Scalable attestation for trusted execution environments

In function-as-a-service (FaaS) environments, a client makes use of a function executing within a trusted execution environment (TEE) on a FaaS server. Multiple tenants of the FaaS platform may provide functions to be executed by the FaaS platform via a gateway. Each tenant may provide code and data for any number of functions to be executed within any number of TEEs on the FaaS platform and accessed via the gateway. Additionally, each tenant may provide code and data for a single surrogate attester TEE. The client devices of the tenant use the surrogate attester TEE to attest each of the other TEEs of the tenant and establish trust with the functions in those TEEs. Once the functions have been attested, the client devices have confidence that the other TEEs of the tenant are running on the same platform as the gateway.

TECHNICAL FIELD

The subject matter disclosed herein generally relates to hardware trusted execution environments (TEEs). Specifically, the present disclosure addresses systems and methods for scalable attestation and orchestration for functions in TEEs.

BACKGROUND

Hardware privilege levels may be used by a processor to limit memory access by applications running on a device. An operating system runs at a higher privilege level and can access all memory of the device and define memory ranges for other applications. The applications, running a lower privilege level, are restricted to accessing memory within the range defined by the operating system and are not able to access the memory of other applications or the operating system. However, an application has no protection from a malicious or compromised operating system.

An enclave is enabled by processor protections that guarantee that code and data loaded inside the enclave is protected from access by code executing outside of the enclave. Thus, the enclave provides an isolated execution environment that prevents, at the hardware level, access of the data and code contained in the enclave from malicious software, including the operating system.

DETAILED DESCRIPTION

Example methods and systems are directed to scalable attestation for TEEs. In the most general sense, a TEE is any trusted execution environment, regardless of how that trust is obtained. An enclave is a portion of memory protected from access by processes outside of the enclave, even if those processes are running at an elevated privilege level. By way of example, TEEs are discussed as being provided by executing code within enclaves. However, other types of TEEs may be used.

TEEs may be used to enable the secure handling of confidential information by protecting the confidential information from all software outside of the TEE. TEEs may also be used for modular programming, wherein each module contains everything necessary for its own functionality without being exposed to vulnerabilities caused by other modules. For example, a code injection attack that is successful against one TEE cannot impact the code of another TEE.

Total memory encryption (TME) protects data in memory from being accessed by bypassing a processor. The system generates an encryption key within the processor on boot and never stores the key outside of the processor. The TME encryption key is an ephemeral key because it does not persist across reboots and is never stored outside of the processor. All data written by the processor to memory is encrypted using the encryption key and decrypted when it read back from memory. Thus, a hardware-based attack that attempts to read data directly from memory without processor intermediation will fail.

Multi-key TME (MKTME) extends TME to make use of multiple keys. Individual memory pages may be encrypted using the ephemeral key of TME or using software-provided keys. This may provide increased security over TME with respect to software-based attacks, since an attacker will need to identify the particular key being used by targeted software rather than having the processor automatically decrypt any memory that the attack software has gained access to.

In function-as-a-service (FaaS) environments, a client makes use of a function executing within a TEE on a FaaS server. FaaS platforms provide cloud computing services that execute application logic but do not store data. Before providing confidential data to the function, the client verifies that the function is executing with a TEE and thus that the confidential data cannot be accessed by other functions that are not part of the trusted environment.

Several full or partial solutions for attestation exist. For example, a public key may be embedded in a code block provided to the FaaS server for execution in a TEE. The client device can encrypt data before sending it to a function in the code block. Thus, the client device is ensured that only code with access to the public key can access the encrypted data. However, the function may still be executing in a non-secured environment. Additionally, an attacker could extract the public key from the code block and use it in malicious code that spoofs the intended function.

When an enclave is created, it may be “measured.” In this context, measurement refers to a set of data that is sufficient to uniquely identify the attributes and contents of an enclave. Thus, two enclaves will have the same measurements only if they include the same code and data, use the same amount of memory, have equal security levels, and so on. The measuring of an enclave is performed by a hardware processor and stored in protected registers or memory. The measurements may be signed by a processor using an Elliptic-Curve-Digital-Signature-Algorithm (ECDSA)-based asymmetric-attestation key. Another processor, having the corresponding decryption key built in, can verify the signature. The signed data may include a timestamp and an identifier of the signer. Thus, the recipient can confirm that the signed data is current and originated at the FaaS server.

Using this attestation mechanism, a client is able to attest that a function that is being directly accessed from the client is actually running in a TEE. However, it may be beneficial for the FaaS server to provide a gateway interface to multiple functions. For example, a representational state transfer (REST) application programming interface (API) allows clients to make function calls using hypertext transport protocol (HTTP). In these implementations, a gateway application receives all of the REST API function calls, translates the uniform resource locator (URL) to a function identifier and function parameters, calls the function with the function parameters, receives a result, and provides the result over the network. The gateway may run in a TEE, in which case the client device can attest the gateway. However, the measurements of the gateway do not allow the client device to attest that the underlying functions are also running in TEEs.

Multiple tenants of the FaaS platform may provide functions to be executed by the FaaS platform via the gateway. A tenant is a group of users that share common access to data, such as users with accounts linked to a particular company. Protection of data between tenants may be a goal of the tenants and the FaaS platform. The FaaS platform comprises one or more FaaS servers, in one or more datacenters. Thus, the gateway may include a load-balancer or other functionality for distributed computing. Since the FaaS platform is providing functionality for multiple tenants via the gateway, no one tenant can control the gateway.

