Method and apparatus for cloud-assisted cryptography

Patent metadata

Field	Value
Publication number	US-9503433-B2
Application number	US-201414227319-A
Country	US
Kind code	B2
Filing date	Mar 27, 2014
Priority date	Mar 27, 2014
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

In an embodiment, a system includes a processor that includes private key decryption logic to decrypt an encrypted private key received from a consuming device to produce a private key, and symmetric key decryption logic to receive the private key from the private key decryption logic and to decrypt an encrypted symmetric key received from the consuming device using the private key. The system also includes a dynamic random access memory (DRAM) coupled to the processor. Other embodiments are described and claimed.

First claim

What is claimed is:

1. A system comprising:
a hardware processor that includes:
attestation hardware logic to generate an attestation of a security level of the system responsive to an attestation request received from a consuming device and included in a secure session request and send the attestation to the consuming device to enable a secure session to be established between the system and consuming device;
private key decryption hardware logic to decrypt an encrypted private key received from the consuming device using a second private key of the system to produce a private key, the encrypted private key encrypted by a content source using a public key of the system; and
symmetric key decryption hardware logic to receive the private key from the private key decryption hardware logic, decrypt an encrypted symmetric key received from the consuming device, and after decryption of the encrypted symmetric key provide the symmetric key to the consuming device, wherein the decryption is performed using the private key, wherein prior to receipt of the encrypted private key and the encrypted symmetric key from the consuming device, the system is to establish a trusted execution environment (TEE), the system comprising a cloud computational server; and

a dynamic random access memory (DRAM) coupled to the hardware processor.

2. The system of claim 1 , wherein the encrypted private key is encrypted using a public key encryption.

3. The system of claim 1 , wherein the encrypted private key and the encrypted symmetric key are received from the consuming device responsive to receipt by the consuming device of an encrypted file that is encrypted with the symmetric key.

4. The system of claim 1 , wherein prior to receipt of the encrypted symmetric key from the consuming device, the hardware processor is to provide an indication of the security level of the system that is compatible with a level of security of the encrypted symmetric key.

5. The system of claim 1 , wherein the hardware processor is to destroy a copy of the private key that resides in the system after the symmetric key is provided to the consuming device.

6. The system of claim 1 , wherein the system is to destroy a copy of the symmetric key that resides in the system after the symmetric key is provided to the consuming device.

7. The system of claim 1 , wherein the hardware processor is to:
receive an encrypted file from the consuming device;
decrypt the encrypted file using the symmetric key to produce an unencrypted data file; and
return the unencrypted data file to the consuming device.

8. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to perform a method comprising:
receiving, by a cloud computational server (CCS) that includes at least one hardware processor, a request from a consuming device for a security attestation and providing the security attestation via an attestation hardware logic of the CCS responsive to the request;
thereafter receiving, by the CCS, a request from the consuming device to decrypt an encrypted symmetric key;
receiving the encrypted symmetric key and an encrypted private key comprising a private key that has been encrypted by a content source via a public key of the CCS;
decrypting, in a private key decryption hardware logic of the CCS, the first encrypted private key using a second private key of the CCS to produce the private key; and
after decrypting the first encrypted private key, decrypting, in a symmetric key decryption hardware logic of the CCS, the encrypted symmetric key using the private key to produce a symmetric key.

9. The at least one non-transitory computer readable storage medium of claim 8 , wherein the method further comprises providing the symmetric key to the consuming device.

10. The at least one non-transitory computer readable storage medium of claim 9 , wherein the method further comprises after providing the symmetric key to the consuming device, destroying, by the CCS, a copy of the symmetric key present in the CCS.

11. The at least one non-transitory computer readable storage medium of claim 9 , wherein the method further comprises after providing the symmetric key to the consuming device, destroying, by the CCS, a copy of the private key present in the CCS.

12. The at least one non-transitory computer readable storage medium of claim 8 , wherein the method further comprises prior to receiving the encrypted symmetric key, receiving a consuming device security attestation from the consuming device.

13. The at least one non-transitory computer readable storage medium of claim 12 , wherein the encrypted symmetric key is received from the consuming device only when the CCS has a security level, based on the security attestation, that satisfies a symmetric key security level associated with the symmetric key.

14. A system comprising:
a hardware processor including:
secure session hardware logic to:
provide a consuming device security attestation to a cloud cryptographic service (CCS) prior to establishment of a secure communication session;
initiate the secure communication session with the CCS;
provide to the CCS, via the secure communication session, a request to decrypt an encrypted symmetric key that is encrypted by a content source via a private key, the encrypted symmetric key, and an encrypted private key including the private key that is encrypted via public key encryption associated with the CCS; and
receive, from the CCS, the symmetric key responsive the request to decrypt the encrypted symmetric key; and

decryption hardware logic to decrypt, using the symmetric key, an encrypted data file to produce an unencrypted data file; and

a dynamic random access memory (DRAM).

15. The system of claim 14 , wherein the system comprises a wireless communication device.

16. The system of claim 15 , wherein the wireless communication device comprises:
an applications processor;
a baseband processor coupled to the applications processor; and
a transceiver coupled to the baseband processor to communicate with an antenna.

Assignees

• Intel Corp

Inventors

• Nayshtut Alex
• Ben-Shalom Omer
• Smith Ned M
• Jimison Jr Edward V
• Khosravi Hormuzd M

Classifications

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L63/045 Primary

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title