Patent SG-11201909855Y-A (SG)
Title: Distributed key management for trusted execution environments
Inventor: WEI CHANGZHENG
Filed: 2019-04-26
Abstract: PalTEE c Node N Service TEE 306d KM TEE 308d W O 20 19/ 1375 65 A2 (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 18 July 2019 (18.07.2019) WIPO I PCT 11111111111111011111111111111110111110101111111111111111111111111111111111111011110111111 (10) International Publication Number WO 2019/137565 A2 (51) International Patent Classification: Not classified (21) International Application Number: PCT/CN2019/084530 (22) International Filing Date: 26 April 2019 (26.04.2019) (25) Filing Language: English (26) Publication Language: English (71) Applicant: ALIBABA GROUP HOLDING LIMITED [—/CN]; Fourth Floor, One Capital Place, P.O. BOX 847, George Town, Grand Cayman (KY). (72) Inventors: WEI, Changzheng; Alibaba Group Legal De- partment 5/F, Building 3, No.969 West Wen Yi Road, Yu Hang District, Hangzhou, Zhejiang 311121 (CN). YAN, Ying; Alibaba Group Legal Department 5/F, Building 3, No.969 West Wen Yi Road, Yu Hang District, Hangzhou, Zhejiang 311121 (CN) ZHAO, Boran; Alibaba Group Legal Department 5/F, Building 3, No.969 West Wen Yi Road, Yu Hang District, Hangzhou, Zhejiang 311121 (CN). SONG, Xuyang; Alibaba Group Legal Department 5/F, Building 3, No.969 West Wen Yi Road, Yu Hang District, Hangzhou, Zhejiang 311121 (CN). (74) Agent: BEIJING BESTIPR INTELLECTUAL PROP- ERTY LAW CORPORATION; Room 409, Tower B, Ka Wah Building, No. 9 Shangdi 3rd Street, Haidian District, Beijing 100085 (CN). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, 1E, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). (54) Title: DISTRIBUTED KEY MANAGEMENT FOR TRUSTED EXECUTION ENVIRONMENTS (57) : Disclosed herein are methods, systems, and apparatus, includ- 300 ing computer programs encoded on computer storage media, for securely ex- ecuting smart contract operations in a trusted execution environment (TEE). One of the methods includes establishing, by a key management (KM) TEE of a KM node, a tmst relationship with a plurality of KM TEEs in a plurality of KM nodes based on performing mutual attestations with the plurality of KM TEEs; initiating a consensus process with the plurality of KM TEEs for reach- ing consensus on providing one or more encryption keys to a service TEE of the KM node; in response to reaching the consensus with the plurality of KM 3046 304c 3044 TEEs, initiating a local attestation process with a service TEE in the KM node; determining that the local attestation process is successful; and in response to determining that the local attestation process is successful, providing one or more encryption keys to the TEE executing on the computing device. 3066 KM TEE 308a Remote Attestation 320' Key Deployment FIG. 3 Key Management C,enier —310 [Continued on next page] 304a Node 1 Inks TEE 306a KM TEE 308b Node 2 &Nice TEE Node 3 See TEE 306c WO 2019/137565 A2 I IllIl I 01E110 Mill II III 11111 II 111 1101 0 Ill OM 11111 II III 11111 11111 1111111011110111111 Published: upon request of the applicant, before the expiration of the time limit referred to in Article 21(2)(a) without international search report and to be republished upon receipt of that report (Rule 48.2(g))