Red Hat, Inc.

Nathaniel Philip McCallum

Michael Hingston McLaughlin Bursell

Peter M Jones

Robert J Relyea

Michael H M Bursell

Benjamin Petersen

Jonathan Michael Toppins

Monis Masood Khan

Michael Tsirkin

Axel Simon

John David Strunk

Nikolaos Mavrogiannopoulos

Ade Lee

Miloslav Trmac

Juan Jose Vallejo Orozco

Adam Young

The technology disclosed herein enables efficient launching of trusted execution environments. An example method can include: receiving, by a processing device of a first computing device, a first request from a second computing device to establish a first trusted execution environment (TEE) in the first computing device; establishing the first TEE in the first computing device, wherein the first TEE comprises an encrypted memory area and executable code; receiving, by the processing device, a second request to establish a second TEE in the first computing device; establishing, by the first TEE, the second TEE in the first computing device, wherein the second TEE comprises a second executable code; receiving, by the first TEE, cryptographic key data from the second computing device; validating, by the first TEE, the second TEE; providing, by the first TEE, the cryptographic key data to the second TEE; and causing, by the processing device, the second TEE to execute, using the cryptographic key data, the second executable code.

Efficient launching of trusted execution environments

The technology disclosed herein provides network bound encryption that enables a node management device to orchestrate workloads with encrypted data without sharing the decryption key. An example method may include: obtaining an asymmetric key pair comprising a public asymmetric key and a private asymmetric key; establishing a symmetric key using a key establishment service, wherein the symmetric key is established in view of the private asymmetric key of a first computing device and a public asymmetric key of the key establishment service; transmitting sensitive data encrypted using the symmetric key to a persistent storage device accessible to a second computing device; initiating a creation of an execution environment on the second computing device; and providing, by the first computing device, the public asymmetric key and the location data to the second computing device, wherein the location data corresponds to the key establishment service.

Network bound encryption for orchestrating workloads with sensitive data

Aspects of the disclosure provide for mechanisms for scheduling computing tasks in a computer system. A method of the disclosure includes determining one or more attributes associated with a computing task, determining an ordered list of the attributes in view of priorities associated with the attributes, generating a first numerical representation of the attributes in view of the ordered list of the attributes, determining a second numerical representation of a priority of the computing task, and determining a third numerical representation of a total priority of the computing task in view of the first numerical representation and the second numerical representation.

Computing task scheduling in a computer system utilizing efficient attributed priority queues

Implementations of the disclosure provide for binding data to a network in the presence of an entity. In one implementation, a cryptographic system is provided. The cryptographic system includes a memory to store encrypted data, and a processing device, operatively coupled to the memory, to identify a public key for a communications device in response to an indication of a presence of the communications device on a network. A first intermediate is determined in view of the public key for the communications device and in view of an acquisitioning public key. The acquisitioning public key is associated with the encrypted data. A second intermediate public key is received from the communications device in view of the first intermediate public key. Thereupon, the encrypted data is decrypted using an encryption key derived at least from the second intermediate public key.

Binding data to a network in the presence of an entity

The technology disclosed herein provides network bound encryption that enables a trusted execution environment to persistently store and access recovery data without persistently storing the decryption key. An example method may include: transmitting combined key data that is based on a cryptographic key data of a second computing device to a third computing device; deriving a cryptographic key from combined key data received from the third computing device, the received combined key data being based on the cryptographic key data of the second computing device and cryptographic key data of the third computing device; and causing the trusted execution environment to use the cryptographic key to access sensitive data on a persistent storage device.

Network bound encryption for recovery of trusted execution environments

The technology disclosed herein provides a cryptographic key wrapping system for verifying device capabilities. An example method may include: accessing, by a processing device, a wrapped key that encodes a cryptographic key; executing, by the processing device in a trusted execution environment, instructions to derive the cryptographic key in view of the wrapped key, wherein the executing to derive the cryptographic key comprises a task that consumes computing resources for a duration of time; using the cryptographic key to access program data; executing, by the processing device, the program data, wherein the executed program data evaluates a condition related to the duration of time; and transmitting a message comprising an indication of the evaluated condition.

Using a trusted execution environment for a cryptographic key wrapping scheme that verifies remote device capabilities

The technology disclosed herein enables efficient launching of trusted execution environments. An example method can include: receiving, by a first computing device, a request from a second computing device to establish a set of trusted execution environments (TEEs) in the first computing device; establishing a first TEE of the set of TEEs in the first computing device, wherein the trusted execution environment comprises an encrypted memory area and executable code; receiving, by the first TEE, cryptographic key data from the first computing device; establishing, by the first TEE, a second TEE of the set of TEEs in the first computing device, wherein the second TEE comprises a copy of the executable code; providing, by the first TEE, the cryptographic key data to the second TEE; and causing the executable code of the second TEE to communicate with the first computing device using the cryptographic key data.

