Split Host-Tenant Credentials for Confidential VM Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In confidential cloud computing systems, existing credential models are insufficient for securely restricting access to live container data, as they rely on hosts that are not trusted, potentially exposing tenant data to the host infrastructure, and existing solutions like running the entire cluster inside confidential guests consume precious resources or limit access to important functionalities.
Innovation Solution
A split security model between host and tenant provides a separate, cryptographically secure access channel using tenant-specific secrets, allowing secure access to cluster commands without exposing data as cleartext to the host, achieved through automatic splitting of API commands and separate tenant interfaces for confidential VMs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If existing credential models are used for accessing confidential VMs, then access to cluster commands is enabled, but tenant data is exposed to the host infrastructure
Solution Approach 1:
The credential model is segmented into two distinct credential sets: host cluster credentials for host-level operations and tenant cluster credentials for tenant-specific confidential operations. This segmentation allows the system to provide appropriate access rights while preventing cross-contamination of trust boundaries, thereby enabling command access without exposing tenant data to the host infrastructure.
Solution Approach 2:
The system introduces an intermediary credential mechanism that mediates between the host infrastructure and tenant workloads. The tenant cluster credentials act as a secure intermediary that enables access to necessary cluster commands while maintaining cryptographic isolation, preventing direct exposure of tenant data to the host while still allowing required operations.
2Object-affected harmful factors
If the entire cluster is run inside confidential guests, then data confidentiality is maximized, but resource consumption increases and access to functionalities is limited
Solution Approach 1:
Instead of applying confidential computing uniformly across the entire cluster, the system applies confidentiality locally and selectively to specific tenant workloads that require it. The split credential model enables certain components to operate in confidential mode while others use traditional hosting, optimizing resource utilization while maintaining confidentiality where needed.
Solution Approach 2:
The system implements partial confidential computing by using tenant cluster credentials only for the specific operations and data that require confidentiality, rather than encrypting and isolating the entire cluster. This partial action approach reduces resource overhead while still providing adequate protection for sensitive operations.
3Object-affected harmful factors
If the entire cluster is run inside confidential guests, then data confidentiality is maximized, but access to important functionalities is limited
Solution Approach 1:
The credential system is segmented to differentiate between host-level functionalities and tenant-level functionalities. Host cluster credentials enable access to infrastructure management functions, while tenant cluster credentials enable access to workload-specific functions. This segmentation ensures that confidential operations can access necessary functionalities without requiring the entire cluster to run in confidential mode.
Solution Approach 2:
The tenant cluster credentials are designed with multi-functionality, enabling them to access both confidential tenant workloads and necessary cluster services. This universal credential design allows a single confidential credential set to handle multiple operational requirements, maintaining broad functionality access while operating within the confidential boundary.
Data Source
AI summary
Techniques for sending commands to a container agent of a confidential virtual machine (VM) are disclosed. An example method includes establishing a first network connection with a control plane of a host computing system and establishing a second network connection with a container agent of a confidential virtual machine (VM) running on the host computing system, wherein the second network connection bypasses the control plane of the host computing system. The method also includes receiving a command from a tenant user interface (UI) and processing the command to determine a command type. The method also includes based on the command type, sending by a processing device, the command to the control plane via the first network connection or to the container agent via the second network connection.