Automated recovery of far edge computing infrastructure in a 5G network

A computing device, comprising:

• at least one processor that supports a secure execution environment;
• at least one security monitor configured for runtime introspection of a runtime state of the computing device;
• hardware-protected System Management Random Access Memory (SMRAM) that is configured for use by the at least one processor to store code associated with a System Management Mode (SMM);
• at least one non-transitory computer-readable storage device storing computer-executable instructions thereon and further storing code for an operating system (OS) thereon;
• and
• an isolated read-only partition of the at least one non-transitory computer-readable storage device storing a recovery OS thereon,
• wherein the instructions, when executed by the least one processor, cause the computing device to
• execute a trusted Unified Extensible Firmware Interface (UEFI) providing a runtime that executes System Management Mode (SMM) code;
• execute the SMM code to instantiate a System Management Interrupt (SMI) handler that executes on the computing device to cause the computing device to reboot and be re-imaged from a trusted recovery operating system (OS);
• initialize a UEFI enclave in the UEFI runtime as a pre-boot process on the computing device;
• configure an untrusted OS to initialize a deferral ticket minting enclave as a post-boot process on the computing device, in which the UEFI enclave and the deferral ticket minting enclave share a common enclave author, and in which the deferral ticket minting enclave is configured for minting a deferral ticket, wherein presence of the deferral ticket causes the SMI handler to defer the reboot and re-imaging of the computing device;
• and
• utilize an enclave versioning support protocol by which enclaves having a common author are each enabled to provision a common symmetric key to provide cryptographic security for the deferral ticket.

One or more non-transitory computer-readable memory devices storing computer-executable instructions which, upon execution by one or more processors disposed in a computing device deployed in a 5G (fifth generation) network, cause the computing device to:

• provide for System Management Mode (SMM) in the one or more processors to execute a System Management Interrupt (SMI) handler, the SMI handler having default behavior that re-images the computing device to a known good state, in which the SMM is executed in a runtime of a trusted Unified Extensible Firmware Interface (UEFI), wherein a UEFI enclave is initiated in the UEFI runtime;
• provide a secure channel between the SMI handler and a deferral ticket minting process that is hosted in a secure enclave on the computing device, in which the secure channel is cryptographically protected using a symmetric key that is commonly shared by the SMI handler and the deferral ticket minting process in the enclave;
• configure the ticket minting process for writing a deferral ticket to the secure channel in response to a determination by the deferral ticket minting process that a runtime state of the computing device adheres to a policy;
• operate the SMI handler to defer the re-imaging of the computing device responsive to a deferral ticket being present in the secure channel;
• and
• utilize an SGX (Software Guard Extension) versioning protocol that enables provisioning of the common symmetric key to each of the UEFI enclave and the secure enclave hosting the deferral ticket minting process, wherein the UEFI enclave and the secure enclave hosting the deferral ticket minting process are enabled to provision the common symmetric key under the SGX versioning protocol by virtue of sharing a common author.