# US 12,113,902 B2 · Scalable attestation for trusted execution environments

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,902 B2
- Document ID: US12113902B2
- Status: Granted
- Kind: B2
- Application number: 17/131,684
- Filed: 2020-12-22
- Published: 2021-04-15
- Granted: 2024-10-08
- Earliest claimed: 2020-12-22
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Anjo Lucas Vahldiek-Oberwagner; Ravi L. Sahita; Mona Vij; Dayeol Lee; Haidong Xia; Rameshkumar Illikkal; Samuel Ortiz; Kshitij Arun Doshi; Mourad Cherfaoui; Andrzej Kuriata; Teck Joo Goh
- Web page: https://patentgrep.com/patent/US12113902B2

## CPC

- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/321: {involving a third party or a trusted authority}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In function-as-a-service (FaaS) environments, a client makes use of a function executing within a trusted execution environment (TEE) on a FaaS server. Multiple tenants of the FaaS platform may provide functions to be executed by the FaaS platform via a gateway. Each tenant may provide code and data for any number of functions to be executed within any number of TEEs on the FaaS platform and accessed via the gateway. Additionally, each tenant may provide code and data for a single surrogate attester TEE. The client devices of the tenant use the surrogate attester TEE to attest each of the other TEEs of the tenant and establish trust with the functions in those TEEs. Once the functions have been attested, the client devices have confidence that the other TEEs of the tenant are running on the same platform as the gateway.

## Claims

### Claim 1

A system comprising:
at least one processor;
a network interface operatively coupled to the processor; and
a memory coupled to the processor to store instructions that, when executed by the processor, cause the at least one processor to perform operations comprising:
creating a first trusted execution environment (TEE) for a first function, the first function to produce first processing results for a tenant;
creating a second TEE for a second function, the second function to produce second processing results for the tenant;
configuring a gateway to provide remote access from a client device to the first function;
receiving, from the client device and via the network interface, a request to verify integrity of the second TEE; and
in response to the request:
generating attestation data for the second TEE;
evaluating the attestation data with a surrogate attester to perform validation the second TEE; and
in response to the validation of the second TEE, configuring the gateway to provide remote access from the client device to the second function via the network interface.

### Claim 2 (depends on 1)

The system of claim 1, wherein the generating of the attestation data for the second TEE comprises:
generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and
verifying the signed structure using the surrogate attester.

### Claim 3 (depends on 1)

The system of claim 1, wherein the operations further comprise:
receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and
in response to the function call:
executing the second function to generate a return value; and
providing the return value to the client device via the network interface.

### Claim 4 (depends on 3)

The system of claim 3, wherein the operations further comprise:
in response to the function call, requesting, by the second function, access to data of the first TEE, wherein the access to the data of the first TEE is limited based on validation of the second TEE by the surrogate attester.

### Claim 5 (depends on 4)

The system of claim 4, wherein the operations further comprise:
determining, by the first function, that the second function has been verified by the surrogate attester; and
in response to the request by the second function for access to the data of the first TEE, based on the determination that the second TEE has been verified by the surrogate attester, providing the requested access to the data.

### Claim 6 (depends on 5)

The system of claim 5, wherein the providing of the requested access to the data comprises:
encrypting the data using an ephemeral key; and
providing access to the ephemeral key to the second function.

### Claim 7 (depends on 1)

The system of claim 1, wherein the operations further comprise:
before receiving the request to verify the integrity of the second TEE, receive a second request to verify the integrity of the first TEE.

### Claim 8 (depends on 1)

The system of claim 1, wherein the gateway is not verified by the client device.

### Claim 9 (depends on 1)

The system of claim 1, wherein:
the gateway provides remote access to a third function of a third TEE, the third function to produce third processing results for the tenant; and
the first function is unable to verify integrity of the third TEE.

