Trusted-Code Requests via Policy Attestations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring the security of computing resources and data in complex network configurations is challenging, particularly as the size and complexity of these configurations grow, with malicious behavior often involving unauthorized executable code.
Innovation Solution
A service provider computer system enables users to programmatically manage policies that enforce access to resources based on the state of a computing environment, using attestations from cryptographic modules to verify compliance with requirements such as approved applications and unmodified states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If distributed computing resources are configured across multiple networks and geographic boundaries, then service robustness and accessibility are improved, but security management complexity increases
Solution Approach 1:
A policy service acts as an intermediary between computing devices and distributed resources, receiving requests, evaluating them against stored policies, and determining access authorization. This mediator approach simplifies security management by centralizing policy evaluation while allowing distributed resource access, directly addressing the contradiction between service accessibility and security management complexity.
2Ease of manufacture
If remote networks are configured using hardware managed by other organizations, then infrastructure costs are reduced, but security control and monitoring become more difficult
Solution Approach 1:
The policy service implements feedback mechanisms by receiving attestation information from computing devices, evaluating it against policies, and returning access decisions. This continuous feedback loop enables security monitoring and control over remotely managed hardware, allowing organizations to maintain security oversight while using cost-effective third-party infrastructure.
3Reliability
If access control policies are enforced across distributed systems, then security is improved, but request processing time increases
Solution Approach 1:
Policies are pre-configured and stored in the policy service before access requests occur. Attestation criteria and access rules are established in advance, allowing the policy service to quickly evaluate incoming requests against predetermined policies rather than making security decisions in real-time, thus reducing request processing time while maintaining security.
Data Source
AI summary
Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.