Secure heartbeat monitoring

A method comprising:

• receiving, by a computing device, a monitoring message from an application that performs operations within a first secure enclave, the monitoring message comprising a message payload and a monitoring message signature,
• wherein the message payload comprises monitoring data of the application, an application identity of the application, and a remote attestation signature that was provided by a node agent that operates within a second secure enclave, wherein the monitoring data includes an application public key generated by the application, and wherein the monitoring message signature is based on the message payload and an application private key generated by the application;
• determining, by the computing device, whether the monitoring message is valid according to the monitoring message signature and the application public key included in the monitoring data;
• and
• in response to determining that the monitoring message is valid, performing, by the computing device, one or more actions based on the monitoring data.

A system comprising:

• a memory;
• and
• a processing device, operatively coupled with the memory, to:
• identify, at a first secure enclave, application monitoring data from an application that performs operations within the first secure enclave;
• generate, at the first secure enclave, using local attestation operations, a first message authentication code based on a combination of the monitoring data, an application identity associated with the application, and a secure local attestation key;
• send, at the first secure enclave, the first message authentication code, the monitoring data, and the application identity to a second secure enclave;
• receive, from the second secure enclave, a remote attestation signature that is based at least on the monitoring data and the application identity;
• generate, at the first secure enclave, a monitoring message signature based on a message payload and an application private key, wherein the message payload comprises the monitoring data, the application identity, and the remote attestation signature;
• and
• send, from the first secure enclave, a monitoring message to a monitoring system, wherein the monitoring message comprises the message payload and the monitoring message signature.

A non-transitory machine-readable storage medium storing instructions that cause a processing device to perform operations comprising:

• identifying, at a first secure enclave of a processing device, application monitoring data from an application that performs operations within the first secure enclave;
• generating, at the first secure enclave, using local attestation operations, a first message authentication code based on a combination of the monitoring data, an application identity associated with the application, and a secure local attestation key;
• sending, at the first secure enclave, the first message authentication code, the monitoring data, and the application identity to a second secure enclave;
• receiving, from the second secure enclave, a remote attestation signature that is based at least on the monitoring data and the application identity;
• generating, at the first secure enclave, a monitoring message signature based on a message payload and an application private key, wherein the message payload comprises the monitoring data, the application identity, and the remote attestation signature;
• and
• sending, from the first secure enclave, a monitoring message to a monitoring system, wherein the monitoring message comprises the message payload and the monitoring message signature.