Using secure enclaves for decryption in unsecured locations

1. A method comprising:

receiving, by a webserver in an unsecured physical location from a client device, a client hello message indicative of a request to initiate a secure session using Transport Layer Security (TLS), the client hello message comprising a first random value and a set of key exchange encryption algorithms supported by the client device;

sending, by the webserver to the client device, (i) a server hello message comprising a second random value, and (ii) a server digital certificate for authentication of the webserver by the client device, wherein the server digital certificate comprises a server public key;

receiving, by the webserver from the client device, an encrypted session key for the secure session, wherein the encrypted session key is encrypted using the server public key;

sending, by the webserver to a key server that is physically separated from the webserver, the encrypted session key and a key identifier associated with the server public key for decryption by the key server;

sending, by the key server to a decryption application executing on a secure enclave at the key server, the encrypted session key and the key identifier for decryption, wherein the secure enclave is configured to operate in a protected area of execution in memory of the key server, and wherein the secure enclave is inaccessible by an operating system of the key server, and wherein the decryption application decrypts the encrypted session key by:

transitioning execution from an untrusted portion of the decryption application to the secure enclave;

determining, by the key server, that an encrypted private key associated with the webserver is unavailable in secure cache memory;

sending, by the key server, a request for the encrypted private key to an external secure datastore that is in communication with the key server;

receiving, by the key server, the encrypted private key from the secure datastore, wherein the encrypted private key is encrypted using a public key associated with the secure enclave;

and

determining the decrypted session key using a trusted decryption function and the encrypted private key;

receiving, by the key server from the decryption application, a decrypted session key;

sending, by the key server to the webserver, the decrypted session key, wherein the decrypted session key is used for encryption and decryption of communication between the webserver and the client device; and

sending, by the webserver to the client device, a confirmation message indicating that the decrypted session key will be used for subsequent communication.

2. The method of claim 1 , wherein the decryption application comprises a call gate that restricts entry to and exit from the decryption application.

3. The method of claim 1 , further comprising:

encrypting a private key associated with the key identifier using a secure enclave public key; and

sending the private key that is encrypted using the secure enclave public key for storage in the secure enclave.

4. A method comprising:

receiving, by one or more computer processors coupled to memory of a webserver, an encrypted session key from a device, wherein the encrypted session key is encrypted using a public key associated with the webserver;

sending the encrypted session key to a key server for decryption, wherein the key server is configured to decrypt the encrypted session key in a secure enclave by:

transitioning execution from an untrusted portion of a decryption application to the secure enclave;

determining, by the key server, that an encrypted private key associated with the webserver is unavailable in secure cache memory;

sending, by the key server, a request for the private key to an external secure datastore that is in communication with the key server; and

determining a decrypted session key using the encrypted private key and a trusted decryption function, wherein private key data for a plurality of private keys is stored at the secure enclave;

receiving a decrypted session key from the key server, wherein the decrypted session key is the encrypted session key in decrypted form; and

establishing a secure session with the device using the decrypted session key.

5. The method of claim 4 , wherein the secure enclave comprises a protected region of memory and processor at the key server that is prevented from access by an operating system of the key server.

6. The method of claim 4 , further comprising:

sending a key identifier to the key server, wherein the key server uses the key identifier to identify the private key associated with the webserver.

7. The method of claim 4 , further comprising:

determining, by the key server in the secure enclave, the private key associated with the webserver.

8. The method of claim 4 , further comprising:

encrypting the private key using a secure enclave public key; and

sending the private key that is encrypted using the secure enclave public key to the key server for storage in the secure enclave.

9. The method of claim 4 , further comprising:

receiving a request from the device to initiate the secure session;

sending the public key to the device; and

sending a secure session confirmation message to the device.

10. The method of claim 4 , wherein the webserver is positioned in a physically unsecured location, and wherein the webserver is prevented from accessing the private key that is associated with the webserver.

11. The method of claim 4 , wherein the webserver and the key server share at least one computer processor.

12. The method of claim 4 , wherein the webserver and the key server are physically separated from each other.

13. A system comprising:

a webserver; and

a key server comprising memory that stores computer-executable instructions and at least one processor configured to access the memory and execute the computer-executable instructions to:

receive a request from the webserver to decrypt an encrypted session key, the request comprising a key identifier;

transition execution from an untrusted portion of a decryption application to a secure enclave at the key server, wherein the decryption application is configured to be executed in the secure enclave to decrypt the encrypted session key;

determine that an encrypted private key associated with the webserver is not stored in the memory;

send a request for the encrypted private key to an external secure datastore that is in communication with the key server;

determine the encrypted private key associated with the key identifier;

determine, in the secure enclave, a decrypted session key using the encrypted private key and a trusted decryption function, wherein the encrypted private key is encrypted using a public key associated with the secure enclave; and

send the decrypted session key to the webserver, wherein the decrypted session key is the encrypted session key in decrypted form;

wherein the webserver is configured to establish a secure session with a device using the decrypted session key.

14. The system of claim 13 , wherein the at least one processor is further configured to access the memory and execute the computer-executable instructions to:

provision the secure enclave after the key server is rebooted.

15. The system of claim 13 , wherein the webserver and the key server are physically separated in an unsecure physical location.

16. The system of claim 13 , wherein the webserver and the key server share the at least one processor in an unsecure physical location.

17. The system of claim 13 , wherein the key server further comprises a secure enclave processor that is dedicated to processing for the secure enclave, and wherein the secure enclave executes in a protected region of the memory that is prevented from access by an operating system of the key server.