Patent SG-11201905456U-A (SG)
Title: Addressing a trusted execution environment using encryption key
Inventor: NOVAK MARK
IPC: G06F21/57
Filed: 2017-12-20
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 02 August 2018 (02.08.2018) WIPO I PCT ill IIIIIl °mons °nolo DIDHoIIl Oil ono imio oimIE (10) International Publication Number WO 2018/140169 Al (51) International Patent Classification: GOOF 21/57 (2013.01) HO4L 9/32 (2006.01) GOOF 21/74 (2013.01) H04L 29/06 (2006.01) H04L 9/08 (2006.01) (21) International Application Number: PCT/US2017/067460 (22) International Filing Date: 20 December 2017 (20.12.2017) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 15/417,060 26 January 2017 (26.01.2017) US (71) Applicant: MICROSOFT TECHNOLOGY LI- CENSING, LLC [US/US]; One Microsoft Way, Redmond, Washington 98052-6399 (US). (72) Inventor: NOVAK, Mark, F.; Microsoft Technology Li- censing, LLC, One Microsoft Way, Redmond, Washington 98052-6399 (US). (74) Agent: MINHAS, Sandip, S. et al.; Microsoft Technology Licensing, LLC, One Microsoft Way, Redmond, Washing- ton 98052-6399 (US). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FL GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, (54) Title: ADDRESSING A TRUSTED EXECUTION ENVIRONMENT USING ENCRYPTION KEY 7 .-- 100c Server Side 105 Client Side 110 • Authentication and secure establishment 165 channel Authentication and secure channel establishment (optional) 160 Cloud Host 185 Key Management Request key Host Guardian Request Requestor TrEE 140 155 System 115 170a Service 150a 120 TrEE targeted secret key 175a 180 FIG. 1C (57) : Methods, systems, and devices are described herein for delivering protected data to a nested trusted execution environ- ment (TrEE), including a trustlet running on top of secure kernel, associated with a potentially untrusted requestor. In one aspect, a targeting protocol head, or other intermediary between a requestor and a key management system or other store of protected data, may receive a request for protected data from a potentially untrusted requestor, and an attestation statement of the secure kernel. The targeting protocol head may encrypt a transfer encryption key with a second encryption key derived from the attestation statement. The targeting protocol head may retrieve the protected data, and encrypt the protected data with the transfer encryption key and an authentication tag, which binds the requestor with the trustlet ID. The targeting protocol head may provide the encrypted transfer encryption key, the encrypted protected data, and encrypted authentication tag to the requestor. [Continued on next page] WO 2018/140169 Al MIDEDIMOMMIDIREEMOMMHOIROHINHIMEN MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(11)) as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.17(iii)) Published: — with international search report (Art. 21(3))