Confidential Workload Provisioning via Cloud Re-Signing for Enclaves

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing trusted execution environments (TEEs) like enclaves face resource management challenges due to hardware constraints, such as limited numbers of enclaves per server, complicating workload provisioning and resource allocation in multi-tenant cloud scenarios.

Innovation Solution

A signing service re-signs tenant applications with a cloud provider's keys, allowing multiple workloads to be provisioned in enclaves without decrypting them, thus overcoming hardware constraints and enabling efficient resource management.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple enclaves are allocated to multiple tenants using individual tenant keys, then tenant privacy and workload confidentiality are maintained, but hardware resource constraints limit the number of enclaves that can be run on a server

Engineering Contradiction:

Improvetenant privacy and workload confidentialityVSAvoidnumber of enclaves per server

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent merges multiple tenant-specific cryptographic operations into a single cloud provider-managed key pair. Instead of each tenant having separate keys that consume enclave resources, the cloud provider uses a unified key pair to sign workload images, allowing multiple tenants to share the same cryptographic infrastructure while maintaining their confidentiality requirements.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The cloud provider's single key pair serves multiple functions: it authenticates workload images from different tenants, enables multiple enclaves to be created on the same server, and maintains security for diverse workloads. This universal key infrastructure eliminates the need for separate keys per tenant, thereby overcoming hardware constraints on enclave数量.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Productivity

If hardware constraints limit the number of enclaves per server, then resource allocation is restricted, but provisioning confidential workloads becomes complicated and inefficient

Engineering Contradiction:

Improveworkload provisioning efficiencyVSAvoidresource allocation complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The cloud provider acts as an intermediary between tenants and the enclave infrastructure. By introducing a workload image signing service that uses the cloud provider's key pair, the system mediates the authentication process, allowing tenants to provision confidential workloads without directly managing cryptographic keys or navigating complex hardware constraints.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Instead of creating separate cryptographic infrastructures for each tenant, the system uses copies of the cloud provider's signed workload images. Each tenant receives authenticated workloads through the signing service, eliminating the need for duplicate key pairs while maintaining security and simplifying resource allocation.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS12549384B2Cloud based confidential workload provisioning

Publication Date: 2026.02.10 DELL PROD LP

AI summary

Confidential workload provisioning is disclosed. To overcome various hardware constraints, a workload (e.g., image or container) to be executed confidentially in an enclave is verified and then re-signed by the cloud service. Re-signing the workload allows workloads to be provisioned confidentially in enclaves or other secure environments while eliminating hardware constraints that may impact workload provisioning.