Method and apparatus for hardware based file/document expiry timer enforcement
A technique for secure network storage includes generating, by a trusted execution environment in a first device, an encryption key and a certificate for a document, wherein the certificate comprises expiry information for the document and the encryption key, encrypting, by a general execution environment in the first device, the document with the encryption key, transmitting the encryption key to a remote key manager, and transmitting the document to a remote network storage device, wherein a second device is allowed to decrypt the document based on the expiry information.
1. A machine readable storage device or storage disc comprising instructions which, when executed, cause a machine to at least:
request, from a remote key manager in a second remote network storage device, (A) expiry information for an encrypted document and (B) an encryption key for the encrypted document, the expiry information and the encryption key associated with a certificate generated in a trusted execution environment, the certificate associated with a document identification of the encrypted document, the encrypted document from a first remote network storage device, the expiry information indicating a time period for which the encryption key is valid to perform a decryption operation on the encrypted document, the first remote network storage device being separate from the second remote network storage device, and (i) the encrypted document, (ii) the expiry information, and (iii) the encryption key associated with the document identification;
in response to obtaining the expiry information and the encryption key, compare a current time to the time period of the expiry information to determine whether the decryption of the encrypted document is prohibited; and
when the decryption is prohibited, prevent access to the encrypted document.
2. The machine readable storage device or storage disc of claim 1 , wherein the instructions cause the machine to access a system clock to determine the current time.
3. The machine readable storage device or storage disc of claim 2 , wherein the system clock resides in the trusted execution environment on the machine.
4. The machine readable storage device or storage disc of claim 1 , wherein the instructions cause the machine to, when decryption is allowed, decrypt the encrypted document using the encryption key.
5. The machine readable storage device or storage disc of claim 1 , wherein the instructions cause the machine to:
prior to the request, determine the document identification of the encrypted document; and
include the document identification in the request.
6. A system comprising:
a general execution environment to request, from a remote key manager in a second remote network storage device, (A) expiry information for an encrypted document and (B) an encryption key for the encrypted document, the expiry information and the encryption key associated with a certificate generated in a trusted execution environment, the certificate associated with a document identification of the encrypted document, the encrypted document from a first remote network storage device, the expiry information indicating a time period for which the encryption key is valid to perform a decryption operation on the encrypted document, the first remote network storage device being separate from the second remote network storage device, and (i) the encrypted document, (ii) the expiry information, and (iii) the encryption key associated with the document identification; and
the trusted execution environment to:
in response to obtaining the expiry information and the encryption key, compare a current time to the time period of the expiry information to determine whether decryption of the encrypted document is prohibited; and
when the decryption is prohibited, prevent access to the encrypted document.
7. The system of claim 6 , wherein the trusted execution environment is to access a system clock to determine the current time.
8. The system of claim 7 , wherein the system clock resides in the trusted execution environment.
9. The system of claim 6 , wherein the general execution environment is to decrypt the encrypted document using the encryption key when the decryption is allowed.
10. The system of claim 6 , wherein the general execution environment is to:
prior to the request, determine the document identification of the encrypted document; and
include the document identification in a request.
11. A method of encrypting a document, the method comprising:
requesting, from a remote key manager in a second remote network storage device, (A) expiry information for an encrypted document and (B) an encryption key for the encrypted document, the expiry information and the encryption key associated with a certificate generated in a trusted execution environment, the certificate associated with a document identification of the encrypted document, the encrypted document from a first remote network storage device, the expiry information indicating a time period for which the encryption key is valid to perform a decryption operation on the document, the first remote network storage device being separate from the second remote network storage device, and (i) the encrypted document, (ii) the expiry information, and (iii) the encryption key associated with the document identification;
in response to obtaining the expiry information and the encryption key, comparing a current time to the time period of the expiry information to determine whether decryption of the encrypted document is prohibited; and
when the decryption is prohibited, preventing decryption of the encrypted document.
12. The method of claim 11 , further including accessing a system clock to determine the current time.
13. The method of claim 12 , wherein the system clock resides in the trusted execution environment.
14. The method of claim 11 , further including decrypting the encrypted document using the encryption key when the decryption is allowed.
15. The method of claim 11 , further including:
prior to the requesting, determining the document identification of the encrypted document; and
including the document identification in a request.