MEC Service Mesh Attestation Through Sidecar Proxies

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing edge computing systems face challenges in managing orchestration, functional coordination, and resource management, particularly in complex mobility settings with multiple participants, leading to limitations in security, processing, and network resources within MEC service mesh frameworks.

Innovation Solution

Implementing a service mesh control plane (SMCP) with hardware security modules and sidecar proxies to enforce security policies and perform disintermediated attestation, ensuring secure and efficient operation of microservices in Multi-Access Edge Computing (MEC) environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If traditional cloud network services are used, then centralized resource management is achieved, but network latency increases and responsiveness decreases

Engineering Contradiction:

Improvenetwork latencyVSAvoiddistributed orchestration complexity

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent segments the centralized cloud service into distributed microservices deployed at edge locations. Each microservice operates independently with local orchestration, eliminating the need for all requests to traverse to centralized cloud data centers. This segmentation reduces network latency while distributing management complexity across multiple autonomous units.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a new architectural dimension by deploying computing resources at the network edge rather than relying solely on centralized cloud infrastructure. This spatial dimensionality change brings compute resources physically closer to end users, reducing transmission distance and latency while enabling localized service delivery.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Adaptability or versatility

If mobility and dynamically launched services are integrated, then service versatility increases, but orchestration and resource management complexity increases

Engineering Contradiction:

Improveservice mobilityVSAvoidorchestration complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements self-service mechanisms where microservices automatically discover, register, and orchestrate themselves within the service mesh framework. The sidecar proxies autonomously manage service lifecycle events, health checks, and routing decisions without requiring complex external orchestration, enabling dynamic service deployment while simplifying management.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent incorporates feedback loops through the service mesh control plane that continuously monitors service health, resource utilization, and performance metrics. This real-time feedback enables automatic scaling, load balancing, and fault recovery, allowing the system to adapt to mobility and dynamic service launches while maintaining manageable orchestration through automated responses.

Inventive Principle:

Principle #23Feedback

3Reliability

If security policies are enforced through traditional intermediaries, then security is maintained, but processing latency increases

Engineering Contradiction:

ImprovesecurityVSAvoidprocessing latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts security verification functions from traditional centralized authentication intermediaries and embeds them directly into the sidecar proxies at the service mesh edge. This extraction eliminates multiple hops to centralized security servers, maintaining security policy enforcement while reducing the processing latency associated with traditional intermediary-based authentication.

Inventive Principle:

Principle #2Taking out (Extraction)

4Speed

If edge computing resources are deployed closer to endpoints, then latency is reduced, but power and cooling constraints increase

Engineering Contradiction:

Improveresponse timeVSAvoidpower consumption

Core Design Contradiction:

SpeedVSUse of energy by moving object

Solution Approach 1:

The patent applies partial action by deploying only the necessary microservices and computing resources at edge locations based on actual service demands, rather than provisioning full-scale data center capabilities at every edge node. This selective deployment reduces power consumption and cooling requirements while maintaining low latency for critical services.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20250274505A1Disintermediated attestation in a MEC service mesh framework

Publication Date: 2025.08.28 INTEL CORP

AI summary

A machine-readable storage medium includes instructions stored thereupon, which when executed by processing circuitry of a computing node operable to implement a service mesh control plane (SMCP) in a MEC network, cause the processing circuitry to decode an attestation request received from a sidecar proxy of a deployable instance. The sidecar proxy is instantiated on a MEC host. Evidence information is collected from the deployable instance responsive to the attestation request, the evidence information comprising at least one security configuration of the deployable instance. An attestation of the evidence information is performed using a verified configuration of the deployable instance to generate an integrity report. An attestation token is generated based on the integrity report and is encoded for transmission to the MEC host. The attestation token authorizes the sidecar proxy to obtain configuration to facilitate a data exchange between the deployable instance and at least another deployable instance.