Secure Execution Environments for Cloud Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In modern distributed and virtual computer systems, ensuring data and application security is challenging, particularly in environments where multiple users and services have access, and there is a need to protect sensitive data from both malicious applications and computing resource service providers.
Innovation Solution
Implementing secure execution environments (SEEs) that allow services to operate within a trusted boundary, using cryptographic measures to encrypt data and prevent unauthorized access, while providing attestation and secure key management to ensure the integrity and isolation of sensitive data and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to protect security, then security is improved, but users need additional assurances that malicious applications cannot obtain trusted status and access encryption keys
Solution Approach 1:
The system segments the computing environment into untrusted regions (host OS, controlling domain) and a trusted region (secure execution environment). By spatially separating sensitive operations into an isolated enclave, the patent resolves the contradiction by providing strong security guarantees without requiring complex security mechanisms throughout the entire system. The secure execution environment acts as a dedicated secure compartment that inherently protects encryption keys and sensitive data.
Solution Approach 2:
The secure execution environment serves as an intermediary layer between untrusted applications and sensitive data/resources. This mediator provides attestation capabilities that verify the identity and trustworthiness of the secure environment to external parties, while simultaneously isolating encryption keys and sensitive operations from malicious applications. The intermediary nature of the SEE resolves the contradiction by providing simplified security assurances through cryptographic attestation rather than complex access control mechanisms.
2Ease of operation
If a controlling domain or operating system always has trusted status and can read or write directly from computer system memory, then system operation is simplified, but user data security against privileged entities is compromised
Solution Approach 1:
The patent extracts sensitive operations and data from the general-purpose controlling domain and operating system into a separate secure execution environment. By taking out encryption key storage and sensitive data processing from the privileged OS context, the system maintains simple operation for unprivileged applications while providing strong security guarantees for sensitive operations. The SEE is accessed through controlled interfaces rather than direct memory access, resolving the contradiction between operational simplicity and security.
Solution Approach 2:
The system applies different security qualities to different parts of the computing environment. The controlling domain and OS maintain general-purpose functionality with standard access privileges, while the secure execution environment implements enhanced security properties including isolated memory access, cryptographic attestation, and protected key storage. This local differentiation resolves the contradiction by providing strong security where needed without compromising overall system operability.
3Productivity
If computing resource service providers can access all computer system resources, then resource utilization is maximized, but customer data security even against discovery by the provider is compromised
Solution Approach 1:
The secure execution environment is nested within the computing resource service provider's infrastructure, creating a hierarchy where the SEE is isolated from the provider's controlling domain and OS. The nested structure allows the provider to maintain overall system control and resource management capabilities while the innermost secure enclave provides customer-controlled protection for sensitive data. This nesting resolves the contradiction by enabling resource utilization through the outer layers while protecting sensitive operations in the innermost layer.
Solution Approach 2:
The system implements asymmetric access rights where the computing resource service provider has full access to manage infrastructure and allocate resources, but deliberately restricted access to the secure execution environment's sensitive data and keys. Customers gain asymmetric control over their encrypted data within the SEE, with the ability to perform cryptographic operations without the provider being able to observe or access the plaintext. This asymmetric permission model resolves the contradiction between provider resource management needs and customer data security requirements.
Data Source
AI summary
Techniques for operating web services within secure execution environments running within computing resource service provider environments are described herein. A web service provides an application that can be instantiated within a secure execution environment associated with a customer computer system that is hosted by a computing resource service provider and programmatically managed by the customer and the customer computer system provides validation of the secure execution environment. Web service requests from the customer computer system are received by the web service application hosted within the secure execution environment. As the one or more web service requests are received by the web service within the secure execution environment, the requests are fulfilled by executing instructions associated with the web service within the secure execution environment.