Method to store data persistently by a software payload

1 . A computer-implemented method to store data persistently by a software payload of an owner device, the method comprising the following steps:

establishing a secure channel between the owner device and the software payload itself when running into a hardware-based trusted executed environment, HW TEE, at the instance of a cloud service provider;

generating, by the owner device, a payload identifier using information shared from the payload during the establishment of the secure channel;

generating, by the owner device, a key initiator and persistently storing at the owner device the key initiator associated to the payload identifier;

sending, by the owner device, the payload identifier and the key initiator to the payload;

using the key initiator, by the payload, to encrypt data;

persistently storing, by the payload, the encrypted data and the payload identifier; and

encrypting, by the owner device, the payload identifier using a first encryption key before sending it to the payload for its persistent storing in encrypted form.

2 . The method according to claim 1 , wherein either:

the key initiator is a symmetric key, or

the key initiator is first passed through a key derivation function, KDF, by the payload, to generate a symmetric key that encrypts the data.

3 . The method according to claim 1 , wherein the key initiator is passed through a key derivation function, KDF, by the payload, to generate a Message Authentication Code (MAC) that allows the payload to subsequently check the integrity of the persistently stored data.

4 . The method according to claim 1 , wherein the secure channel between the owner device and the software payload is backed by a computation, by the HW TEE, of an attestation, and wherein the payload identifier is derived from the attestation information such as at least one of information relative to the HW TEE, the version of the payload, and the instantiation of the payload.

5 . A computer-implemented method to retrieve data persistently stored by a payload of an owner device according to claim 1 , the method comprising the following steps:

having established or re-establishing a secure channel between the owner device and the software payload itself when running into the HW TEE at the instance of a cloud service provider;

retrieving, by the payload, the stored payload identifier and sending it to the owner device;

retrieving, by the owner device, the key initiator associated to the received payload identifier;

sending, by the owner device, the key initiator to the payload; and

using the key initiator, by the payload, to decrypt the persistently stored data.

6 . The method according to claim 5 , wherein the stored payload identifier had been previously encrypted by the owner device using the first encryption key, the method comprising the following steps:

sending, by the owner device, the first encryption key to the payload; and

after being retrieved, decrypting, by the payload, the payload identifier and sending it to the owner device.

7 . The method according to claim 5 , wherein the stored payload identifier had been previously encrypted by the owner device using the first encryption key, the method comprising the following steps:

sending, by the payload, the encrypted payload identifier to the owner device;

decrypting, by the owner device, the payload identifier; and

retrieving, by the owner device, the key initiator associated to the decrypted payload identifier.

8 . A system for persistently storing data by a software payload of an owner device, the system comprising:

the owner device of the software payload configured to send the software payload to the a hardware-based trusted executed environment (HW TEE) for its execution, the software payload configured to run into the HW TEE, and the HW TEE operated by a cloud service provider;

wherein the owner device of the software payload and the software payload itself are configured to establish a secure channel between them when the payload is running into the HW TEE at the instance of the cloud service provider;

wherein the owner device is further configured to

generate a payload identifier using information shared from the payload during the establishment of the secure channel;

generate a key initiator;

persistently store at the owner device the key initiator associated to the payload identifier;

send the payload identifier and the key initiator to the payload; and

encrypt the payload identifier using a first encryption key before sending it to the payload for its persistent storing in encrypted form; and

wherein the payload is further configured to

use the key initiator to encrypt data; and

persistently store the encrypted data and the payload identifier.

9 . An owner device of a software payload for persistently storing data by the software payload, the owner device of the software payload configured to send the software payload to a hardware-based trusted executed environment (HW TEE) for its execution, wherein the owner device is further configured to

establish a secure channel with the payload when the payload is running into the HW TEE at the instance of a cloud service provider;

generate a payload identifier using information shared from the payload during the establishment of the secure channel;

generate a key initiator;

persistently store at the owner device the key initiator associated to the payload identifier;

send the payload identifier and the key initiator to the payload which will use the key initiator to encrypt data and persistently store it and the payload identifier; and

encrypt the payload identifier using a first encryption key before sending it to the payload for its persistent storing in encrypted form.