Scaled trusted execution environment for application services

Patent metadata

Field	Value
Publication number	US-12450332-B2
Application number	US-202318236352-A
Country	US
Kind code	B2
Filing date	Aug 21, 2023
Priority date	Sep 9, 2022
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

Various aspects of the subject technology relate to systems, methods, and machine-readable media for providing an application trusted execution environment. Various aspects may include performing attestation of each application enclave of a plurality of application enclaves for a plurality of applications. Aspects may also include receiving a request from a client. Aspects may also include selecting a load balancer to forward the request to the application enclaves. Aspects may also include determining a sensitivity level of the request that is associated with a secured environment parameter. Aspects may include routing, by an enclave server of the load balancer, the request to an application enclave according to the sensitivity level for execution of an application of the plurality of applications in the application trusted execution environment.

First claim

What is claimed is:

1. A computer-implemented method for providing an application trusted execution environment, the method comprising:
performing first attestation of a first application enclave from multiple application enclaves for a plurality of applications, to gain trust in executing the application enclaves for the plurality of applications;
receiving a request from a client;
selecting a first load balancer from multiple load balancers to forward the request to the application enclaves;
encrypting, by the first load balancer, a request body of the request in an application layer, based on a type of the request;
performing second attestation of the first load balancer based on an attestation report; and
routing, by an enclave server of the load balancer, the request from the load balancer to an application enclave of the application enclaves for execution of an application of the plurality of applications in the application trusted execution environment.

2. The computer-implemented method of claim 1 , wherein the request from the client includes to store a public data, further comprising assigning a sensitivity level to the request, storing the public data in a database, and enabling a server operator in the database to read and modify the public data.

3. The computer-implemented method of claim 1 , wherein the request from the client includes an account balance, further comprising assigning a sensitivity level to the request, and storing the account balance in an encrypted Merkle trie accessible to an authorized application enclave.

4. The computer-implemented method of claim 1 , wherein performing the attestation of a first application enclave comprises:
determining, by the first load balancer and for each application enclave, cryptographic information comprising at least one of: a shared cryptographic key, a cryptographic credential, or a hash authentication of an application configured to be executed by the application enclaves; and
verifying, based on the cryptographic information, a validity or authenticity of each of the application enclaves.

5. The computer-implemented method of claim 1 , wherein receiving the request comprises receiving a type of an application layer request corresponding to the request.

6. The computer-implemented method of claim 1 , wherein selecting the first load balancer comprises:
initializing each of the load balancers as a stateless application; and determining the load balancers based on a domain name system (DNS) record.

7. The computer-implemented method of claim 1 , further comprising determining a sensitivity level of the request based on a trusted environment parameter depending on whether the request or information associated with the request requires encryption.

8. The computer-implemented method of claim 6 , wherein routing the request from the first load balancer to the first application enclave comprises determining, based on a trusted environment parameter, a visibility of client information associated with the request according to a sensitivity level of the request.

9. The computer-implemented method of claim 1 , further comprising:
encrypting the request body of the request in the application layer, based on corresponding shared cryptographic information with each of the application enclaves; and
performing, by the first load balancer, user input sanitization.

10. The computer-implemented method of claim 1 , further comprising:
encrypting, based on a sensitivity level and prior to sending the request to at least one of the application enclaves, information associated with the request via an encryption mechanism shared with the at least one of the application enclaves;
selecting the first application enclave based on the sensitivity level or a type of application; validating a response from the first application enclave as authentic; and
encrypting the response prior to returning the response to the client.

11. A system for providing an application trusted execution environment, comprising: one or more processors; and
a memory comprising instructions stored thereon, which when executed by the one or more processors, causes the one or more processors to perform:
performing first attestation of each application enclave of a plurality of application enclaves for a plurality of applications;
receiving a request from a client;
selecting a load balancer of a plurality of load balancers to forward the request to the plurality of application enclaves;
encrypting, by the load balancer, prior to sending the request to at least one of the plurality of application enclaves, information associated with the request via an encryption mechanism shared with the at least one of the plurality of application enclaves;
performing second attestation of the load balancer based on an attestation report; and
routing, by an enclave server, the request from the load balancer to an application enclave of the plurality of application enclaves for execution of an application of the plurality of applications in the application trusted execution environment.

12. The system of claim 11 , wherein the instructions that cause the one or more processors to perform performing the attestation of each application enclave cause the one or more processors to determine, by the load balancer and for each application enclave, a shared cryptographic key to encrypt and authenticate requests from each application enclave.

13. The system of claim 11 , wherein the one or more processors further execute instructions to verify that a hash authentication of an application configured to be executed by the plurality of application enclaves matches an expected version.

14. The system of claim 11 , wherein the instructions that cause the one or more processors to perform receiving the request cause the one or more processors to perform receiving a type of application programming interface (API) request corresponding to the request.

15. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform determining a sensitivity level of the request based on a trusted environment parameter, depending on whether the request or information associated with the request requires encryption.

16. The system of claim 11 , wherein the instructions that cause the one or more processors to perform selecting the load balancer cause the one or more processors to perform:
initializing each of the plurality of load balancers as a stateless application;
determining the plurality of load balancers based on a domain name system record; and
routing the request from the load balancer to the application enclave and determining, based on a trusted environment parameter, a visibility of client information associated with the request according to a sensitivity level of the request.

17. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform encrypting, by the load balancer, a request body of a request to an application layer, based on corresponding shared cryptographic information with each of the plurality of application enclaves.

18. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform:
performing, by the load balancer, user input sanitization.

19. The system of claim 11 , further comprising stored

Assignees

• Ava Labs Inc

Inventors

• Kaplan Michael
• Wong Bernard
• Mussallem Nicholas John
• Buttolph Stephen John
• O'Grady Patrick Robert
• Sekniqi Kevin
• Yin Ted

Classifications

• H04L67/1012 Primary

  based on compliance of requirements or conditions with available server resources · CPC title

• H04L67/63

  Routing a service request depending on the request content or context · CPC title

• H04L63/126

  the source of the received data · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title