As discussed herein, each tenant may provide code and data for any number of functions to be executed within any number of TEEs on the FaaS platform and accessed via the gateway. Additionally, each tenant may provide code and data for a single surrogate attester TEE. The client devices of the tenant use the surrogate attester TEE to attest each of the other TEEs of the tenant and establish trust with the functions in those TEEs. Once the functions have been attested, the client devices have confidence that the other TEEs of the tenant are running on the same platform as the gateway (which may also be attested).

Since the tenant controls the contents of the surrogate attester TEE, the surrogate attester TEE may be designed to securely attest each of the deployed TEEs of the tenant, which the gateway is unable to do. Since only a single surrogate attester TEE is needed for each tenant, this solution is scalable, allowing any number of TEEs to be created for each tenant without increasing the attestation overhead.

By comparison with existing methods of attesting enclaves of a tenant, the methods and systems discussed herein enable the use of a gateway to access the enclaves without requiring direct attestation over a network of each enclave, thus reducing network usage. Since the overhead of a single surrogate attester TEE does not increase when the tenant functions are protected in finer-grained enclaves, system security is increased. When these effects are considered in aggregate, one or more of the methodologies described herein may obviate a need for certain efforts or resources that otherwise would be involved in attesting enclaves. Computing resources used by one or more machines, databases, or networks may similarly be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, and cooling capacity.

FIG.1is a network diagram illustrating a network environment100suitable for servers providing functions as a service using TEEs, according to some example embodiments. The network environment100includes a FaaS servers110A and110B, client devices120A and120B, and a network130. The FaaS servers110A-110B provide functions to client devices120A-120B via the network130. The FaaS servers110A and110B may be referred to collectively as FaaS servers110or generically as a FaaS server110. The client devices120A and120B may be referred to collectively as client devices120or generically as a client device120.

The client devices120A and120B may be devices of different tenants, such that each tenant wants to ensure that their tenant-specific data and code is not accessible by other tenants. Accordingly, the FaaS servers110A-110B may use an enclave for each FaaS provided. The FaaS servers110A-110B and the client devices120A and120B may each be implemented in a computer system, in whole or in part, as described below with respect toFIG.9.

Systems and methods described herein to scalably provide attestation of TEEs may be used. For example, an attestation surrogate enclave for each tenant may be created by a FaaS server110to allow for attestation by the client devices120of the functions provided before accessing the functions through a gateway.

Any of the machines, databases, or devices shown inFIG.1may be implemented in a general-purpose computer modified (e.g., configured or programmed) by software to be a special-purpose computer to perform the functions described herein for that machine, database, or device. For example, a computer system able to implement any one or more of the methodologies described herein is discussed below with respect toFIG.9. As used herein, a “database” is a data storage resource and may store data structured as a text file, a table, a spreadsheet, a relational database (e.g., an object-relational database), a triple store, a hierarchical data store, a document-oriented NoSQL database, a file store, or any suitable combination thereof. The database may be an in-memory database. Moreover, any two or more of the machines, databases, or devices illustrated inFIG.1may be combined into a single machine, database, or device, and the functions described herein for any single machine, database, or device may be subdivided among multiple machines, databases, or devices.

The FaaS servers110and the client devices120are connected by the network130. The network130may be any network that enables communication between or among machines, databases, and devices. Accordingly, the network130may be a wired network, a wireless network (e.g., a mobile or cellular network), or any suitable combination thereof. The network130may include one or more portions that constitute a private network, a public network (e.g., the Internet), or any suitable combination thereof. Each of the devices is connected to the network130using a network interface.

FIG.2is a block diagram200of the FaaS server110A, according to some example embodiments, suitable for scalable attestation for TEEs. The FaaS server110A is shown as including a communication module210, a gateway function220, a trusted component230of an application, a trusted domain module240, a surrogate attester250, a shared memory260, and a private memory270, all configured to communicate with each other (e.g., via a bus, shared memory, or a switch). Any one or more of the modules described herein may be implemented using hardware (e.g., a processor of a machine). For example, any module described herein may be implemented by a processor configured to perform the operations described herein for that module. Moreover, any two or more of these modules may be combined into a single module, and the functions described herein for a single module may be subdivided among multiple modules. Furthermore, according to various example embodiments, modules described herein as being implemented within a single machine, database, or device may be distributed across multiple machines, databases, or devices.

The communication module210receives data sent to the FaaS server110A and transmits data from the FaaS server110A. For example, the communication module210may receive, from the client device130A, a request to perform a function. After the function is performed, the results of the function are provided by the communication module210to the client device130A. Communications sent and received by the communication module210may be intermediated by the network130. The called function may be intermediated by another function. For example, the communication module210may provide a URL to the gateway function220. The gateway function220parses the URL and invokes a function in the trusted component230.

The gateway function220may execute within or outside of an enclave. If the gateway function does not operate within an enclave, if the operating system or other untrusted components are compromised, the gateway function220is vulnerable to attack. The trusted component230executes within an enclave. Thus, even if the operating system or the untrusted component220is compromised, the data and code of the trusted component230remains secure.

The trusted domain module240creates and protects enclaves and is responsible for transitioning execution between the gateway function220and the trusted component230. Signed code may be provided to the trusted domain module240, which verifies that the code has not been modified since it was signed. The signed code is loaded into a portion of physical memory that is marked as being part of an enclave. Thereafter, hardware protections prevent access, modification, execution, or any suitable combination thereof of the enclave memory by untrusted software. The code may be encrypted using a key only available to the trusted domain module240.

Once the trusted component230is initialized, the gateway function220can invoke functions of the trusted component230using special processor instructions of the trusted domain module240that transition from an entrusted mode to a trusted mode or between trusted enclaves. The trusted component230performs parameter verification, performs the requested function if the parameters are valid, and returns control to the gateway function220via the trusted domain module240. Multiple trusted components230may be instantiated in the FaaS server110A, each providing one or more functions.

The trusted domain module240may be implemented as one or more components of an Intel® hardware processor providing Intel® Software Guard Extensions (SGX), Intel® Trust Domain Extensions (TDX), or both. In Intel® SGX, attestation is the mechanism by which a third entity establishes that a software entity is running on an Intel® SGX enabled platform protected within an enclave prior to provisioning that software with secrets and protected data. Attestation relies on the ability of a platform to produce a credential that accurately reflects the signature of an enclave, which includes information on the enclave's security properties. The Intel® SGX architecture provides the mechanisms to support two forms of attestation. There is a mechanism for creating a basic assertion between enclaves running on the same platform, which supports local, or intra-platform attestation, and then another mechanism that provides the foundation for attestation between an enclave and a remote third party.

The surrogate attester250generates attestation for enclaves (e.g., the trusted component230). The attestation is an evidence structure that uniquely identifies the attested enclave and the host (e.g., the FaaS server110A), using asymmetric encryption and supported by built-in processor functions. The attestation may be provided to a client device120via the communication module210, allowing the client device120to confirm that the trusted component230has not been compromised. For example, the processor may be manufactured with a built-in private key using hardware that prevents access of the key. Using this private key, the attestation structure can be signed by the processor to generate a signed structure. Using a corresponding public key published by the hardware manufacturer, the signature can be confirmed by the client device120. This allows the client device120to ensure that the enclave on the remote device (e.g., the FaaS server110A) has actually been created without being tampered with.

Both the gateway function220and the trusted component230can access and modify the shared memory260, but only the trusted component230can access and modify the private memory270. Though only one trusted component230and one private memory270are shown inFIG.2, each tenant may have multiple trusted components230, each with a corresponding private memory270. Additionally, multiple applications may be run with separate memory spaces, and thus separate shared memories260. In this context “shared” refers to the memory being accessible by all software and hardware with access to the memory space (e.g., an application and its operating system), not necessarily being accessible by all applications running on the system.

The surrogate attester250for a tenant may verify the integrity of one or more trusted components230for the tenant. Thus, by communication with a single surrogate attester250, the client devices120of the tenant are able to verify any number of trusted components230prior to invoking functions of those components using the single gateway function220.

Mutual attestation between enclaves (e.g., between the surrogate attester250and each of the one or more trusted components230for the same tenant or between two of the trusted components230) may be enabled by having each enclave maintain a list of measurement hashes (e.g., MRENCLAVE values provided by Intel® SGX) of the enclaves that it attests. The measurement values may be maintained in a manifest and the hash value of the manifest can be loaded at enclave creation, thereby securing the measurement hashes that the enclave will trust. Thus, after requesting the measurement hash for another enclave from the secure processor (e.g., using Intel® SGX or TDX), the requested hash can be compared with the stored hash to confirm that the other enclave is one of the trusted enclaves without using a third-party attestation verifier. Thus, so long as the surrogate attester250is trusted by the tenant and the surrogate attester250is able to attest to the other enclaves running on the FaaS server, the tenant is able to attest that all of the enclaves are secure.

FIG.3is a block diagram300of prior art ring-based memory protection. The block diagram300includes applications310and320and an operating system330. The operating system330executes processor commands in ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. The applications310-320execute processor commands in ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

The hardware processor prevents code that is executing at the lower privilege level from accessing memory outside of the memory range defined by the operating system. Thus, the code of the application310cannot directly access the memory of the operating system330or the application320(as shown by the “X” inFIG.3). The operating system330exposes some functionality to the applications310-320by predefining specific access points (e.g., by call gates, SYSENTER/SYSEXIT instructions on Intel® processors, SYSCALL/SYSRET instructions on AMD® processors, or any suitable combination or equivalent thereof).

Since the operating system330has access to all of memory, the applications310and320have no protection from a malicious operating system. For example, a competitor may modify the operating system before running the application310in order to gain access to the code and data of the application310, permitting reverse engineering.

Additionally, if an application is able to exploit a vulnerability in the operating system330and promote itself to the privilege level of the operating system, the application would be able to access all of memory. For example, the application310, which is not normally able to access the memory of the application320(as shown by the X between the applications310and320inFIG.3), would be able to access the memory of the application320after promoting itself to ring 0 or exception level 1. Thus, if the user is tricked into running a malicious program (e.g., the application310), private data of the user or an application provider may be accessed directly from memory (e.g., a banking password used by the application320).

FIG.4is a block diagram400of enclave-based memory protection, suitable for reducing latency of TEEs according to some example embodiments. The block diagram400includes an application410, an enclave420, and an operating system430. The operating system430executes processor commands in ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. The application410and the enclave420execute processor commands in ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

The operating system430allocates the memory of the enclave420and indicates to the processor the code and data to be loaded into the enclave420. However, once instantiated, the operating system430does not have access to the memory of the enclave420. Thus, even if the operating system430is malicious or compromised, the code and data of the enclave420remains secure.

The enclave420may provide functionality to the application410. The operating system430may control whether the application410is permitted to invoke functions of the enclave420(e.g., by using an ECALL instruction). Thus, a malicious application may be able to gain the ability to invoke functions of the enclave420by compromising the operating system430. Nonetheless, the hardware processor will prevent the malicious application from directly accessing the memory or code of the enclave420. Thus, while the code in the enclave420cannot assume that functions are being invoked correctly or by a non-attacker, the code in the enclave420has full control over parameter checking and other internal security measures and is only subject to its internal security vulnerabilities.

FIG.5is a block diagram of a database schema500, according to some example embodiments, suitable for use in scalable attestation for TEEs. The database schema500includes an attestation table510and a remote function table540. The attestation table510includes rows530A,530B, and530C of a format520. The attestation table510may be used by the surrogate attester250, the client devices120A-120B, or any suitable combination thereof. The remote function table540includes rows560A,560B, and560C of a format550. The remote function table540may be used by the client devices120A-120B.

The format520of the attestation table510includes an enclave identifier field and a status field. Each of the rows530A-530C stores data for a single enclave. The enclave identifier is a unique identifier for the enclave. For example, when an enclave is created, the trusted domain module240may assign the next unused identifier to the created enclave. The status field indicates the status of the enclave, such as attested, unattested, or not owned by the attesting tenant.

Thus, in the example ofFIG.5, three enclaves are shown in the attestation table510. One of the enclaves is attested, one is unattested, and one is not owned. Accordingly, if the attestation table510is integrated in the surrogate attester250, a request for status from the client device120A may be responded to with an indication that only enclave 0 has been attested. As a result, the client device120A may authorize calls to the FaaS server110A only for the function associated with enclave 0. Alternatively, the surrogate attester250may respond to the request by attempting to attest the unattested enclaves (e.g., enclave 1 of the row530B) before providing results to the client device120A.

In embodiments in which the attestation table510is stored on the client devices120, applications executing on each client device120may check the status field of the enclave corresponding to a function before invoking the function using the FaaS server110A. Accordingly, unattested functions will not be invoked, and the tenant data will not be exposed to the function. Lazy attestation may be performed, such that a TEE for a function is only attested in response to a request, on the client device, for an attestation.

Alternatively or additionally, each client device120may use the remote function table540. The format550of the remote function table540includes a function name, a server identifier, and a status field. Each of the rows560A-560C stores data for a single function. The function name is a unique identifier for the function. The server identifier identifies the server that performs the function. In the example ofFIG.5, the server 10.0.0.1 performs the DSP and FOLD functions and the server 10.0.0.2 performs the ENCRYPT function. In the example ofFIG.5, the server identifiers are Internet Protocol (IP) addresses, but other identifiers may be used. The status field indicates the status of the enclave containing the function, such as attested or unattested.

FIG.6is a block diagram600of communication links between functions and devices suitable for use in scalable attestation for TEEs, according to some example embodiments. As shown inFIG.6, the FaaS110A provides a gateway610, functions620A,620B,620C, and620D, and surrogate attester clients630A and630B. With reference toFIG.2, the gateway610corresponds to the gateway function220, the functions620A-620D correspond to four trusted components230, and the surrogate attester clients630A-630D correspond to two surrogate attesters250.

The client devices120A and120B, of two different tenants, contact the FaaS110A via two interfaces, the gateway610and the surrogate attester client630A or630B corresponding to the tenant. The FaaS server110A provides functions620A,620B,620C, and620D, each in a separate TEE. In this example, the surrogate attester client630A attests the TEEs for the functions620A and620B, containing code provided by the tenant associated with the client device120A for execution on the FaaS server110A. Likewise, the surrogate attester client630B attests the TEEs for the functions620C and620D, containing code provided by the tenant associated with the client device120B for execution on the FaaS server110A. The surrogate attester client630A is unable to attest the TEEs for the functions620C and620D because the surrogate attester client630A was not provided by the same tenant that provided the code for the functions620C and620D. Since they were provided by different tenants, the secret security information used by the functions620C-620D is not available to the surrogate attester client630A. Thus, the addition of the surrogate attester clients630A-630B does not compromise the inter-tenant security provided by the use of TEEs.

After using the surrogate attester client630A to attest the functions620A and620B, the client device120A uses the gateway610to invoke one of the functions620A or620B, with confidence that the correct function is being invoked in a secure environment. This process may be repeated for any number of clients of any number of tenants, with each tenant having any number of protected functions620A-620D, but only using one surrogate attester client630A-630B for each tenant. As a result, the scalability of the FaaS server110A is improved over systems that provide for remote attestation of each TEE without a surrogate attester client and the security of the FaaS server110A is improved over systems that do not allow for remote attestation of each TEE.

FIG.7is a flowchart illustrating operations of a method700suitable for execution by a server in providing scalable attestation for TEEs, according to some example embodiments. The method700includes operations710,720,730, and740. By way of example and not limitation, the method700may be performed by the FaaS server110A ofFIG.1, using the modules, databases, and structures shown inFIGS.2-4.

In operation710, the trusted domain module240creates a first TEE for a first function, a second TEE for a second function, and a gateway for remote access to the first function. With reference toFIG.6, the first function may be the function620A, the second function may be the surrogate attester client630A, and the gateway may be the gateway610. In some example embodiments, the surrogate attester client630A is verified by the client device120A by requesting and verifying attestation data of the surrogate attester client630A itself. Once attestation of the attester client630A is complete, the client device120A may provide an encryption key to be used by the surrogate attester client630A for further communication with the client device120A.

In some example embodiments, the gateway610is verified by the client device120A by requesting and verifying attestation data of the gateway610itself. In other example embodiments, the gateway610is not verified by the client device120A.

Creating a TEE may include processing a request that includes a pre-computed hash value for the TEE and indicates a portion of the shared memory260(e.g., a portion identified by an address and a size included in the request) that contains the code and data for the TEE. The trusted domain module240may perform a hash function on a binary memory state (e.g., the portion of the shared memory260indicated in the request) to confirm that the hash value provided in the request matches the computed hash value. If the hash values match, the trusted domain module240has confirmed that the indicated memory actually contains the code and data of the requested TEE. If the hash values don't match, the trusted domain module240may return an error value, preventing the modified memory from being loaded into the enclave.

