Broadcast remote sealing for scalable trusted execution environment provisioning

Patent metadata

Field	Value
Publication number	US-11328111-B2
Application number	US-202017129223-A
Country	US
Kind code	B2
Filing date	Dec 21, 2020
Priority date	Sep 25, 2020
Publication date	May 10, 2022
Grant date	May 10, 2022

Abstract

An apparatus to facilitate broadcast remote sealing for scalable trusted execution environment provisioning is disclosed. The apparatus includes one or more processors to: request a group status report to confirm a status of a group of trusted execution platforms from a cloud service provider (CSP) providing scalable runtime validation for on-device design rule checks; validate, by a tenant, a minimum trusted computing base (TCB) declared with the group status report; determine, based on validation of the minimum TCB, whether a set of group members of the group of trusted execution platforms satisfies security requirements of the tenant; responsive to the set of group members satisfying the security requirement, utilize a group public key to encrypt a workload of the tenant; and send the encrypted workload to the CSP for storage by the CSP and subsequent execution by an execution platform of the group using a private group key.

First claim

What is claimed is:

1. An apparatus comprising:
one or more hardware processors of a computing device associated with a tenant, the one or more processors to:
request a group status report to confirm a status of a group of trusted execution platforms from a cloud service provider (CSP) providing scalable runtime validation for on-device design rule checks;
validate, by the tenant, a minimum trusted computing base (TCB) declared with the group status report;
determine, by the tenant based on validation of the minimum TCB, whether a set of group members of the group of trusted execution platforms satisfies security requirements of the tenant;
responsive to the set of group members satisfying the security requirement, utilize a group public key to encrypt a workload of the tenant; and
send the encrypted workload to the CSP for storage by the CSP and subsequent execution by an execution platform of the group of trusted execution platforms using a private group key.

2. The apparatus of claim 1 , wherein the group of trusted execution platforms comprise at least a field-programmable gate array (FPGA).

3. The apparatus of claim 1 , wherein the execution platform of the group of trusted execution platforms decrypts the encrypted workload in response to validation by other group members of the group of trusted execution platforms.

4. The apparatus of claim 1 , wherein the CSP indicates to each trusted execution platform in the group of trusted execution platforms that a public key associated with the tenant is authorized.

5. The apparatus of claim 1 , wherein the CSP informs the tenant of existence of the group of trusted execution platforms.

6. The apparatus of claim 1 , wherein the tenant declares a policy to define acceptable trusted execution platforms for execution of workloads of the tenant.

7. The apparatus of claim 1 , wherein the execution platform comprises a security device manager comprising a configuration manager and security enclave for the execution platform.

8. The apparatus of claim 1 , wherein the CSP is an untrusted platform provider that is not able to decrypt the workload.

9. The apparatus of claim 1 , wherein the execution platform comprises a programmable integrated circuit (IC) comprising at least one of a field programmable gate array (FPGA), a programmable array logic (PAL), a programmable logic array (PLA), a field programmable logic array (FPLA), an electrically programmable logic device (EPLD), an electrically erasable programmable logic device (EEPLD), a logic cell array (LCA), or a complex programmable logic devices (CPLD).

10. A method comprising:
requesting, by one or more processors of a computing device associated with a tenant, a group status report to confirm a status of a group of trusted execution platforms from a cloud service provider (CSP) providing scalable runtime validation for on-device design rule checks;
validating, by the one or more processors, a minimum trusted computing base (TCB) declared with the group status report;
determining, by the one or more processors based on validation of the minimum TCB, whether a set of group members of the group of trusted execution platforms satisfies security requirements of the tenant;
responsive to the set of group members satisfying the security requirement, utilizing a group public key to encrypt a workload of the tenant; and
sending the encrypted workload to the CSP for storage by the CSP and subsequent execution by an execution platform of the group of trusted execution platforms using a private group key.

11. The method of claim 10 , wherein the group of trusted execution platforms comprise at least a field-programmable gate array (FPGA).

12. The method of claim 10 , wherein the execution platform of the group of trusted execution platforms decrypts the encrypted workload in response to validation by other group members of the group of trusted execution platforms.

13. The method of claim 10 , wherein the CSP indicates to each trusted execution platform in the group of trusted execution platforms that a public key associated with the tenant is authorized, and wherein the CSP informs the tenant of existence of the group of trusted execution platforms.

14. The method of claim 10 , wherein the tenant declares a policy to define acceptable trusted execution platforms for execution of workloads of the tenant.

15. The method of claim 10 , wherein the execution platform comprises a programmable integrated circuit (IC) comprising at least one of a field programmable gate array (FPGA), a programmable array logic (PAL), a programmable logic array (PLA), a field programmable logic array (FPLA), an electrically programmable logic device (EPLD), an electrically erasable programmable logic device (EEPLD), a logic cell array (LCA), or a complex programmable logic devices (CPLD).

16. A non-transitory machine readable storage medium comprising instructions that, when executed, cause at least one processor to at least:
request, by the at least one processor of a computing device associated with a tenant, a group status report to confirm a status of a group of trusted execution platforms from a cloud service provider (CSP) providing scalable runtime validation for on-device design rule checks;
validate, by the at least one processor, a minimum trusted computing base (TCB) declared with the group status report;
determine, by the at least one processor based on validation of the minimum TCB, whether a set of group members of the group of trusted execution platforms satisfies security requirements of the tenant;
responsive to the set of group members satisfying the security requirement, utilize a group public key to encrypt a workload of the tenant; and
send the encrypted workload to the CSP for storage by the CSP and subsequent execution by an execution platform of the group of trusted execution platforms using a private group key.

17. The non-transitory machine readable storage medium of claim 16 , wherein the group of trusted execution platforms comprise at least a field-programmable gate array (FPGA).

18. The non-transitory machine readable storage medium of claim 16 , wherein the execution platform of the group of trusted execution platforms decrypts the encrypted workload in response to validation by other group members of the group of trusted execution platforms.

19. The non-transitory machine readable storage medium of claim 16 , wherein the CSP indicates to each trusted execution platform in the group of trusted execution platforms that a public key associated with the tenant is authorized, and wherein the CSP informs the tenant of existence of the group of trusted execution platforms.

20. The non-transitory machine readable storage medium of claim 16 , wherein the tenant declares a policy to define acceptable trusted execution platforms for execution of workloads of the tenant.

Assignees

• Intel Corp

Inventors

• Schulz Steffen
• Trivedi Alpa
• Koeberl Patrick

Classifications

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title

• G06F15/7867

  with reconfigurable architecture · CPC title

• G06F21/85 Primary

  interconnection devices, e.g. bus-connected or in-line devices · CPC title

• G06F15/7825

  Globally asynchronous, locally synchronous, e.g. network on chip · CPC title

• G06F11/0754

  by exceeding limits · CPC title