Low latency launch for trusted execution environments
AssigneeRed Hat, Inc.
InventorMichael Tsirkin
Life of this patent
Estimating the term…
Abstract
A system includes an application trusted execution environment (“TEE”) instance and an escrow TEE instance. The escrow TEE instance is hosted along with the application TEE instance and is outside the control of a TEE instance owner. The system also includes a server, which is configured to receive a request to start the application TEE instance. The server is also configured to launch the escrow TEE instance. The escrow TEE instance is validated by the TEE instance owner. Additionally, the escrow TEE instance is configured to obtain a key for the application TEE instance, validate the application TEE instance, and provide the key to the application TEE instance.
Claims20
A system comprising:
- an application trusted execution environment (“TEE”) instance;
- an escrow TEE instance that is hosted alongside the application TEE instance and outside the control of a TEE instance owner;
- and
- a server configured to:
- receive a request to start the application TEE instance, and
- launch the escrow TEE instance, wherein the escrow TEE instance is validated by the TEE instance owner,
- wherein the escrow TEE instance is configured to:
- obtain a key for the application TEE instance,
- validate the application TEE instance, and
- provide the key to the application TEE instance.
A method comprising:
- receiving, by a server, a request to start an application TEE instance;
- launching, by the server, an escrow TEE instance that is outside the control of a TEE instance owner, wherein the escrow TEE instance is validated by the TEE instance owner;
- obtaining, by the escrow TEE instance, a key for the application TEE instance;
- validating, by the escrow TEE instance, the application TEE instance;
- and
- providing, by the escrow TEE instance, the key to the application TEE instance.
A non-transitory machine-readable medium storing code, which when executed by a processor is configured to:
- receive a request to start an application TEE instance;
- launch an escrow TEE instance that is outside the control of a TEE instance owner, wherein the escrow TEE instance is validated by the TEE instance owner;
- obtain a key for the application TEE instance;
- validate the application TEE instance;
- and
- provide the key to the application TEE instance.
Dependencies are inferred from the claim text.