Secure confidential use of communication session keys

1. A method for secure communication, the method comprises:

generating master keys by a keys security entity (KSE) enclave that is established within a KSE;

generating one-time connection session keys, by the KSE enclave, based on the master keys;

outputting the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and

preventing access, by the KSE enclave, to the master keys.

2. The method according to claim 1 comprising:

verifying, by the KSE enclave, a state of the CSE and/or CSE enclave; and

preventing a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised.

3. The method according to claim 2 comprising periodically verifying the state of the CSE enclave.

4. The method according to claim 2 comprising verifying the state of the CSE and/or CSE enclave before sending to the CSE and/or CSE enclave at least some of the one-time connection session keys.

5. The method according to claim 1 comprising:

managing, by the CSE and/or CSE enclave, real time connections with multiple edge devices using the one-time connection session keys, and

deleting, by the CSE and/or CSE enclave, each one-time connection session key at an end of a connection session to which the one-time connection session key is allocated.

6. The method according to claim 1 wherein the CSE is a cloud-based software-based CSE of a datacenter.

7. The method according to claim 1 comprising:

requesting, by the CSE and/or CSE enclave and from the KSE, to provide a one-time connection session key for a connection session;

providing to the CSE and/or CSE enclave the one-time connection session key;

establishing, by the CSE and/or CSE enclave, a connection session using the one-time connection session key.

8. The method according to claim 1 comprising:

requesting the KSE enclave to provide a one-time connection session key for a connection session;

verifying, by the KSE enclave, whether a state of the CSE and/or CSE enclave is non-compromised state;

following a successful verifying, responding to the request.

9. A non-transitory computer readable medium for secure communication, the non-transitory computer readable medium comprises:

generating master keys by a keys security entity (KSE) enclave that is established within a KSE;

generating one-time connection session keys, by the KSE enclave, based on the master keys;

outputting the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and

preventing access, by the KSE enclave, to the master keys.

10. The non-transitory computer readable medium according to claim 9 that stores instructions for:

verifying, by the KSE enclave, a state of the CSE and/or CSE enclave; and

preventing a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised.

11. The non-transitory computer readable medium according to claim 10 that stores instructions for periodically verifying the state of the CSE enclave.

12. The non-transitory computer readable medium according to claim 10 that stores instructions for verifying the state of the CSE and/or CSE enclave before sending to the CSE and/or CSE enclave at least some of the one-time connection session keys.

13. The non-transitory computer readable medium according to claim 9 that stores instructions for:

managing, by the CSE and/or CSE enclave, real time connections with multiple edge devices using the one-time connection session keys, and

deleting, by the CSE and/or CSE enclave, each one-time connection session key at an end of a connection session to which the one-time connection session key is allocated.

14. The non-transitory computer readable medium according to claim 9 wherein the CSE is a cloud-based software-based CSE of a datacenter.

15. The non-transitory computer readable medium according to claim 9 that stores instructions for:

requesting, by the CSE and/or CSE enclave and from the KSE, to provide a one-time connection session key for a connection session;

providing to the CSE and/or CSE enclave the one-time connection session key;

establishing, by the CSE and/or CSE enclave, a connection session using the one-time connection session key.

16. The non-transitory computer readable medium according to claim 9 that stores instructions for:

requesting the KSE enclave to provide a one-time connection session key for a connection session;

verifying whether a state of the CSE and/or CSE enclave is non-compromised state;

following a successful verifying, responding to the request.

17. A system for secure communication, the system comprises:

a keys security entity (KSE) enclave that is established in a KSE, the KSE enclave is configured to (a) generate master keys, (b) generate one-time connection session keys, by the KSE enclave, based on the master keys, (c) output the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and (d) prevent access, by the KSE enclave, to the master keys.

18. The system according to claim 17 comprising the CSE and the CSE enclave.

19. The system according to claim 17 wherein the KSE enclave is configured to verify a state of the CSE and/or CSE enclave; and wherein the system is configured to prevent a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised.