Secure key management for service mesh deployments

A device providing a service host of a service mesh, the service host comprising:

• network communication circuitry;
• secure storage to provide a secure enclave;
• processing circuitry;
• and
• a storage medium including instructions embodied thereon, wherein the instructions, which when executed by the processing circuitry, cause the processing circuitry to:
• receive a private key at the service host, via the network communication circuitry, the private key generated according to a confidential computing technology;
• store the private key in the secure enclave, the secure enclave operated according to the confidential computing technology;
• access the private key within the secure enclave of the secure storage, for use in establishing a secure transport session within the service mesh;
• and
• perform communications between the service host and another entity within the service mesh, in the secure transport session via the network communication circuitry, based on use of the private key in the secure enclave to sign one or more keys for the secure transport session.

A method for operating a service host in a service mesh, the method comprising:

• receiving a private key at the service host, the private key generated according to a confidential computing technology;
• maintaining the private key in a secure enclave accessible to the service host, the secure enclave operated according to the confidential computing technology;
• accessing the private key within the secure enclave, for use in establishing a secure transport session within the service mesh;
• and
• performing communications between the service host and another entity within the service mesh, via the secure transport session, based on use of the private key in the secure enclave to sign one or more keys for the secure transport session.

At least one machine-readable storage device comprising instructions stored thereupon, which when executed by processing circuitry of a service mesh computing system, cause the processing circuitry to operate a service host in a service mesh, with operations to:

• receive a private key at the service host, the private key generated according to a confidential computing technology;
• store the private key in a secure enclave, the secure enclave operated according to the confidential computing technology;
• access the private key within the secure enclave, for use in establishing a secure transport session within the service mesh;
• and
• perform communications between the service host and another entity within the service mesh, in the secure transport session, based on use of the private key in the secure enclave to sign one or more keys for the secure transport session.