TEE Library OS Overlay for Unmodified Container Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrating application workloads with non-virtual machine-based hardware Trusted Execution Environments (TEEs) is complex, requiring modifications and image rebuilds, which increases complexity and extraneous dependencies, making it difficult to deploy applications securely in confidential computing environments.
Innovation Solution
The solution involves using a TEE Library OS layer with overlay file systems to allow unmodified application images to run in non-VM-based hardware TEEs, reducing the need for image rebuilds and extraneous dependencies, and providing a secure environment for confidential computing without modifying the original application code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application images are modified to adapt to TEE protection, then security is improved, but device complexity and ease of manufacture deteriorate
Solution Approach 1:
The patent introduces a TEE library OS layer as an intermediary between the application image and the hardware TEE. This library OS provides the necessary TEE-specific functionality and interfaces, allowing unmodified application images to run securely in the TEE environment without requiring direct modifications to the application code, thus maintaining security while reducing complexity
Solution Approach 2:
The patent segments the TEE execution environment into distinct layers: the hardware TEE layer, the TEE library OS layer, and the application layer. This segmentation allows each layer to operate independently with well-defined interfaces, enabling unmodified application images to be deployed without increasing overall system complexity
2Reliability
If application images are rebuilt for TEE compatibility, then security is improved, but loss of time and productivity deteriorate
Solution Approach 1:
The TEE library OS layer is prepared in advance with all necessary TEE-specific libraries, interfaces, and configuration files. This preliminary preparation eliminates the need for time-consuming image rebuilds during deployment, as the library OS is already configured to work with standard application images in the TEE environment
Solution Approach 2:
The library OS acts as a pre-configured intermediary that handles all TEE-specific requirements, allowing application images to be deployed without modification and significantly reducing deployment time while maintaining security
3Ease of operation
If overlay file systems are used with TEE library OS, then ease of operation is improved, but storage overhead increases
Solution Approach 1:
The patent merges the TEE library OS file system with the application image file system using overlay technology. This allows the library OS files and application files to coexist in a unified view, simplifying deployment operations while managing storage efficiently through shared underlying storage infrastructure
Data Source
AI summary
Operations are described for executing application images in a trusted execution environment (TEE). These operations can include retrieving a user application image and generating a bundle for the application image by mounting an overlay onto the application image. The overlay can include library functionality for operating in the TEE. The operations can further include providing the bundle for execution in the TEE.