Secure Data Offload via TDXIO Trusted Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current microservice orchestration solutions face limitations in securing data offloading and communication between microservices, particularly when using hardware accelerators, as they rely on trusted host operating systems and hypervisors, which can be compromised, and existing security features like mTLS and RBAC have limitations in ensuring data confidentiality and integrity.
Innovation Solution
The implementation of Trusted Domain Extensions (TDX) and Trusted I/O (TDXIO) solutions provide a secure communication framework, leveraging multi-key total memory encryption (MKTME) and trusted execution environments (TEEs) to isolate and encrypt data across microservices, ensuring secure data offloading and communication while maintaining scalability and dynamic requirements of microservices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If trusted host operating systems and hypervisors are used for microservice orchestration, then ease of operation is improved, but security and data confidentiality deteriorate due to potential compromises
Solution Approach 1:
The system segments the trusted compute base by introducing TDX-protected domains that isolate critical security functions from the untrusted host OS and hypervisor. The microservice orchestration is divided into untrusted components (running on host OS) and trusted components (running in TDX domains), allowing ease of operation while protecting data confidentiality through architectural separation.
Solution Approach 2:
TDX domains act as an intermediary trusted layer between the untrusted host environment and the microservices requiring security. The TDXIO framework provides a mediated interface that enables secure data offload to accelerators without requiring trust in the host OS or hypervisor, thus maintaining operational ease while ensuring security.
2Reliability
If mTLS and RBAC security features are implemented, then data security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the security-critical functions (authentication, authorization, data protection) from the complex mTLS and RBAC implementation and relocates them to TDX-protected domains. This extraction simplifies the overall system by concentrating security in a manageable trusted enclave while leaving the untrusted environment simpler and easier to operate.
Solution Approach 2:
The TDX domain creates a virtual copy of the security-managed environment isolated from the untrusted host. Instead of implementing complex security throughout the entire system, the patent creates a simplified copy within the TDX domain that handles all security requirements, reducing overall device complexity while maintaining strong security.
3Productivity
If hardware accelerators are used for data offloading, then productivity is improved, but security vulnerabilities increase due to trust requirements
Solution Approach 1:
The system segments the data processing workflow into untrusted data preparation (on host CPU), trusted security verification (in TDX domain), and accelerated processing (on hardware accelerator). This segmentation enables high productivity through hardware acceleration while eliminating security vulnerabilities by removing the need to trust the host OS or hypervisor for accelerator access.
Solution Approach 2:
The TDX domain serves as an intermediary that enables secure data offload to hardware accelerators without requiring trust in the host environment. The TDXIO framework provides a secure interface between the TDX-protected microservices and the accelerators, allowing productivity improvement through hardware acceleration while blocking security vulnerabilities through cryptographic isolation.
Data Source
AI summary
An apparatus comprises a compute complex comprising one or more processing resources to execute a software process, a hardware processor to initiate an authentication request to at least one adjunct processing hardware device communicatively coupled to the compute complex, establish a session key with the at least one adjunct processing hardware device, negotiate, with a hypervisor, a virtual function allocation for at least one virtual adjunct processing device to be implemented by the at least one adjunct processing hardware device to define a configuration in a trusted page table, verify the configuration with the at least one adjunct processing hardware device using the session key, and lock the configuration in the trusted table.