Systems and methods for detecting and handling attacks on processes executing within a trusted execution environment (TEE) are disclosed. In one implementation, a processing device may detect by a first process an event indicating that a first process executing in a TEE of a host computer system is under attack from a second process executing on the host computer system. the processing device may set a flag within a memory region of the TEE indicating that the first process is under attack. The processing device may further perform, in view of an attack response policy associated with the first process, an action responsive to detecting the event.

Detecting and handling attacks on processes executing within a trusted execution environment

The technology disclosed herein provides an enhanced cryptographic access control mechanism that uses cryptographic keys that are based on temporal data. An example method may include: determining temporal data of a computing device; transforming the temporal data in view of conversion data associated with the computing device, wherein the conversion data causes a set of alternate temporal data values to transform to a specific cryptographic value; creating, by a processing device, a cryptographic key in view of the transformed temporal data; and using the cryptographic key to enable access to a protected resource.

Constrained key derivation in temporal space

The technology disclosed herein provides network bound encryption that enables a trusted execution environment to persistently store and access recovery data without persistently storing the decryption key. An example method may include: establishing a trusted execution environment in a first computing device, the trusted execution environment comprising an encrypted memory area; loading cryptographic key data of a second computing device and executable code into the trusted execution environment; transmitting combined key data that is based on the cryptographic key data to a third computing device; deriving a cryptographic key from combined key data received from the third computing device, the received combined key data being based on the cryptographic key data of the second computing device and cryptographic key data of the third computing device; and causing the trusted execution environment to execute the executable code and use the cryptographic key to access sensitive data on a persistent storage device.

Providing smart contracts including secrets encrypted with oracle-provided encryption keys is disclosed. In one example, a contract creator encrypts sensitive data necessary for executing a smart contract into ciphertext using a symmetric cryptographic key K, and also encrypts the symmetric cryptographic key K into a wrapper using a public cryptographic key e of a contract executor. The contract creator then generates an envelope using a public cryptographic key o of a contract oracle, where the envelope includes the wrapper encrypted using the public cryptographic key o and a policy that includes condition(s) precedent and is digitally authenticated. The smart contract, including the envelope and the ciphertext, is deployed to the contract executor. The sensitive data thus may be provided within the smart contract itself, while being protected from unauthorized access in the event the smart contract is malicious or is compromised.

Providing smart contracts including secrets encrypted with oracle-provided encryption keys

The technology disclosed herein provides a proof-of-work key wrapping system for verifying device capabilities. An example method may include: accessing a wrapped key and a cryptographic attribute for the wrapped key from an encrypted memory region, wherein the wrapped key encodes a cryptographic key; deriving, by a processing device, the cryptographic key in view of the wrapped key and the cryptographic attribute, wherein the deriving consumes computing resources for a duration of time; using the cryptographic key to access program data; and executing, by the processing device, the program data, wherein the executed program data evaluates a condition related to the duration of time.

Using a trusted execution environment for a proof-of-work key wrapping scheme that restricts execution based on device capabilities

Systems and methods are disclosed for protecting data. An example method includes creating an outer cluster on one or more host machines coupled to a network. The outer cluster includes a plurality of outer nodes. The method also includes creating an enclave cluster on the outer cluster. The enclave cluster includes a plurality of inner nodes, and each inner node of the plurality of inner nodes executes within an enclave of the one or more host machines. The method further includes exposing an application programming interface (API) to the outer cluster, where invocation of the API causes at least one inner node of the enclave cluster to perform an operation on data. The method also includes performing, by an inner node of the enclave cluster, the operation on the data in response to invocation of the API by an outer node of the outer cluster.

Protection of private data using an enclave cluster

Message decryption dependent on third-party confirmation of a condition precedent is disclosed. A message is encrypted with a message encryption key to form an encrypted message. A message decryption key that is configured to decrypt the encrypted message is encrypted with a key of a first entity to which the message is to be disclosed upon occurrence of a condition precedent to form an encrypted message decryption key. The encrypted message decryption key is encrypted with a key of a second entity configured to confirm the occurrence of the condition precedent to form a double encrypted message decryption key. A condition identifier that identifies the condition precedent is generated. The encrypted message, the double encrypted message decryption key, and the condition identifier are sent to the first entity.

Growing community of inventors

Raleigh, NC, United States of America

Nathaniel Philip McCallum