Runtime Workload Attestation in Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional Trusted Execution Environments (TEEs) rely on initial workload validation at launch, leaving them vulnerable to attacks or compromises during execution, as they lack ongoing monitoring and validation mechanisms.
Innovation Solution
A system that performs periodic runtime validation checks on workloads within TEEs, utilizing an endpoint runtime integrity monitor, workload snapshots, and a policy enforcement engine to detect and respond to runtime code exploitation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional initial workload validation at launch is used, then the system structure remains simple, but the workload becomes vulnerable to attacks or compromises during execution
Solution Approach 1:
The system performs preliminary actions by capturing workload snapshots at designated points during execution and pre-establishing verification mechanisms. These snapshots are taken at snapshot triggers (time-based or event-based) before potential compromises can occur, allowing the system to proactively maintain integrity rather than reactively respond to breaches.
Solution Approach 2:
The system implements continuous feedback loops by repeatedly generating measurements of the workload at different time points, verifying these measurements against expected values, and using this feedback to determine whether the workload remains uncompromised. This closed-loop verification process enables real-time detection and response to potential security breaches during execution.
2Measurement precision
If periodic runtime validation checks are implemented, then ongoing monitoring and detection capability is improved, but the system complexity and resource consumption increase
Solution Approach 1:
The system employs periodic action by capturing workload snapshots at regular intervals or at specific trigger points during execution. This periodic measurement approach balances the need for continuous monitoring with system resource constraints, performing validation checks at meaningful intervals rather than continuously, thereby maintaining detection accuracy while controlling complexity.
Solution Approach 2:
The system applies partial action by focusing verification efforts on critical snapshot points during workload execution rather than attempting to monitor every instantaneous state. By selecting strategic measurement moments (snapshot triggers), the system achieves sufficient integrity verification without the prohibitive complexity of exhaustive continuous monitoring.
3Reliability
If workload snapshots are captured at multiple time points, then the ability to detect runtime code exploitation is enhanced, but the storage and processing requirements increase
Solution Approach 1:
The system creates simplified copies of the workload state at specific snapshot points rather than storing complete workload images. These snapshots capture essential measurement data and state information sufficient for verification purposes, reducing storage requirements while maintaining the ability to detect runtime code exploitation through comparison of snapshot measurements.
Data Source
AI summary
It is provided an anon-transitory computer-readable medium storing instructions that, when executed by one or more processing circuitries, causing the one or more processing circuitries to perform a method for attestation of a running workload in a trusted execution environment. The method comprises generating a first measurement of a workload. The method further comprises capturing one or more snapshots of a trusted execution environment executing the workload. The one or more snapshots are captured based on one or more snapshot triggers. The method comprises generating a second measurement of the workload while the workload is being executed in the trusted execution environment. The method comprises verifying the generated second measurement. The method comprises triggering a verification failure action, if the verification of the second measurement fails.