Cryptlet identity

Patent metadata

Field	Value
Publication number	US-10637645-B2
Application number	US-201715592928-A
Country	US
Kind code	B2
Filing date	May 11, 2017
Priority date	May 11, 2017
Publication date	Apr 28, 2020
Grant date	Apr 28, 2020

Abstract

In one example, the cryptlet binary and a cryptlet key pair are provided to an enclave. A cryptlet key pair for the first cryptlet includes a cryptlet private key and a cryptlet public key. A cryptlet binding associated with a first cryptlet includes at least one binding. Each binding includes a mapping between the first cryptlet and at least one of a smart contract or another cryptlet. A binding identification is associated with the cryptlet binding. An output is received from the first cryptlet, such that the output is at least one of encrypted or signed by the cryptlet private key, and such that the output is signed by an enclave private key. A cryptlet identity is generated for the first cryptlet, such that the cryptlet identification includes: the hash of the cryptlet binary, the cryptlet public key, and the binding identification.

First claim

I claim:

1. An apparatus, comprising:
a device including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the device to perform actions, including:
identifying a first enclave to be used for executing a cryptlet binary of a first cryptlet, wherein the first enclave is a secure execution environment, and wherein the first enclave stores an enclave private key;
causing a cryptlet key pair for the first cryptlet to be provided to the first enclave, wherein the cryptlet key pair includes a cryptlet private key and a cryptlet public key;
providing the cryptlet binary to the first enclave;
generating a cryptlet binding that is associated with the first cryptlet, wherein the cryptlet binding includes at least one binding, and wherein each binding includes a mapping between the first cryptlet and at least one of a smart contract or another cryptlet;
generating a binding identification that is associated with the cryptlet binding;
providing the cryptlet binding to the first enclave;
receiving an output from the first cryptlet, wherein the output is at least one of encrypted or signed by the cryptlet private key, and wherein the output is signed by the enclave private key; and
causing a cryptlet identity to be generated for the first cryptlet, wherein the cryptlet identity includes: a hash of the cryptlet binary, the cryptlet public key, and the binding identification.

2. The apparatus of claim 1 , wherein the cryptlet binding represents at least one of properties or rules for the first cryptlet.

3. The apparatus of claim 1 , wherein the first cryptlet is a software component that inherits from base classes and implements interfaces that provide cryptographic primitives and integrations for distributed trust applications.

4. The apparatus of claim 1 , the actions further comprising generating a hash digest of the cryptlet identity.

5. The apparatus of claim 4 , the actions further comprising providing the hash digest of the cryptlet identity to a blockchain ledger.

6. The apparatus of claim 1 , the actions further comprising installing the first cryptlet, and generating an identity for the first cryptlet, such that when the first cryptlet is uninstantiated, the cryptlet identity of the first cryptlet corresponds to the hash of the cryptlet binary and the cryptlet public key.

7. The apparatus of claim 6 , wherein installing the first cryptlet includes:
fetching the cryptlet binary of the first cryptlet;
generating the hash of the cryptlet binary;
requesting a generation of the cryptlet key pair;
receiving the cryptlet public key; and
registering the cryptlet identity in a cryptlet registry.

8. A method, comprising:
identifying a first enclave to be used for executing a cryptlet binary of a first cryptlet, wherein the first enclave is a secure execution environment, and wherein the first enclave stores an enclave private key;
causing a cryptlet key pair for the first cryptlet to be sent to the first enclave, wherein the cryptlet key pair includes a cryptlet private key and a cryptlet public key;
providing the cryptlet binary to the first enclave;
creating a cryptlet binding that is associated with the first cryptlet, wherein the cryptlet binding includes at least one binding, and wherein each binding includes a mapping between the first cryptlet and at least one of a smart contract or another cryptlet;
creating a binding identification that is associated with the cryptlet binding; sending the cryptlet binding to the first enclave;
receiving a payload from the first cryptlet, wherein the payload is at least one of encrypted or signed by the cryptlet private key; and
registering a cryptlet identity for the first cryptlet, wherein the cryptlet identity includes: a hash of the cryptlet binary, the cryptlet public key, and the binding identification.

9. The method of claim 8 , wherein the cryptlet binding represents at least one of properties or rules for the first cryptlet.

10. The method of claim 8 , further comprising generating a hash digest of the cryptlet identity.

11. The method of claim 10 , further comprising sending the hash digest of the cryptlet identity to a blockchain ledger.

12. The method of claim 8 , further comprising installing the first cryptlet, and generating an identity for the first cryptlet, such that when the first cryptlet is uninstantiated, the cryptlet identity of the first cryptlet corresponds to the hash of the cryptlet binary and the cryptlet public key.

13. The method of claim 12 , wherein installing the first cryptlet includes:
fetching the cryptlet binary of the first cryptlet;
generating the hash of the cryptlet binary;
requesting a generation of the cryptlet key pair;
receiving the cryptlet public key; and
registering the cryptlet identity in a cryptlet registry.

14. A processor-readable storage medium, having stored thereon process-executable code that, upon execution by at least one processor, enables actions, comprising:
identifying a first enclave to be used for executing a cryptlet binary of a first cryptlet, wherein the first enclave is a secure execution environment, and wherein the first enclave stores an enclave private key;
causing a cryptlet key pair for the first cryptlet to be provided to the first enclave, wherein the cryptlet key pair includes a cryptlet private key and a cryptlet public key;
providing the cryptlet binary to the first enclave;
generating a cryptlet binding that is associated with the first cryptlet, wherein the cryptlet binding includes at least one binding, and wherein each binding includes a mapping between the first cryptlet and at least one of a smart contract or another cryptlet;
generating a binding identification that is associated with the cryptlet binding; and;
providing the cryptlet binding to the first enclave;
receiving an output from the first cryptlet, wherein the output is at least one of encrypted or signed by the cryptlet private key, and wherein the output is signed by the enclave private key; and
registering a cryptlet identity for the first cryptlet, wherein the cryptlet identity includes: a hash of a cryptlet binary of the first cryptlet, the cryptlet public key of the first cryptlet, and the binding identification.

15. The processor-readable storage medium of claim 14 , wherein the cryptlet binding represents at least one of properties or rules for the first cryptlet.

16. The processor-readable storage medium of claim 14 , the actions further comprising generating a hash digest of the cryptlet identity.

17. The processor-readable storage medium of claim 16 , the actions further comprising sending the hash digest of the cryptlet identity to a blockchain ledger.

18. The processor-readable storage medium of claim 14 , the actions further comprising installing the first cryptlet, and generating an identity for the first cryptlet, such that when the first cryptlet is uninstantiated, the cryptlet identity of the first cryptlet corresponds to the hash of the cryptlet binary and the cryptlet public key.

19. The processor-readable storage medium of claim 18 , wherein installing the first cryptlet includes:
fetching the cryptlet binary of the first cryptlet;
generating the hash of the cryptlet binary;
requesting a generation of the cryptlet key pair;
receiving the cryptlet public key; and
registering the cryptlet identity in a cryptlet registry.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Gray John Marley

Classifications

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title