Trusted Execution Environment Logic Loader Attestation for Code Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure enclaves fail to authenticate executed service logic code, leaving sensitive information exposed to security breaches due to frameworks prone to vulnerabilities.
Innovation Solution
Implement a confidential computing framework within a trusted execution environment (TEE) that includes an attestable service loader API, enabling attestation of business logic loader code and integrity checking of service logic code during load time, ensuring secure execution and updating of business logic code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If service logic code is loaded into secure enclave without authentication, then loading speed is improved, but security is worsened due to unauthenticated code execution
Solution Approach 1:
The patent performs attestation of the logic loader code and integrity checking of service logic code before the code is loaded into the secure enclave. This preliminary authentication ensures that only verified code is loaded, resolving the contradiction by establishing security checks in advance rather than during or after loading, thus maintaining both security and loading efficiency.
2Reliability
If integrity checking is performed on service logic code, then security is improved, but loading time is worsened due to additional verification steps
Solution Approach 1:
The integrity checking is performed as a preliminary action before code loading, with attestation data generated and verified in advance. The checking process uses efficient cryptographic verification of code hashes, and the attestation mechanism is designed to minimize overhead by caching verification results and using hardware-accelerated cryptographic operations.
3Reliability
If logic loader code is protected in secure enclave, then security is improved, but code updating capability is worsened due to restricted access
Solution Approach 1:
The patent introduces an attestation mechanism as an intermediary between the secure enclave and external code sources. The attestation data serves as a mediator that verifies the authenticity of code without requiring direct access to the enclave, enabling secure code updates through verified external sources while maintaining enclave isolation and protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method according to one embodiment includes performing an attestation of code of a logic loader in a trusted execution environment (TEE) and receiving a request for the logic loader to load service logic code to the TEE. An integrity check of the service logic code associated with the request is performed. In response to the service logic code associated with the request passing the integrity check, the logic loader is allowed to load the service logic code associated with the request to the TEE. A computer program product according to another embodiment includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and/or executable by a computer to cause the computer to perform the foregoing method.