Trusted Execution Platform Integration for Function-Based Service Framework
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrating trusted execution platforms into Function-as-a-Service (FaaS) computing paradigms is challenging due to FaaS's ephemeral and elastic nature, leading to performance degradation, increased costs, and security vulnerabilities such as sensitive information leakage and prolonged attestation processes.
Innovation Solution
A function-based service framework is integrated with a trusted execution platform, where applications are split into trusted and untrusted parts, with only security-sensitive functions executed within secure containers, utilizing an attestation delegator to optimize attestation and minimize the Trusted Computing Base, thereby reducing resource waste and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all functions are executed within secure containers in a trusted execution platform, then security is improved, but performance degrades and costs increase
Solution Approach 1:
The application is divided into trusted and untrusted functions. Only security-sensitive functions are executed within secure containers in the trusted execution environment, while non-sensitive functions run outside the enclave. This segmentation allows the system to maintain security for critical operations while avoiding the performance overhead and cost penalties of executing all code within the secure environment.
2Reliability
If attestation is performed for each function execution request, then security is ensured, but attestation latency increases
Solution Approach 1:
Attestation is performed in advance during container initialization rather than at the time of each function execution request. The attestation delegator establishes trust credentials beforehand, allowing subsequent function invocations to proceed without repeated attestation overhead. This preliminary action reduces latency while maintaining security assurance.
Solution Approach 2:
An attestation delegator is introduced as an intermediary component that handles attestation operations. The delegator manages trust credentials and coordinates attestation between the secure containers and the FaaS platform, streamlining the attestation process and reducing latency for function execution requests.
3Reliability
If the entire application is placed in secure containers, then security is improved, but computational costs increase
Solution Approach 1:
Different quality levels of security are applied to different parts of the application. Security-critical functions execute within secure containers with full trusted execution protections, while non-critical functions execute in standard environments without the overhead of enclave execution. This local differentiation optimizes the balance between security and computational cost.
Data Source
AI summary
Techniques for integrating a trusted execution platform with a function-based service framework are disclosed. For example, a method obtains an application program comprising a first set of one or more functions for execution within a secure execution area of a function-based service framework and a second set of one or more functions for execution within a non-secure execution area of the function-based service framework. A client attests an attestation delegator and the attestation delegator attests one or more secure containers prior to receipt of a function execution request to execute a function in the function-based service framework.