Trusted computing resource meter

Patent metadata

Field	Value
Publication number	US-10754703-B2
Application number	US-201514977952-A
Country	US
Kind code	B2
Filing date	Dec 22, 2015
Priority date	Dec 22, 2015
Publication date	Aug 25, 2020
Grant date	Aug 25, 2020

Abstract

In an example, there is disclosed a computing apparatus, having a computing resource; a bespoke sensor for measuring at least one parameter of usage of the computing resource; and one or more logic elements providing a trusted compute meter (TCM) agent to: receive an external workload; provision a workload enclave; execute the external workload within the TCM enclave; and measure resource usage of the external workload via the bespoke sensor. There is also disclosed a computer-readable medium having stored thereon executable instructions for providing a TCM agent, and a method of providing a TCM agent.

First claim

What is claimed is:

1. A computing apparatus, comprising:
a hardware platform comprising a computing resource;
a bespoke sensor to measure at least one parameter of usage of the computing resource;
a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave; and
a trusted compute meter (TCM) agent comprising logic to operate within the first TEE independently of an operating system of the apparatus, the bespoke sensor, and a secure communication channel to communicatively couple the TCM agent logic to the bespoke sensor, wherein the TCM is to:
receive an external workload;
provision a workload enclave within the first TEE;
execute the external workload within the workload enclave; and
measure resource usage of the external workload via the bespoke sensor, wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,
wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure communication between the TCM agent of the first TEE and the TMME.

2. The computing apparatus of claim 1 , wherein the bespoke sensor is to provide fine-grained compute or energy consumption data for the external workload.

3. The computing apparatus of claim 1 , further comprising a secure interface to configure the bespoke sensor.

4. The computing apparatus of claim 1 , wherein the TCM agent is to provision the workload enclave within a scope selected from at least two different scopes, wherein each scope has different security features from the other scope.

5. The computing apparatus of claim 1 , wherein TCM agent logic further comprises a processing device selected from a group consisting of a central processing unit, graphical processing unit, and a neural network processor.

6. The computing apparatus of claim 1 , wherein the TCM agent is to provision a first workload enclave for a first workload, and a second workload enclave for a second workload, wherein the first workload enclave and second workload enclave are logically separate and mutually exclusive.

7. The computing apparatus of claim 1 , wherein the bespoke sensor is to measure the external workload independently of the workload enclave and of an operating system running on the computing apparatus.

8. The computing apparatus of claim 1 , wherein the TCM agent is further to save data of the bespoke sensor as part of a workload state.

9. The computing apparatus of claim 1 , wherein the TCM agent is further to snapshot and seal data from the bespoke sensor to the workload enclave based on a configurable event.

10. The computing apparatus of claim 1 , wherein the TCM agent is to execute within a TCM enclave separate from and mutually exclusive of the workload enclave.

11. The computing apparatus of claim 1 , wherein the TCM agent is further to convert raw data from the bespoke sensor into a billing-appropriate unit in a format different from the raw data.

12. The computing apparatus of claim 1 , wherein the at least one parameter is selected from the group consisting of power consumption, processor cycles consumed, memory consumed, storage consumed, energy transmission, and volume of communication.

13. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to instruct a processor to provide a trusted compute meter (TCM) agent to operate independently of a host operating system and to communicate securely with a bespoke sensor, wherein the TCM agent is to be provided within a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave, to:
receive an external workload for execution on a hardware platform comprising a computing resource;
provision a workload enclave to execute the external workload;
execute the external workload within the workload enclave using the computing resource; and
measure resource usage of the external workload via a bespoke sensor configured to measure at least one parameter of usage of the computing resource, wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,
wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure communication between the TCM agent of the first TEE and the TMME.

14. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the bespoke sensor is to provide fine-grained compute or energy consumption data for the external workload.

15. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is to provision the workload enclave within a scope selected from at least two different scopes, wherein each scope has different security features from the other scope.

16. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is to provision a first workload enclave for a first workload, and a second workload enclave for a second workload, wherein the first workload enclave and second workload enclave are logically separate and mutually exclusive.

17. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the bespoke sensor is to measure the external workload independently of the workload enclave and of an operating system.

18. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to save data of the bespoke sensor as part of a workload state.

19. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to snapshot and seal data from the bespoke sensor to the workload enclave based on a configurable event.

20. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to convert raw data from the bespoke sensor into a billing-appropriate unit in a format different from the raw data.

21. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the at least one parameter is selected from the group consisting of power consumption, processor cycles consumed, memory consumed, storage consumed, energy transmission, and volume of communication.

22. A method of providing a trusted compute meter (TCM) agent, comprising:
receiving an external workload for execution on a computing resource;
provisioning a workload enclave to execute the external workload within a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave;
executing the external workload within the workload enclave using the computing resource; and
measuring resource usage of the external workload via a bespoke sensor configured to measure at least one parameter of usage of the computing resource and to securely communicate with the TCM agent independently of a host operating system,
wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,
wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure

Assignees

• Mcafee Llc

Inventors

• Herbert Howard C
• Mankin Jennifer Eligius
• Hunt Simon
• Sambandam Venkata Ramanan
• Scott-Nash Mark E
• Bartfai-Walcott Katalin Klara
• Illikkal Rameshkumar

Classifications

• G06F9/5072 Primary

  Grid computing · CPC title

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/3409

  for performance assessment · CPC title

• G06F11/3062

  where the monitored property is the power consumption (power management in a computing system G06F1/3203) · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title