Trusted Execution Workload Control With Multi-Entity Constraint Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing confidential computing approaches face challenges in securely managing workloads across multiple entities, leading to potential security risks and data leakage due to uncompromised components, especially when constraints from different entities are not consistently enforced.
Innovation Solution
A confidential computing control service that generates an execution requirement by integrating constraints from multiple entities, ensuring compliance and resolving conflicts, while providing attestation records to verify adherence to these constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If confidential computing isolates sensitive data in protected CPU enclaves, then data security during processing is improved, but verification of constraint compliance across multiple entities becomes difficult
Solution Approach 1:
The patent introduces an execution requirement as an intermediary document that mediates between multiple entities' constraints and the trusted execution environment. This execution requirement consolidates constraints from multiple entities into a single verifiable format, simplifying the verification process while maintaining data security within the enclave.
Solution Approach 2:
The patent implements an attestation mechanism that provides feedback to entities about constraint compliance. The trusted execution environment generates attestation records that verify whether constraints are being met, allowing entities to receive confirmation of compliance without compromising the security of data inside the enclave.
2Reliability
If constraints from multiple entities are enforced, then security and compliance are improved, but conflict resolution and execution requirement generation become more complex
Solution Approach 1:
The patent merges multiple constraints from different entities into a single execution requirement document. This consolidation process combines disparate constraints into a unified format that can be systematically processed and verified, reducing the complexity of managing multiple separate constraint sets.
Solution Approach 2:
The patent performs preliminary conflict detection and resolution during the execution requirement generation phase, before the workload is executed. By identifying and resolving constraint conflicts in advance, the system avoids complexity during runtime and ensures compliance is established upfront.
3Measurement precision
If attestation records include constraint identifiers, then verification accuracy is improved, but the size and processing overhead of attestation records increase
Solution Approach 1:
The patent extracts only the essential constraint identifiers into the attestation records, rather than including complete constraint definitions or full verification data. This extraction approach maintains verification accuracy by including sufficient identifying information while minimizing the size and processing overhead of the attestation records.
Data Source
AI summary
A method, system, and computer program product receive constraints for execution of a workload on one or more trusted execution environments from a plurality of entities. The constraints form a constraint space. An execution requirement for controlling the trusted execution environment(s) using the constraints is automatically generated. The execution requirement defines parameters for executing the workload in compliance with the constraints. The automatically generating includes adding identifiers of the constraints to the execution requirement for an attestation of constraints being complied with by the trusted execution environment(s) when executing the workload in compliance with the execution requirement. The trusted execution environment(s) are controlled in compliance with the execution requirement. The controlling includes providing the execution requirement to the trusted execution environment(s), which enables the trusted execution environment(s) to provide one or more attestation records for an attestation of the execution. The attestation records include the identifiers.