### Claim 10 (depends on 9)

The system of claim 9, wherein the operations further comprise:
creating a fourth TEE for a fourth function, the fourth function to produce fourth processing results for another tenant; and
receiving a second function call to the fourth function from a second client device and via the network interface, the second function call to cause another surrogate attester to verify the integrity of the third TEE.

### Claim 11

A method comprising:
creating, by a processor, a first trusted execution environment (TEE) for a first function, the first function to produce first processing results for a tenant;
creating, by the processor, a second TEE for a second function, the second function to produce second processing results for the tenant;
configuring, by the processor, a gateway to provide remote access from a client device to the first function;
receiving, from a client device and via a network interface, a request to verify integrity of the second TEE;
in response to the request:
generating attestation data for the second TEE;
evaluating the attestation data with a surrogate attester to perform validation of the second TEE; and
in response to the validation of the second TEE, configuring the gateway to provide remote access from the client device to the second function via the network interface.

### Claim 12 (depends on 11)

The method of claim 11, wherein the generating of the attestation data for the second function comprises:
generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and
verifying, by the processor, the signed structure using the surrogate attester.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and
in response to the function call:
executing, by the processor, the second function to generate a return value; and
providing the return value to the client device via the network interface.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
in response to the function call, requesting, by the second function, access to data of the first TEE.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
determining, by the first function, that the second function has been verified; and
in response to the request by the second function for access to the data of the first TEE, based on the determination that the second function has been verified, providing the requested access to the data, wherein the access to the data of the first TEE is limited based on validation of the second TEE by the surrogate attester.

### Claim 16

A non-transitory computer readable medium that stores instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:
creating a first trusted execution environment (TEE) for a first function, the first function to produce first processing results for a tenant;
creating a second TEE for a second function, the second function to produce second processing results for the tenant;
configuring a gateway to provide remote access from a client device to the first function;
receiving, from the client device and via a network interface, a request to verify integrity of the second TEE; and
in response to the request:
generating attestation data for the second TEE;
evaluating the attestation data with a surrogate attester to perform validation of the second TEE; and
in response to the validation of the second TEE, configuring the gateway to provide remote access from the client device to the second function via the network interface.

### Claim 17 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the generating of the attestation data for the second function comprises:
generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and
verifying the signed structure using the surrogate attester.

### Claim 18 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the operations further comprise:
receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and
in response to the function call:
executing the second function to generate a return value; and
providing the return value to the client device via the network interface.

### Claim 19 (depends on 18)

The non-transitory computer readable medium of claim 18, wherein the operations further comprise:
in response to the function call, requesting, by the second function, access to data of the first TEE.

### Claim 20 (depends on 19)

The non-transitory computer readable medium of claim 19, wherein the operations further comprise:
determining, by the first function, that the second function has been verified; and
in response to the request by the first function for access to the data of the first TEE, based on the determination that the second function has been verified, providing the requested access to the data, wherein the access to the data of the first TEE is limited based on validation of the second TEE by the surrogate attester.

### Claim 21 (depends on 20)

The non-transitory computer readable medium of claim 20, wherein the providing of the requested access to the data comprises:
encrypting the data using an ephemeral key; and
providing access to the ephemeral key to the second function.

### Claim 22 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the operations further comprise:
before receiving the request to verify the integrity of the second TEE, receiving a second request to verify the integrity of the first TEE.

### Claim 23 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the gateway is not verified by the client device.

### Claim 24 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein:
the gateway provides remote access to a third function of a third TEE, the third function to produce third processing results for the tenant; and
the first function is unable to verify the integrity of the third TEE.

### Claim 25 (depends on 24)

The non-transitory computer readable medium of claim 24, wherein the operations further comprise:
creating, by the at least one processor, a fourth TEE for a fourth function, the fourth function to produce fourth processing results for another tenant; and
receiving a third function call to the fourth function, from a second client device and via the network interface, the third function call cause another surrogate attester to verify the integrity of the third TEE.