US 12,113,902 B2 · Scalable attestation for trusted execution environments

Abstract

In function-as-a-service (FaaS) environments, a client makes use of a function executing within a trusted execution environment (TEE) on a FaaS server. Multiple tenants of the FaaS platform may provide functions to be executed by the FaaS platform via a gateway. Each tenant may provide code and data for any number of functions to be executed within any number of TEEs on the FaaS platform and accessed via the gateway. Additionally, each tenant may provide code and data for a single surrogate attester TEE. The client devices of the tenant use the surrogate attester TEE to attest each of the other TEEs of the tenant and establish trust with the functions in those TEEs. Once the functions have been attested, the client devices have confidence that the other TEEs of the tenant are running on the same platform as the gateway.

Claims25

Dependent claims

A system comprising:

at least one processor;
a network interface operatively coupled to the processor;
and
a memory coupled to the processor to store instructions that, when executed by the processor, cause the at least one processor to perform operations comprising:
creating a first trusted execution environment (TEE) for a first function, the first function to produce first processing results for a tenant;
creating a second TEE for a second function, the second function to produce second processing results for the tenant;
configuring a gateway to provide remote access from a client device to the first function;
receiving, from the client device and via the network interface, a request to verify integrity of the second TEE;
and
in response to the request:
generating attestation data for the second TEE;
evaluating the attestation data with a surrogate attester to perform validation the second TEE;
and
in response to the validation of the second TEE, configuring the gateway to provide remote access from the client device to the second function via the network interface.

11 more elements

A non-transitory computer readable medium that stores instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

creating a first trusted execution environment (TEE) for a first function, the first function to produce first processing results for a tenant;
creating a second TEE for a second function, the second function to produce second processing results for the tenant;
configuring a gateway to provide remote access from a client device to the first function;
receiving, from the client device and via a network interface, a request to verify integrity of the second TEE;
and
in response to the request:
generating attestation data for the second TEE;
evaluating the attestation data with a surrogate attester to perform validation of the second TEE;
and
in response to the validation of the second TEE, configuring the gateway to provide remote access from the client device to the second function via the network interface.

7 more elements

Dependencies are inferred from the claim text.

Scalable attestation for trusted execution environments

Life of this patent

Scalable attestation for trusted execution environments

Life of this patent

Abstract

Claims25