Trusted execution environment for distributed data security in the service mesh
AssigneeCisco Technology, Inc.
InventorsCharles Fleming, Ramana Rao V. R. Kompella
Life of this patent
Estimating the term…
Abstract
In one implementation, a method is disclosed comprising: associating, by a device in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh; executing, by the device, the security function and the portion of the online application within a trusted execution environment of the device to produce output data; generating, by the device, a cryptographic proof for the output data based on the security function; and providing, by the device, the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.
Claims20
A method, comprising:
- associating, by a device in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh;
- executing, by the device, the security function and the portion of the online application within a trusted execution environment of the device to produce output data;
- generating, by the device and based on the security function, a cryptographic proof for the output data comprising a remote attestation that a security policy defined for the portion of the online application was applied during an execution that produced the output data within the trusted execution environment;
- and
- providing, by the device, the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.
A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:
- associating, in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh;
- executing the security function and the portion of the online application within a trusted execution environment of a device to produce output data;
- generating, based on the security function, a cryptographic proof for the output data comprising a remote attestation that a security policy defined for the portion of the online application was applied during an execution that produced the output data within the trusted execution environment;
- and
- providing the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the one or more network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process that is executable by the processor, the process, when executed, configured to:
- associate, in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh;
- execute the security function and the portion of the online application within a trusted execution environment of a device to produce output data;
- generate, based on the security function, a cryptographic proof for the output data comprising a remote attestation that a security policy defined for the portion of the online application was applied during an execution that produced the output data within the trusted execution environment;
- and
- provide the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.
Dependencies are inferred from the claim text.