The FaaS server110A receives a request via the network130to verify the integrity of the second TEE (operation720). For example, a remote function call to the first function may be made. As a further example, the surrogate attester client630A may be invoked to verify the integrity of the TEE containing the function620A.

In operation730, the FaaS server110A executes the first function to generate attestation data for the second TEE. For example, measurements of the second TEE may be accessed by the first function and signed using a key exchanged between the first function and the client device120A prior to the receiving of the first function call in operation720.

The data and code for a TEE may include a self-signed certificate from the author of the TEE. This self-signed certificate allows the trusted domain module240to verify that the data and code being loaded into the TEE have not been modified since they were signed. The signed data includes an identifier of the author. Thus, the attestation data for the second TEE indicates both that the TEE was unmodified after signing and the identifier of the author. If the author is the tenant associated with the client device120A, the validity of the TEE is confirmed. For further protection, the attestation data for the second TEE may be generated within the second TEE and exported to the first function. The attestation data may be a structure that includes an identity of the second TEE, one or more attributes of the second TEE, a message authentication code (MAC), or any suitable combination thereof. The structure may be signed using an ephemeral private key.

The memory space of a TEE may be encrypted using Xor-encrypt-xor (XEX)-based tweaked-codebook mode with ciphertext stealing (XTS) mode of the Advanced Encryption Standard (AES) with ephemeral 128-bit memory encryption keys. Additionally, cryptographic integrity protection may be provided using a Secure Flash Algorithm 3 (SHA-3) based MAC. A MAC is a piece of information used to identify a message. The MAC protects the message's data integrity by allowing verifies to detect any changes to the message content.

The first function, in operation740, provides the attestation data via the network. Continuing with this example, the client device120A receives the signed attestation data, verifies that the data was signed by the already-attested surrogate attester client630A, and verifies that the attestation data correctly identifies the second TEE.

Alternatively, the first function may verify the signed structure and provide to the client device an indication as to whether the attestation succeeded or failed rather than provide the attestation data itself. Verifying the attestation data may include verifying the signature of the attestation data using an ephemeral public key corresponding to the ephemeral private key used for the signing.

Once verification of the second TEE is complete, the client device120A can safely invoke the second function of the second TEE via the gateway. Invocation of the second function of the second TEE may include providing parameters to the second function, generating a return value, and providing the return value to the client device120A via the network130.

In some example embodiments, the second function requests access to data of the first TEE. For example, the client device120A may provide configuration data to the first TEE via the direct connection shown inFIG.6and the function620A may access that data, reducing the number of parameters that are communicated via the gateway610. The first TEE may determine whether the second TEE has been verified and share the requested data only if the second TEE has been verified. This ensures that the tenant's data is not shared with unverified functions.

The data may be passed between TEEs by encrypting the data of one TEE using an ephemeral key and providing the encrypted data and access to the ephemeral key to another TEE. Hardware protections may prevent the ephemeral key from being used from unprotected memory (e.g., code running outside of any TEE).

FIG.8is a flowchart illustrating operations of a method800suitable for execution by a client in making use of scalable attestation for TEEs, according to some example embodiments. The method800includes operations810,820, and830. By way of example and not limitation, the method800may be performed by the client device120A ofFIG.1, using the modules, databases, and structures shown inFIGS.2-4.

In operation810, a client device (e.g., the client device120A) verifies the integrity of a first TEE of a remote server (e.g., the FaaS server110A). For example, the client device120A may request signed attestation data from the surrogate attestation client630A. The surrogate attestation client630A generates attestation data from within a TEE and the attestation data is signed by a hardware-protected key that can only be accessed from within a TEE. The client device120A receives the signed attestation data, verifies the signature using the trusted domain module240of the client device120A, and verifies the attestation data against a local copy of the attestation data generated before the code and data for the TEE was provided to the remote server.

The client device, in operation820, makes a first remote function call to a first function of the first TEE to verify the integrity of a second TEE of the remote server. For example, the client device120A may invoke the surrogate attestation client630A to verify the integrity of the TEE containing the function420A. The surrogate attestation client630A performs a local attestation of the second TEE and sends a secure confirmation to the client device120A that the TEE of the function630A has been attested.

In some example embodiments, the first remote function call includes data from the client device120A for the second TEE being attested. In these example embodiments, the surrogate attestation client630A compares the attestation data received from the client device120A with the attestation data received locally for the second TEE. If the two sets of attestation data match, a verification response is provided to the client device120A. Otherwise, the surrogate attestation client630A indicates that the second TEE could not be verified.

In other example embodiments, the TEE for the surrogate attestation client430A includes attestation data for the second TEE when the surrogate attestation client630A is deployed. In these example embodiments, the surrogate attestation client630A compares the stored attestation data with the attestation data received locally for the second TEE to determine whether to send a verification response or an indication that the second TEE could not be verified.

In operation830, based on the verification provided by the first function, the client device makes a second remote function call to a first function of the second TEE. For example, if the surrogate attestation client630A verified the second TEE, the client device120A may invoke the verified function620A. Invocation of the verified function620A may be direct, as with invocation of the surrogate attestation client630A, or indirect, making use of the gateway610.

Thus, by use of the method800, the client device120A is enabled to verify any number of functions in any number of TEEs on the FaaS server110A while only directly invoking the surrogate attestation client630A, reducing the complexity of the verification process on both client and server and reducing network traffic and related overhead.

