Decentralized TEE Policy for Secure Workload Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for secure sharing of trusted execution environments (TEEs) among independent workloads in computing systems face security vulnerabilities, particularly with existing approaches like Kata Confidential Container (Kata CC), which lack adequate attestation to container identities and allow compromised containers to compromise all instances sharing the same transport layer security (TLS) certificate, leading to potential eavesdropping and tampering.
Innovation Solution
Implementing decentralized launch policies with a workload file format that binds workload code/data with its launch policy and attributes, using measurement registers to attest to the initial state and identities of workloads, and enforcing launch policies to ensure only compatible workloads can be loaded, thereby enhancing security and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple independent workloads are run in a single TVM for better resource utilization, then resource utilization improves, but security vulnerabilities increase due to lack of cryptographic isolation between workloads
Solution Approach 1:
The patent segments the TVM into multiple isolated workload environments, each with its own cryptographic identity and launch policy. This segmentation allows multiple workloads to share the TVM while maintaining cryptographic isolation through individual measurement registers and policy enforcement for each workload.
Solution Approach 2:
The patent introduces an intermediary launch policy mechanism that mediates between workloads and the TVM environment. This intermediary enforces cryptographic isolation by validating each workload's identity and compatibility before allowing it to execute, preventing direct interaction that could compromise security.
2Reliability
If workload validation and policy evaluation are performed for each new workload, then security is improved, but system complexity increases
Solution Approach 1:
The patent performs preliminary validation and policy evaluation actions before workloads are allowed to execute in the TVM. By pre-establishing cryptographic identities, measurement registers, and launch policies for each workload beforehand, the system ensures security requirements are met while streamlining the execution process.
3Reliability
If cryptographic isolation is implemented between workloads in a TVM, then security is improved, but performance overhead increases due to inter-workload communication
Solution Approach 1:
The patent applies local quality by providing cryptographic isolation only where necessary between workloads, while allowing optimized communication paths for workloads that require interaction. Each workload receives individualized security treatment through its own measurement register and launch policy, rather than uniform isolation across all workloads.
Data Source
AI summary
A computing system to receive a new workload by a trusted execution environment virtual machine (TVM); validate the new workload; in response to the new workload being successfully validated, evaluate a launch policy of the new workload against one or more launch policies of one or more existing workloads of the TVM; and in response to the launch policy of the new workload being successfully validated, load the new workload into the TVM.