TEE Agent Overlaying Encrypted Disk Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Confidential computing technologies, such as Trusted Execution Environments (TEEs), face challenges in sharing container disk images due to encryption, which breaks confidentiality and limits resource utilization in cluster computing environments.
Innovation Solution
Implementing dedicated agents within TEEs to initialize containers by generating cryptographic keys, encrypting empty disk images, and overlaying them with pre-encrypted container disk images, allowing secure sharing while maintaining confidentiality through hardware-based encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If container disk images are encrypted in TEEs to maintain confidentiality, then security is improved, but the ability to share disk images across multiple containers is broken
Solution Approach 1:
The disk image is divided into two separate components: a read-only base image that is encrypted and shared across multiple containers, and a writable overlay layer that is unique to each container. This segmentation allows the encrypted base image to be efficiently shared while maintaining container isolation through the separate overlay layer.
Solution Approach 2:
The writable overlay layer is nested on top of the encrypted base image, creating a layered structure where the base image provides shared encrypted storage and the overlay provides container-specific writable space. This nested structure enables both sharing and isolation simultaneously.
2Adaptability or versatility
If dedicated agents are added to TEEs to manage encrypted disk images, then disk image sharing is enabled, but device complexity increases
Solution Approach 1:
The agent is designed as a universal component that can be deployed across different TEEs and container platforms. It handles multiple functions including encryption key management, overlay layer creation, and disk image sharing, reducing the need for multiple specialized components.
Solution Approach 2:
The agent acts as an intermediary between the container engine and the TEE hardware, abstracting the complexity of encrypted storage and overlay management. This mediator approach allows the container engine to interact with encrypted disk images without directly managing the underlying cryptographic operations.
3Reliability
If overlay layers are created for each container, then container isolation is maintained, but storage space utilization decreases
Solution Approach 1:
Multiple containers share the same encrypted base image through the overlay mechanism, merging their storage requirements into a single shared component. This reduces redundant storage of the base image across multiple containers while maintaining isolation through the overlay layers.
Solution Approach 2:
The writable overlay layer is discarded after the container terminates, and only the encrypted base image is retained for future use. This recovering mechanism ensures that storage space is not wasted on temporary container data while preserving the valuable encrypted base image for reuse.
Data Source
AI summary
The technology disclosed herein enables enhancing trusted execution environments with dedicated agents configured to initialize containers. An example method includes identifying, by an agent running in a trusted execution environment, an encrypted first disk image including data associated with an executable container. The agent may store an empty second disk image. The agent may further encrypt, using one or more keys generated by the agent, the second disk image and create a file system on the encrypted second disk image. The agent may further decrypt the encrypted first disk image and generate an overlay between the decrypted first disk image and the encrypted second disk image.