Encryption Key protection for Private Computing on Public Platforms

Private Computing on Public Platforms (PCPP) is a new technology designed to enable secure and private execution of applications on remote, potentially hostile, public platforms. PCPP must secure its encryption keys to ensure that application isolation is robust and reliable. To this end we offer a protection scheme for PCPP encryption keys. In this paper we first discuss a commonly used key storage mechanism, the Linux Key Retention Service (LKRS) and show a method for defeating this protection allowing one user to read the LKRS stored keys from another user's processes. We then describe our PCPP key protection methodology and how it interacts with the other PCPP building blocks to isolate encryption keys even from privileged users.