Distributed key management for trusted execution environments
Disclosed herein are methods, systems, and apparatus, for securely executing smart contract operations in a trusted execution environment (TEE). One of the methods includes establishing, by a key management (KM) TEE of a KM node, a trust relationship with a plurality of KM TEEs in a plurality of KM nodes based on performing mutual attestations with the plurality of KM TEEs; initiating a consensus process with the plurality of KM TEEs for reaching consensus on providing one or more encryption keys to a service TEE of the KM node; in response to reaching the consensus with the plurality of KM TEEs, initiating a local attestation process with a service TEE in the KM node; determining that the local attestation process is successful; and in response to determining that the local attestation process is successful, providing one or more encryption keys to the TEE executing on the computing device.
1. A computer-implemented method for verifying authenticity of trusted execution environments (TEEs), the method comprising:
determining, by a key management center, that a trust relationship has been established among multiple knowledge management (KM) trusted execution environments (TEEs) based on a successful completion of a mutual attestation process by the KM TEEs;
after determining that the trust relationship has been established among the multiple KM TEEs, determining, by the key management center, that the KM TEEs have reached a consensus based on a successful completion of a consensus process by the KM TEEs;
after determining that the KM TEEs have reached the consensus, determining, by the key management center, to transmit one or more encryption keys that are specified by the consensus to a particular service TEE based on a successful completion of a local attestation process by a particular KM TEE that is implemented on a same blockchain node as the particular service TEE; and
after determining to transmit the one or more encryption keys that are specified by the consensus to the particular service TEE, transmitting, by the key management center, the one or more encryption keys that are specified by the consensus to the particular service TEE that is implemented on the same blockchain node as the particular KM TEE.
2. The computer-implemented method of claim 1 , wherein the KM TEEs are in a consortium blockchain and the method further comprises:
storing the one or more encryption keys in the consortium blockchain, wherein the one or more encryption keys stored in the consortium blockchain represent a consensus version of the one or more encryption keys accessible by all nodes in the consortium blockchain.
3. The computer-implemented method of claim 1 , wherein the key management center is comprised of one or more of the KM TEEs elected by the KM TEEs, through a different consensus process, to act as the key management center to generate and maintain encryption keys and deploy the encryption keys.
4. The computer-implemented method of claim 1 , wherein the KM TEEs form a set of KM TEEs within a consortium blockchain, and wherein determining that the trust relationship has been established further includes determining that a second mutual attestation process between two KM TEEs of the set of KM TEEs is successful.
5. The computer-implemented method of claim 1 , wherein determining that the trust relationship has been established further includes determining that a first KM TEE performs a mutual attestation with each of the KM TEEs.
6. The computer-implemented method of claim 1 , wherein the KM TEEs are in a consortium blockchain, and wherein the encryption keys are stored in the consortium blockchain in response to the key management center determining the KM TEEs successfully performed the consensus process on the encryption keys.
7. The computer-implemented method of claim 1 , wherein the consensus process is a Practical Byzantine Fault Tolerance (PBFT) process.
8. The computer-implemented method of claim 1 , wherein the KM TEEs are in a consortium blockchain, and wherein the encryption keys include a TEE public key and a TEE private key associated with the particular service TEE, and wherein a first KM TEE or a second KM TEE retrieves the TEE public key from the consortium blockchain and provides the TEE public key to a client in response to a request.
9. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
determining, by a key management center, that a trust relationship has been established among multiple knowledge management (KM) trusted execution environments (TEEs) based on a successful completion of a mutual attestation process by the KM TEEs;
after determining that the trust relationship has been established among the multiple KM TEEs, determining, by the key management center, that the KM TEEs have reached a consensus based on a successful completion of a consensus process by the KM TEEs;
after determining that the KM TEEs have reached the consensus, determining, by the key management center, to transmit one or more encryption keys that are specified by the consensus to a particular service TEE based on a successful completion of a local attestation process by a particular KM TEE that is implemented on a same blockchain node as the particular service TEE; and
after determining to transmit the one or more encryption keys that are specified by the consensus to the particular service TEE, transmitting, by the key management center, the one or more encryption keys that are specified by the consensus to the particular service TEE that is implemented on the same blockchain node as the particular KM TEE.
10. The non-transitory, computer-readable medium of claim 9 , wherein the KM TEEs are in a consortium blockchain and the operations further comprise:
storing the one or more encryption keys in the consortium blockchain, wherein the one or more encryption keys stored in the consortium blockchain represent a consensus version of the one or more encryption keys accessible by all nodes in the consortium blockchain.
11. The non-transitory, computer-readable medium of claim 9 , wherein the key management center is comprised of one or more of the KM TEEs elected by the KM TEEs, through a consensus process, to act as the key management center to generate and maintain encryption keys and deploy the encryption keys.
12. The non-transitory, computer-readable medium of claim 9 , wherein the KM TEEs form a set of KM TEEs within a consortium blockchain, and wherein determining that a trust relationship has been established further includes determining that a mutual attestation process between two KM TEEs of the set of KM TEEs is successful.
13. The non-transitory, computer-readable medium of claim 9 , wherein determining that the trust relationship has been established further includes determining that a first KM TEE performs a mutual attestation with each of the KM TEEs.
14. The non-transitory, computer-readable medium of claim 9 , wherein the KM TEEs are in a consortium blockchain, and wherein the encryption keys are stored in the consortium blockchain in response to the key management center determining the KM TEEs successfully performed a consensus process on the encryption keys.
15. The non-transitory, computer-readable medium of claim 9 , wherein the KM TEEs are in a consortium blockchain, and wherein the encryption keys include a TEE public key and a TEE private key associated with the particular service TEE, and wherein a first KM TEE or a second KM TEE retrieves the TEE public key from the consortium blockchain and provides the TEE public key to a client in response to a request.
16. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
determining, by a key management center, that a trust relationship has been established among multiple knowledge management (KM) trusted execution environments (TEEs) based on a successful completion of a mutual attestation process by the KM TEEs;
after determining that the trust relationship has been established among the multiple KM TEEs, determining, by the key management center, that the KM TEEs have reached a consensus based on a successful completion of a consensus process by the KM TEEs;
after determining that the KM TEEs have reached the consensus, determining, by the key management center, to transmit one or more encryption keys that are specified by the consensus to a particular service TEE based on a successful completion of a local attestation process by a particular KM TEE that is implemented on a same blockchain node as the particular service TEE; and
after determining to transmit the one or more encryption keys that are specified by the consensus to the particular service TEE, transmitting, by the key management center, the one or more encryption keys that are specified by the consensus to the particular service TEE that is implemented on the same blockchain node as the particular KM TEE.
17. The computer-implemented system of claim 16 , wherein the KM TEEs are in a consortium blockchain and the operations further comprise:
storing the one or more encryption keys in the consortium blockchain, wherein the one or more encryption keys stored in the consortium blockchain represent a consensus version of the one or more encryption keys accessible by all nodes in the consortium blockchain.
18. The computer-implemented system of claim 16 , wherein the key management center is comprised of one or more of the KM TEEs elected by the KM TEEs, through a consensus process, to act as the key management center to generate and maintain encryption keys and deploy the encryption keys.
19. The computer-implemented system of claim 16 , wherein the KM TEEs form a set of KM TEEs within a consortium blockchain, and wherein determining that a trust relationship has been established further includes determining that a mutual attestation process between two KM TEEs of the set of KM TEEs is successful.
20. The computer-implemented system of claim 16 , wherein determining that the trust relationship has been established further includes determining that a first KM TEE performs a mutual attestation with each of the KM TEEs.