Attestable Tool Chains for Verifying Logic on Heterogeneous Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face challenges in providing confidential computing services in heterogeneous cloud environments, where code deployment via tool chains results in derivative code rather than the customer's original code, making it difficult to attest the logic running on compute nodes.
Innovation Solution
An attestable tool chain is used to generate a chain of attestation assertions that trace from the customer-recognizable workload to the machine logic running on end compute nodes, allowing customers to verify the logic through a transitive attestation chain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If code is deployed via tool chains to heterogeneous compute nodes, then computing device versatility is improved, but the ability to attest to the original customer logic is worsened
Solution Approach 1:
The patent applies preliminary action by having the tool chain generate an attestation assertion about the customer logic before the logic is converted to machine code. This attestation assertion is then included in the machine code, ensuring that the attestation is established before the transformation occurs, thus maintaining reliability while enabling versatility.
Solution Approach 2:
The patent uses an intermediary approach by introducing a measurement value as an intermediate representation between the customer logic and the machine code. The tool chain measures the customer logic to generate this measurement value, which serves as a verifiable intermediary that connects the original logic to the transformed machine code, enabling attestation across heterogeneous platforms.
2Adaptability or versatility
If tool chains convert customer logic to machine code for different compute nodes, then computing device adaptability is improved, but code integrity verification is worsened
Solution Approach 1:
The patent applies copying by creating a measurement value that replicates the essential characteristics of the customer logic. This measurement value is copied into the machine code generated by the tool chain, serving as a verifiable copy that proves the machine code originated from the customer's logic without requiring the original logic to be present on the heterogeneous compute node.
Data Source
AI summary
Attestation of operations by tool chains is described. An example of a storage medium includes instructions for receiving source code for processing of a secure workload of a tenant; selecting at least a first compute node to provide computation for the workload; processing the source code by an attestable tool chain to generate machine code for the first compute node, including performing one or more conversions of the source code by one or more convertors to generate converted code and generating an attestation associated with each code conversion, and receiving machine code for the first compute node and generating an attestation associated with the first compute node; and providing each of the attestations from the first stage and the second stage for verification.