US20230045505A1 - Technologies for accelerated orchestration and attestation with edge device trust chains - Google Patents
Technologies for accelerated orchestration and attestation with edge device trust chains Download PDFInfo
- Publication number
- US20230045505A1 US20230045505A1 US17/891,780 US202217891780A US2023045505A1 US 20230045505 A1 US20230045505 A1 US 20230045505A1 US 202217891780 A US202217891780 A US 202217891780A US 2023045505 A1 US2023045505 A1 US 2023045505A1
- Authority
- US
- United States
- Prior art keywords
- certificate
- component
- appliance
- edge
- appliance device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000005516 engineering process Methods 0.000 title abstract description 5
- 238000000034 method Methods 0.000 claims abstract description 60
- 230000008569 process Effects 0.000 claims abstract description 25
- 238000003860 storage Methods 0.000 claims description 21
- 230000004044 response Effects 0.000 claims description 13
- 238000012795 verification Methods 0.000 claims description 8
- 238000004891 communication Methods 0.000 description 15
- 230000006870 function Effects 0.000 description 15
- 238000013500 data storage Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 6
- 230000002093 peripheral effect Effects 0.000 description 3
- 230000004224 protection Effects 0.000 description 3
- 238000013461 design Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 239000004744 fabric Substances 0.000 description 2
- 238000002955 isolation Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 150000001875 compounds Chemical class 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 238000013497 data interchange Methods 0.000 description 1
- 230000006837 decompression Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000013403 standard screening design Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/20—Network management software packages
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0893—Assignment of logical groups to network elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5003—Managing SLA; Interaction between SLA and QoS
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5003—Managing SLA; Interaction between SLA and QoS
- H04L41/5019—Ensuring fulfilment of SLA
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
- H04L67/63—Routing a service request depending on the request content or context
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
Definitions
- FaaS function as a service
- Typical FaaS systems allow a client to invoke a particular function on-demand, without executing a dedicated service process.
- a FaaS function may be performed by an appliance composed of multiple components. The number or amount of users executing FaaS services may be unbounded.
- FIG. 1 is a simplified block diagram of at least one embodiment of a system for accelerated orchestration and attestation
- FIG. 2 is a simplified block diagram of at least one embodiment of various environments of the system of FIG. 1 ;
- FIG. 3 is a simplified flow diagram of at least one embodiment of a method for aggregated attestation that may be executed by an edge appliance device of the system of FIGS. 1 - 2 ;
- FIG. 4 is a simplified flow diagram of at least one embodiment of a method for attestation and orchestration that may be executed by an edge orchestrator device of the system of FIGS. 1 - 2 ;
- FIG. 5 is a simplified block diagram of at least one embodiment of an edge architecture that may include the system of FIGS. 1 - 2 .
- references in the specification to “one embodiment,” “an embodiment,” “an illustrative embodiment,” etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may or may not necessarily include that particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.
- items included in a list in the form of “at least one A, B, and C” can mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).
- items listed in the form of “at least one of A, B, or C” can mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).
- the disclosed embodiments may be implemented, in some cases, in hardware, firmware, software, or any combination thereof.
- the disclosed embodiments may also be implemented as instructions carried by or stored on a transitory or non-transitory machine-readable (e.g., computer-readable) storage medium, which may be read and executed by one or more processors.
- the disclosed embodiments may be initially encoded as a set of preliminary instructions (e.g., encoded on a machine-readable storage medium) that may require a preliminary processing operations to prepare the instructions for execution on a destination device.
- the preliminary processing may include combining the instructions with data present on a device, translating the instructions to a different format, performing compression, decompression, encryption, and/or decryption, combining multiple files that include different sections of the instructions, integrating the instructions with other code present on a device, such as a library, an operating system, etc., or similar operations.
- the preliminary processing may be performed by the source compute device (e.g., the device that is to send the instructions), the destination compute device (e.g., the device that is to execute the instructions), or an intermediary device.
- a machine-readable storage medium may be embodied as any storage device, mechanism, or other physical structure for storing or transmitting information in a form readable by a machine (e.g., a volatile or non-volatile memory, a media disc, or other media device).
- a machine e.g., a volatile or non-volatile memory, a media disc, or other media device.
- a system 100 for accelerated orchestration and attestation includes multiple edge devices 102 and multiple endpoint devices 104 .