FIG.9is a flowchart illustrating operations of a method900suitable for execution by a client in making use of scalable attestation for TEEs, according to some example embodiments. The method900includes operations910,920,930,940, and950. By way of example and not limitation, the method900may be performed by the client device120A ofFIG.1, using the modules, databases, and structures shown inFIGS.2-4.

In operation910, a client device (e.g., the client device120A) determines whether a TEE for a function has been attested on a remote server (e.g., the FaaS server110A). For example, the remote function table540ofFIG.5may be queried to determine if an entry for the function exists and indicates that the function has been attested.

If the TEE has been attested, the client device invokes the function on the remote server (operation920). With reference to the row560A of the remote function table540, the client device confirms in operation910that the DSP function is attested and, in operation920, invokes the DSP function on the server 10.0.0.1.

However, if the TEE has not been attested, the client device requests, in operation930, attestation from the remote server. As discussed with respect to the method800and the block diagram600, this may be performed by making a remote function call to a different function in a different TEE on the remote server.

In operation940, the result of the requested attestation is checked by the client device. If the attestation was successful, the local data indicating whether the function was attested is updated (e.g., by adding a row to the attestation table510or updating an existing row in the remote function table540) and the remote function is invoked (operation920).

If the attestation was not successful, a local version of the function is invoked (operation950). In some example embodiments, the computing power of the remote server is greater than the computing power of the client device, and thus using the remote server is preferred when secure functionality is available. However, by being able to invoke the function locally, the application making use of the function is able to proceed even if the remote server is unable to provide the function.

Thus, by use of the method900, the client device120A is enabled to verify any number of functions in any number of TEEs on the FaaS server110A while only directly invoking the surrogate attestation client630A, reducing the complexity of the verification process on both client and server and reducing network traffic and related overhead. Additionally, functions may be invoked locally when they are unavailable or unsecured remotely, allowing for greater reliability.

In view of the above described implementations of subject matter this application discloses the following list of examples, wherein one feature of an example in isolation or more than one feature of an example, taken in combination and, optionally, in combination with one or more features of one or more further examples are further examples also falling within the disclosure of this application.

Example 1 is a system to provide remote attestation of a trusted execution environment (TEE), the system comprising: at least one processor; a network interface operatively coupled to the processor; and a memory coupled to the at least one processor to store instructions that, when executed by the processor, cause the at least one processor to perform operations comprising: creating a first TEE for a first function; creating a second TEE for a second function; providing a gateway for remote access to the first function; receiving, from a client device and via the network interface, a request to verify integrity of the second TEE; and in response to the request: executing the first function to generate attestation data for the second TEE; and providing the attestation data to the client device via the network interface.

In Example 2, the subject matter of Example 1 includes, wherein the generating of the attestation data for the second TEE comprises: generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and verifying the signed structure using the first function of the first TEE.

In Example 3, the subject matter of Examples 1-2 includes, wherein the operations further comprise: receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and in response to the function call: executing the second function to generate a return value; and providing the return value to the client device via the network interface.

In Example 4, the subject matter of Example 3 includes, wherein the operations further comprise: in response to the function call, requesting, by the second function, access to data of the first TEE.

In Example 5, the subject matter of Example 4 includes, wherein the operations further comprise: determining, by the first function, that the second function has been verified; and in response to the request by the second function for access to the data of the first TEE, based on the determination that the second function has been verified, providing the requested access to the data.

In Example 6, the subject matter of Example 5 includes, wherein the providing of the requested access to the data comprises: encrypting the data using an ephemeral key; and providing access to the ephemeral key to the second function.

In Example 7, the subject matter of Examples 1-6 includes, wherein the operations further comprise: before receiving the request to verify the integrity of the second TEE, receive a second request to verify the integrity of the first TEE.

In Example 8, the subject matter of Examples 1-7 includes, wherein the gateway is not verified by the client device.

In Example 9, the subject matter of Examples 1-8 includes, wherein: the gateway provides remote access to a third function of a third TEE; and the first function is unable to verify integrity of the third TEE.

In Example 10, the subject matter of Example 9 includes, wherein the operations further comprise: creating a fourth TEE for a fourth function; and receiving a second function call to the fourth function from a second client device and via the network interface, the second function call to verify the integrity of the third TEE.

Example 11 is a method of providing remote attestation of a trusted execution environment (TEE), the method comprising: creating, by a processor, a first trusted execution environment (TEE) for a first function; creating, by the processor, a second TEE for a second function; providing, by the processor, a gateway for remote access to the first function; receiving, from a client device and via a network interface, a request to verify integrity of the second TEE; in response to the request: executing, by the processor, the first function to generate attestation data for the second TEE; and providing the attestation data to the client device via the network interface.

In Example 12, the subject matter of Example 11 includes, wherein the generating of the attestation data for the second function comprises: generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and verifying, by the processor, the signed structure using the first function of the first TEE.

In Example 13, the subject matter of Examples 11-12 includes, receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and in response to the function call: executing, by the processor, the second function to generate a return value; and providing the return value to the client device via the network interface.

In Example 14, the subject matter of Example 13 includes, in response to the function call, requesting, by the second function, access to data of the first TEE.

In Example 15, the subject matter of Example 14 includes, determining, by the first function, that the second function has been verified; and in response to the request by the second function for access to the data of the first TEE, based on the determination that the second function has been verified, providing the requested access to the data.

In Example 16, the subject matter of Example 15 includes, wherein the providing of the requested access to the data comprises: encrypting the data using an ephemeral key; and providing access to the ephemeral key to the second function.

In Example 17, the subject matter of Examples 11-16 includes, before receiving the request to verify the integrity of the second TEE, receiving a second request to verify the integrity of the first TEE.

