a second device attestation comprising an attestation of the second threshold device;
• determining, by the first threshold device, member attributes for the trusted execution environment;
• generating, by the first threshold device based on the member attributes, a team proposal comprising:
• a team proposal identifier;
• and
• the team attributes;
• sending, by the first threshold device to the second threshold device, the team proposal;
• receiving, by the first threshold device from the second threshold device, a team join pledge comprising:
• the team proposal identifier;
• and
• a public key corresponding to a private key of a cryptographic key pair of the second threshold device;
• generating, by the first threshold device, a root secret for the team of threshold devices;
• generating, by the first threshold device, shares of the root secret, each of the shares representing a portion of the root secret;
• generating, by the first threshold device, a first subset of the shares of the root secret;
• encrypting, by the first threshold device using the public key, the first subset of the shares of the root secret to generate a first encrypted set of shares of the root secret;
• and
• sending, by the first threshold device to the second threshold device, a team member certificate comprising the first encrypted set of shares of the root secret for storage by the second threshold device.

A method comprising:

• receiving, by a first device from a second device, second device identity evidence comprising:
• a second device identifier;
• and
• a second device attestation;
• generating, by the first device, a team proposal comprising:
• a team proposal identifier;
• and
• team attributes;
• sending, by the first device to the second device, the team proposal;
• receiving, by the first device from the second device, a team join pledge comprising:
• the team proposal identifier;
• and
• a public key corresponding to a private key of a cryptographic key pair;
• generating, by the first device, a root secret;
• generating, by the first device, shares of the root secret;
• generating, by the first device, a first subset of the shares of the root secret;
• encrypting, by the first device using the public key, the first subset of the shares of the root secret to generate a first encrypted set of shares of the root secret;
• and
• sending, by the first device to the second device, the first encrypted set of shares of the root secret for storage by the second device.