Secure virtualized cryptographic subsystems for autonomous systems and applications

Abstract

In various examples, the disclosed techniques include receiving, from an application executing in a virtual machine (VM), a request to perform a cryptographic operation, wherein the request specifies an ephemeral key identifier and source data. The techniques also determine, using key metadata received from a trusted execution environment, a key slot identifier associated with the ephemeral key identifier, wherein the key slot identifier identifies a key slot in which a cryptographic key is stored. The techniques further cause the cryptographic operation to be performed on the source data in the trusted execution environment using the cryptographic key, where the cryptographic key used to perform the cryptographic operation is accessed from the key slot identified by the key slot identifier. The techniques further provide, to the application, a cryptographic operation result received form the trusted execution environment.