In Example 18, the subject matter of Examples 11-17 includes, wherein the gateway is not verified by the client device.

In Example 19, the subject matter of Examples 11-18 includes, wherein: the gateway provides remote access to a third function of a third TEE; and the first function is unable to verify integrity of the third TEE.

In Example 20, the subject matter of Example 19 includes, creating, by the processor, a fourth TEE for a fourth function; and receiving a second function call to the fourth function from a second client device and via the network interface, the second function call to verify the integrity of the third TEE.

Example 21 is a non-transitory computer readable medium having instructions for causing at least one processor to provide remote attestation of a trusted execution environment (TEE) by performing operations comprising: creating a first trusted execution environment (TEE) for a first function; creating a second TEE for a second function; providing a gateway for remote access to the first function; receiving, from a client device and via a network interface, a request to verify integrity of the second TEE; in response to the request: executing the first function to generate attestation data for the second TEE; and providing the attestation data to the client device via the network interface.

In Example 22, the subject matter of Example 21 includes, wherein the generating of the attestation data for the second function comprises: generating, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and verifying the signed structure using the first function of the first TEE.

In Example 23, the subject matter of Examples 21-22 includes, wherein the operations further comprise: receiving a function call at the gateway from the client device and via the network interface, the function call associated with the second function; and in response to the function call: executing the second function to generate a return value; and providing the return value to the client device via the network interface.

In Example 24, the subject matter of Example 23 includes, wherein the operations further comprise: in response to the function call, requesting, by the second function, access to data of the first TEE.

In Example 25, the subject matter of Example 24 includes, wherein the operations further comprise: determining, by the first function, that the second function has been verified; and in response to the request by the first function for access to the data of the first TEE, based on the determination that the second function has been verified, providing the requested access to the data.

In Example 26, the subject matter of Example 25 includes, wherein the providing of the requested access to the data comprises: encrypting the data using an ephemeral key; and providing access to the ephemeral key to the second function.

In Example 27, the subject matter of Examples 21-26 includes, wherein the operations further comprise: before receiving the request to verify the integrity of the second function, receiving a second request to verify the integrity of the first function.

In Example 28, the subject matter of Examples 21-27 includes, wherein the gateway is not verified by the client device.

In Example 29, the subject matter of Examples 21-28 includes, wherein: the gateway provides remote access to a third function of a third TEE; and the first function is unable to verify the integrity of the third TEE.

In Example 30, the subject matter of Example 29 includes, wherein the operations further comprise: creating, by the processor, a fourth TEE for a fourth function; and receiving a second function call to the fourth function from a second client device and via the network interface, the second function call to verify the integrity of the third TEE.

Example 31 is a system to provide remote attestation of a trusted execution environment (TEE), the system comprising: means for storage; network interface means; and processing means to: create a first TEE for a first function; create a second TEE for a second function; provide a gateway for remote access to the first function; receive, from a client device and via the network interface means, a request to verify integrity of the second TEE; in response to the request: execute the first function to generate attestation data for the second TEE; and provide the attestation data to the client device via the network interface means.

In Example 32, the subject matter of Example 31 includes, wherein to generate the attestation data for the second TEE, the processing means is to: generate, from within the second TEE, a signed structure that comprises an identity of the second TEE, an attribute of the second TEE, and a message authentication code (MAC), the structure being signed using an ephemeral private key; and verify the signed structure using the first function of the first TEE.

In Example 33, the subject matter of Examples 31-32 includes, wherein the processing means is further to: receive a function call at the gateway from the client device and via the network interface means, the function call associated with the second function; and in response to the function call: execute the second function to generate a return value; and provide the return value to the client device via the network interface means.

In Example 34, the subject matter of Example 33 includes, wherein the processing means is further to: in response to the function call, request, by the second function, access to data of the first TEE.

In Example 35, the subject matter of Example 34 includes, wherein the processing means is further to: determine, by the first function, that the second function has been verified; and in response to the request by the second function for access to the data of the first TEE, based on the determination that the second function has been verified, provide the requested access to the data.

In Example 36, the subject matter of Example 35 includes, wherein to provide the requested access to the data, the processing means is to: encrypt the data using an ephemeral key; and provide access to the ephemeral key to the second function.

In Example 37, the subject matter of Examples 31-36 includes, wherein the processing means is further to: before receiving the request to verify the integrity of the second TEE, receive a second request to verify integrity of the first TEE.

In Example 38, the subject matter of Examples 31-37 includes, wherein the gateway is not verified by the client device.

In Example 39, the subject matter of Examples 31-38 includes, wherein: the gateway provides remote access to a third function of a third TEE; and the first function is unable to verify integrity of the third TEE.

In Example 40, the subject matter of Example 39 includes, wherein the processing means is further to: create a fourth TEE for a fourth function; and receive a second function call to the fourth function from a second client device and via the network interface means, the second function call to verify the integrity of the third TEE.

Example 42 is an apparatus comprising means to implement of any of Examples 1-40.

Example 43 is a system to implement of any of Examples 1-40.

Example 44 is a method to implement of any of Examples 1-40.

FIG.10is a block diagram1000showing one example of a software architecture1002for a computing device. The architecture1002may be used in conjunction with various hardware architectures, for example, as described herein.FIG.10is merely a non-limiting example of a software architecture and many other architectures may be implemented to facilitate the functionality described herein. A representative hardware layer1004is illustrated and can represent, for example, any of the above referenced computing devices. In some examples, the hardware layer1004may be implemented according to the architecture of the computer system ofFIG.10.

