Secure Mobile Edge Computing Ecosystem with TEE and SPX
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The integration of edge computing in mobile-cloud and IoT systems faces challenges due to resource constraints and the need for secure end-to-end encryption, as existing solutions like homomorphic encryption and trusted execution environments (TEEs) are inefficient and vulnerable to attacks such as TOCTTOU and cuckoo attacks.
Innovation Solution
The implementation of a secure mobile edge computing ecosystem that employs a trusted execution environment (TEE) with remote attestation and secured protocol extensions (SPX) to establish an OS-agnostic secure communication channel, ensuring data integrity and confidentiality by encrypting data within the edge function and using attestation-bound handshakes to maintain end-to-end encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption is used to secure edge computing, then data confidentiality is improved, but performance overhead increases substantially
Solution Approach 1:
The patent extracts the encryption operations from the main execution path and performs them within a trusted execution environment (TEE). By isolating cryptographic operations in a separate secure enclave, the system maintains data confidentiality without burdening the entire edge computing platform with homomorphic encryption overhead, thus resolving the contradiction between security and performance.
Solution Approach 2:
The TEE acts as an intermediary between the untrusted edge infrastructure and the confidential data/operations. It provides a trusted mediation layer that enables secure computation without requiring full homomorphic encryption, thereby achieving data confidentiality with minimal performance impact.
2Reliability
If TEE with remote attestation is used to secure edge functions, then trustworthiness is improved, but vulnerability to TOCTTOU and cuckoo attacks increases
Solution Approach 1:
The patent performs remote attestation and binding operations before establishing communication channels. By verifying the TEE's integrity and binding it to the communication protocol in advance, the system prevents TOCTTOU attacks where timing differences could be exploited. This preliminary securing action eliminates the vulnerability window.
Solution Approach 2:
The patent merges the TEE attestation process with the communication channel establishment process. By combining these previously separate operations into a unified atomic transaction, the system prevents cuckoo attacks where an attacker could substitute a different TEE instance. The merged process ensures that the same TEE that is attested is the one used for communication.
3Reliability
If end-to-end encryption is maintained in edge computing, then security is improved, but the edge function cannot access and process encrypted traffic
Solution Approach 1:
The patent segments the encryption/decryption operations from the main data processing flow by performing them within the TEE. The TEE handles cryptographic operations on encrypted traffic without exposing the decryption keys or plaintext to the untrusted edge infrastructure, thus maintaining end-to-end security while enabling the edge function to process the data.
Solution Approach 2:
The patent applies different security properties to different parts of the system: the TEE maintains strong encryption and confidentiality properties, while the untrusted edge infrastructure operates with limited access. This local differentiation of security qualities allows the edge function to access and process encrypted traffic within the secure boundary of the TEE without compromising overall security.
4Adaptability or versatility
If multiple tenant EFs are hosted on edge infrastructure, then versatility is improved, but security isolation between tenants deteriorates
Solution Approach 1:
The patent adds a new dimensional layer of isolation by implementing TEEs for each tenant or application. Instead of relying on traditional virtualization boundaries, the system creates separate trusted execution dimensions where each tenant's data and operations are isolated in their own secure enclave. This dimensional separation enables multi-tenant versatility while maintaining strong security isolation between tenants.
Data Source
AI summary
The disclosed technology may include systems and methods that provide a secure mobile edge computing eco-system employing end-to-end encrypted communication and edge functions capable of withstanding compromised operating systems. A secure mobile edge computing eco-system may include a use, an edge, and a backend. The backend may upload functionality to the backend onto secure edge functions (EFs). The functionality may be used to respond to user request at the edge in order to reduce bandwidth requirements and latency effects on a system. The secure edge functions (EFs) employing trusted execution environments (TEEs) to provide for secure execution and storage of functionality uploaded by the backend. The secure mobile edge computing eco-system may also include secure protocol extensions (SPX) for ensuring end-to-end encryption of user requests from the user to the backend and through the edge.