Distributed Service Attestation Using TEE Identity Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attestation protocols, such as Intel's SGX, are inadequate for distributed or micro-service based systems, failing to differentiate between legitimate and malicious deployments, and do not support secure communication among multiple enclaves.
Innovation Solution
A code library within a trusted execution environment (TEE) calculates a unique Trusted Distributed Identity (TDID) for a distributed service by combining Trusted Local IDs (TLIDs) of neighbor nodes, ensuring secure communication and identity verification using a recursive hash-based protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional SGX attestation protocol is used for monolithic applications, then code immutability and data confidentiality are ensured, but it fails to provide secure attestation for distributed services with multiple enclaves
Solution Approach 1:
The patent segments the distributed service into multiple enclaves, each with its own identity, while introducing a coordinator enclave that aggregates attestation information from all enclaves. This segmentation allows each enclave to maintain its security boundaries while enabling collective attestation for the entire distributed service.
Solution Approach 2:
The patent introduces a coordinator enclave as an intermediary that receives attestation reports from multiple service enclaves and aggregates them into a unified attestation statement. This intermediary enables the verification system to assess the entire distributed service as a single entity while maintaining the security properties of individual enclaves.
2Adaptability or versatility
If distributed services use multiple enclaves communicating with each other, then service functionality is enhanced, but existing attestation mechanisms cannot verify the integrity of the entire service topology
Solution Approach 1:
The patent merges the attestation information from multiple enclaves into a single unified attestation statement generated by the coordinator enclave. This combining of individual enclave attestations enables comprehensive verification of the entire distributed service topology and its communication patterns.
Solution Approach 2:
The patent adds a new dimension to attestation by not only verifying individual enclave integrity but also verifying the topology and communication relationships between enclaves. This multi-dimensional approach ensures both code integrity and architectural integrity of the distributed service.
3Productivity
If the service topology or code base changes to scale applications, then productivity increases, but traditional attestation cannot distinguish legitimate changes from malicious attacks
Solution Approach 1:
The patent implements dynamic attestation that can adapt to legitimate topology and code changes in distributed services. The system continuously verifies enclave identities and communication patterns, allowing scalable deployment while detecting deviations that indicate malicious attacks through the unified attestation statement.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to secure communication with a system of services distributed in a network. To this end, the present invention provides a node for providing a service to a client node in a network, wherein the node is configured to execute a code for providing the service to the client node in an enclave of a trusted execution environment (TEE) and execute a code library in the enclave to attest to the client node the identity of the service provided. In a further embodiment the service provided to the client node is a distributed service comprising a result of a cooperation of a plurality of neighbor nodes, which are connected to the node either directly or through other intermediate nodes and wherein the code library is configured to attest to the client node the identity of the distributed service.