The representative hardware layer1004comprises one or more processing units1006having associated executable instructions1008. Executable instructions1008represent the executable instructions of the software architecture1002, including implementation of the methods, modules, subsystems, and components, and so forth described herein and may also include memory and/or storage modules1010, which also have executable instructions1008. Hardware layer1004may also comprise other hardware as indicated by other hardware1012which represents any other hardware of the hardware layer1004, such as the other hardware illustrated as part of the software architecture1002.

In the example architecture ofFIG.10, the software architecture1002may be conceptualized as a stack of layers where each layer provides particular functionality. For example, the software architecture1002may include layers such as an operating system1014, libraries1016, frameworks/middleware1018, applications1020, and presentation layer1044. Operationally, the applications1020and/or other components within the layers may invoke application programming interface (API) calls1024through the software stack and access a response, returned values, and so forth illustrated as messages1026in response to the API calls1024. The layers illustrated are representative in nature and not all software architectures have all layers. For example, some mobile or special purpose operating systems may not provide a frameworks/middleware1018, while others may provide such a layer. Other software architectures may include additional or different layers.

The operating system1014may manage hardware resources and provide common services. The operating system1014may include, for example, a kernel1028, services1030, and drivers1032. The kernel1028may act as an abstraction layer between the hardware and the other software layers. For example, the kernel1028may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, and so on. The services1030may provide other common services for the other software layers. In some examples, the services1030include an interrupt service. The interrupt service may detect the receipt of an interrupt and, in response, cause the architecture1002to pause its current processing and execute an interrupt service routine (ISR) when an interrupt is accessed.

The drivers1032may be responsible for controlling or interfacing with the underlying hardware. For instance, the drivers1032may include display drivers, camera drivers, Bluetooth® drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Wi-Fi® drivers, NEC drivers, audio drivers, power management drivers, and so forth depending on the hardware configuration.

The libraries1016may provide a common infrastructure that may be utilized by the applications1020and/or other components and/or layers. The libraries1016typically provide functionality that allows other software modules to perform tasks in an easier fashion than to interface directly with the underlying operating system1014functionality (e.g., kernel1028, services1030and/or drivers1032). The libraries1016may include system libraries1034(e.g., C standard library) that may provide functions such as memory allocation functions, string manipulation functions, mathematic functions, and the like. In addition, the libraries1016may include API libraries1036such as media libraries (e.g., libraries to support presentation and manipulation of various media format such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG), graphics libraries (e.g., an OpenGL framework that may be used to render two-dimensional and three-dimensional in a graphic content on a display), database libraries (e.g., SQLite that may provide various relational database functions), web libraries (e.g., WebKit that may provide web browsing functionality), and the like. The libraries1016may also include a wide variety of other libraries1038to provide many other APIs to the applications1020and other software components/modules.

The frameworks/middleware1018may provide a higher-level common infrastructure that may be utilized by the applications1020and/or other software components/modules. For example, the frameworks/middleware1018may provide various graphic user interface (GUI) functions, high-level resource management, high-level location services, and so forth. The frameworks/middle ware1018may provide a broad spectrum of other APIs that may be utilized by the applications1020and/or other software components/modules, some of which may be specific to a particular operating system or platform.

The applications1020include built-in applications1040and/or third-party applications1042. Examples of representative built-in applications1040may include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and/or a game application. Third-party applications1042may include any of the built-in applications as well as a broad assortment of other applications. In a specific example, the third-party application1042(e.g., an application developed using the Android™ or iOS™ software development kit (SDK) by an entity other than the vendor of the particular platform) may be mobile software running on a mobile operating system such as iOS™, Android™, Windows® Phone, or other mobile computing device operating systems. In this example, the third-party application1042may invoke the API calls1024provided by the mobile operating system such as operating system1014to facilitate functionality described herein.

The applications1020may utilize built in operating system functions (e.g., kernel1028, services1030and/or drivers1032), libraries (e.g., system libraries1034, API libraries1036, and other libraries1038), frameworks/middleware1018to create user interfaces to interact with users of the system. Alternatively, or additionally, in some systems, interactions with a user may occur through a presentation layer, such as presentation layer1044. In these systems, the application/module “logic” can be separated from the aspects of the application/module that interact with a user.

Some software architectures utilize virtual machines. In the example ofFIG.10, this is illustrated by virtual machine1048. A virtual machine creates a software environment where applications/modules can execute as if they were executing on a hardware computing device. A virtual machine is hosted by a host operating system (operating system1014) and typically, although not always, has a virtual machine monitor1046, which manages the operation of the virtual machine as well as the interface with the host operating system (i.e., operating system1014). A software architecture executes within the virtual machine1048such as an operating system1050, libraries1052, frameworks/middleware1054, applications1056and/or presentation layer1058. These layers of software architecture executing within the virtual machine1048can be the same as corresponding layers previously described or may be different.

Modules, Components and Logic

Electronic Apparatus and System

Example Machine Architecture and Machine-Readable Medium

The example computer system1100includes a processor1102(e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), a main memory1104, and a static memory1106, which communicate with each other via a bus1108. The computer system1100may further include a video display unit1110(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system1100also includes an alphanumeric input device1112(e.g., a keyboard or a touch-sensitive display screen), a user interface (UI) navigation (or cursor control) device1114(e.g., a mouse), a storage unit1116, a signal generation device1118(e.g., a speaker), and a network interface device1120.

The storage unit1116includes a machine-readable medium1122on which is stored one or more sets of data structures and instructions1124(e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. The instructions1124may also reside, completely or at least partially, within the main memory1104and/or within the processor1102during execution thereof by the computer system1100, with the main memory1104and the processor1102also constituting machine-readable media1122.

Transmission Medium