Confidential Workload Migration Using Attestation Evidence

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies do not effectively handle the live migration of Confidential Computing Environments (CCEs), failing to preserve workload integrity and security during transitions across different physical or virtual infrastructures.

Innovation Solution

A method for live migration of CCEs using CCE attestation to verify the integrity of memory-resident workloads, preserving integrity and security by leveraging attestation evidence and minimizing downtime through seamless transitions to resource-rich environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If workload migration is performed across different physical or virtual infrastructures, then resource flexibility and scalability are improved, but workload integrity and security may be compromised

Engineering Contradiction:

Improveresource flexibilityVSAvoidworkload integrity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an intermediary attestation mechanism that verifies workload integrity during migration. The attestation evidence acts as a mediator between source and destination CCEs, ensuring that the workload maintains its integrity and security properties across infrastructure transitions without compromising reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent performs preliminary attestation verification before completing the migration process. By checking attestation evidence in advance and validating security properties beforehand, the system ensures that only verified workloads are migrated, preventing integrity loss while enabling resource flexibility.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If traditional migration methods are used, then infrastructure flexibility is improved, but downtime during migration increases

Engineering Contradiction:

Improveinfrastructure flexibilityVSAvoidmigration downtime

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent enables continuous workload execution during migration by maintaining the workload in a suspended but active state. The attestation mechanism allows the workload to be transferred between CCEs without full shutdown, preserving continuous useful action and minimizing downtime while achieving infrastructure flexibility.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The patent implements dynamic migration where the workload can be suspended, transferred, and resumed based on infrastructure needs. The system dynamically adjusts the migration process using attestation evidence to enable seamless transitions between different computing environments without significant downtime.

Inventive Principle:

Principle #15Dynamics

3Reliability

If attestation verification is performed for each migration, then workload security is improved, but migration complexity increases

Engineering Contradiction:

Improveworkload securityVSAvoidmigration process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses attestation evidence as a copyable verification artifact that can be transferred and validated without repeating the entire verification process. By copying and validating pre-generated attestation data, the system maintains high security standards while reducing the operational complexity of each migration step.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent performs attestation verification in advance and caches the evidence for reuse during migration. By preparing verification data beforehand, the system ensures workload security is maintained while avoiding repeated complex verification processes during actual migration operations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP4718299A1An apparatus for migrating a workload, an apparatus and a method

Publication Date: 2026.04.01 INTEL CORP

Figure 1~2
Figure 3~4
Figure 5

AI summary

It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to obtain a migration history log from a first confidential computing environment executing a workload. The migration history log comprising data about one or more performed migrations of the workload. The machine-readable instructions further include instructions to obtain an attestation evidence collection associated with the workload. The attestation evidence collection associated with the workload comprising one or more attestation evidence associated with the workload. The machine-readable instructions further include instructions to obtain a migration image of the workload from the first confidential computing environment. The machine-readable instructions further include instructions to transmit at least one of the migration image, the attestation evidence collection and the migration history log to a second confidential computing environment