Trusted Execution in Service Meshes Without Sidecar Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional service meshes rely on resource-intensive sidecar proxies for security, which introduce complexity, performance bottlenecks, and limited efficacy, especially when handling third-party APIs and disk operations, failing to provide comprehensive distributed data security.
Innovation Solution
Integrate security functions within a trusted execution environment (TEE) of applications, executing security functions and generating cryptographic proofs to establish verifiable data lineage, eliminating the need for sidecar proxies and enhancing security across the service mesh.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sidecar proxies are used for security functions, then security is provided, but resource consumption increases and complexity increases
Solution Approach 1:
The patent extracts security functions from sidecar proxies and relocates them into the application code itself. This is achieved through just-in-time compilation of security policies into native code that runs within the application process, eliminating the need for separate sidecar proxy processes and reducing resource consumption while maintaining security functionality.
Solution Approach 2:
The patent merges security functions directly into the application execution flow by compiling security policies into the application's native code. This consolidation eliminates the architectural separation between application and security enforcement, reducing complexity and resource overhead while ensuring security is an integral part of application execution.
2Reliability
If sidecar proxies are used for security functions, then security is provided, but device complexity increases
Solution Approach 1:
The patent extracts security enforcement from external sidecar proxies and embeds it directly into the application binary through just-in-time compilation. This eliminates the need for managing separate proxy processes, service mesh infrastructure, and associated configuration complexity, while maintaining comprehensive security coverage.
Solution Approach 2:
The patent creates a universal security enforcement mechanism that is compiled directly into applications, making security a built-in capability rather than an external add-on. This approach works across different application types and runtime environments without requiring separate proxy infrastructure, reducing overall system complexity.
3Reliability
If sidecar proxies are used for security functions, then inter-service communication security is improved, but security for third-party APIs and disk operations is not achieved
Solution Approach 1:
The patent creates a universal security enforcement mechanism through just-in-time compilation that can handle multiple types of operations within a single unified framework. The compiled security policies can enforce restrictions on inter-service communications, third-party API calls, and disk operations, providing comprehensive security coverage across all application data access points without requiring separate security mechanisms for each operation type.
Data Source
AI summary
In one implementation, a method is disclosed comprising: associating, by a device in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh; executing, by the device, the security function and the portion of the online application within a trusted execution environment of the device to produce output data; generating, by the device, a cryptographic proof for the output data based on the security function; and providing, by the device, the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.