Edge Appliance Certificate Aggregation for Low-Latency Attestation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud computing architectures face challenges in providing secure and efficient function-as-a-service (FaaS) with unbounded user execution, requiring effective verification of edge appliance components and workload scheduling to ensure service level agreements (SLA) are met, while maintaining low latency.

Innovation Solution

The system employs edge devices with accelerators to generate and verify appliance certificates, aggregating component certificates for comprehensive attestation, and orchestrators to verify these certificates against SLA requirements, ensuring the root of trust and scheduling workloads efficiently across disaggregated components.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional FaaS systems verify each component certificate individually, then comprehensive security attestation is achieved, but verification latency increases

Engineering Contradiction:

Improvesecurity attestationVSAvoidverification latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent combines multiple component certificates into a single aggregated appliance certificate that represents the entire edge appliance. This merging allows the orchestrator to verify one certificate instead of multiple individual component certificates, reducing verification latency while maintaining comprehensive security attestation of all components.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The edge appliance pre-aggregates component certificates into an appliance certificate before the orchestrator requests verification. This preliminary action prepares the consolidated certificate in advance, enabling faster verification when the orchestrator needs to attest the edge appliance's trustworthiness.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the system verifies complete root of trust for all components, then security is improved, but orchestration complexity increases

Engineering Contradiction:

Improveroot of trust verificationVSAvoidorchestration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The trust verification is segmented into two levels: component-level certificates signed by component private keys, and appliance-level certificate aggregated by the edge appliance. This segmentation allows the orchestrator to verify the aggregated appliance certificate without needing to individually verify each component, reducing orchestration complexity while maintaining complete root of trust verification.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The appliance certificate acts as an intermediary that represents the collective trust of all components. Instead of the orchestrator directly verifying each component certificate, it verifies the appliance certificate which encapsulates all component trust relationships, simplifying the orchestration process.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If the system schedules workloads dynamically across unbounded users, then service flexibility is improved, but ensuring SLA compliance becomes more difficult

Engineering Contradiction:

Improveworkload scheduling flexibilityVSAvoidSLA compliance verification

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system uses appliance certificates as feedback mechanisms that continuously attest to the edge appliance's component integrity and utilization state. The orchestrator verifies these certificates to obtain feedback on whether SLA requirements are met, enabling dynamic workload scheduling while maintaining SLA compliance verification across unbounded users.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20230045505A1Technologies for accelerated orchestration and attestation with edge device trust chains

Publication Date: 2023.02.09 INTEL CORP

AI summary

Technologies for accelerated orchestration and attestation include multiple edge devices. An edge appliance device performs an attestation process with each of its components to generate component certificates. The edge appliance device generates an appliance certificate that is indicative of the component certificates and a current utilization of the edge appliance device and provides the appliance certificate to a relying party. The relying party may be an edge orchestrator device. The edge orchestrator device receives a workload scheduling request with a service level agreement requirement. The edge orchestrator device verifies the appliance certificate and determines whether the service level agreement requirement is satisfied based on the appliance certificate. If satisfied, the workload is scheduled to the edge appliance device. Attestation and generation of the appliance certificate by the edge appliance device may be performed by an accelerator of the edge appliance device. Other embodiments are described and claimed.