- one or more edge devices 102 may be composed into or otherwise establish an edge appliance device 102 to perform a function-as-a-service (FaaS) request or other service.
- the edge appliance device 102 generates an appliance certificate using accelerated logic.
- the appliance certificate attests to the configuration and utilization of one or more components of the edge appliance device 102 .
- the edge appliance device 102 provides the appliance certificate to an orchestrator, such as an edge orchestrator device 102 .
- the edge orchestrator device 102 verifies the appliance certificate and compares the appliance certificate to a service level agreement (SLA) requirement associated with a tenant workload.
- SLA service level agreement
- the system 100 allows for verification of the complete root of trust for components of an edge appliance, with low latency. Additionally, the system 100 allows for a workload plan to be verified before issuing an SLA, which extends the root of trust verification to extend into workload scheduling.
- Each edge device 102 may be embodied as any type of device capable of performing the functions described herein.
- the edge device 102 may be embodied as, without limitation, a computer, a server, a workstation, a multiprocessor system, a distributed computing device, a switch, a router, a network device, a virtualized system (e.g., one or more functions executed in virtualized environment(s), such as virtual machine(s) or container(s), in which the underlying hardware resources appear as physical hardware to software executing in the virtualized environment(s), but are separated from the software by an abstraction layer), and/or a consumer electronic device.
- a virtualized system e.g., one or more functions executed in virtualized environment(s), such as virtual machine(s) or container(s), in which the underlying hardware resources appear as physical hardware to software executing in the virtualized environment(s), but are separated from the software by an abstraction layer
- a consumer electronic device e.g., one or more functions executed in virtualized environment(s), such
- the edge device 102 may be embodied as a one or more compute sleds, memory sleds, or other racks, sleds, computing chassis, or other components of a physically disaggregated computing device.
- the illustrative edge device 102 includes a compute engine 120 , an I/O subsystem 122 , a memory 124 , a data storage device 126 , and a communication subsystem 128 .
- one or more of the illustrative components may be incorporated in, or otherwise form a portion of, another component.
- the memory 124 or portions thereof, may be incorporated in the compute engine 120 in some embodiments.
- the compute engine 120 may be embodied as any type of compute engine capable of performing the functions described herein.
- the compute engine 120 may be embodied as a single or multi-core processor(s), digital signal processor, microcontroller, field-programmable gate array (FPGA), or other configurable circuitry, application-specific integrated circuit (ASIC), or other processor or processing/controlling circuit or virtualized version thereof.
- the memory 124 may be embodied as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. In operation, the memory 124 may store various data and software used during operation of the edge device 102 such as operating systems, applications, programs, libraries, and drivers.
- the memory 124 may be communicatively coupled to the compute engine 120 via the I/O subsystem 122 , which may be embodied as circuitry and/or components to facilitate input/output operations with the compute engine 120 , the memory 124 , and other components of the edge device 102 .
- the I/O subsystem 122 may be embodied as, or otherwise include, memory controller hubs, input/output control hubs, sensor hubs, host controllers, firmware devices, communication links (i.e., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.) and/or other components and subsystems to facilitate the input/output operations.
- the memory 124 may be directly coupled to the compute engine 120 , for example via an integrated memory controller hub. Additionally, in some embodiments, the I/O subsystem 122 may form a portion of a system-on-a-chip (SoC) and be incorporated, along with the compute engine 120 , the memory 124 , the accelerator 130 , and/or other components of the edge device 102 , on a single integrated circuit chip.
- SoC system-on-a-chip
- the data storage device 126 may be embodied as any type of device or devices configured for short-term or long-term storage of data such as, for example, memory devices and circuits, memory cards, hard disk drives, solid-state drives, non-volatile flash memory, or other data storage devices.
- the communications subsystem 128 may be embodied as any communication circuit, device, or collection thereof, capable of enabling communications between the edge device 102 and other remote devices over the network 106 .
- the communications subsystem 128 may be configured to use any one or more communication technology (e.g., wired or wireless communications) and associated protocols (e.g., Ethernet, Bluetooth®, WiMAX, 3G, 4G LTE, 5G, etc.) to effect such communication.
- the accelerator 130 may be embodied as a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a coprocessor, or other digital logic device capable of performing accelerated functions (e.g., accelerated application functions, accelerated network functions, or other accelerated functions).
- FPGA field-programmable gate array
- ASIC application-specific integrated circuit
- coprocessor or other digital logic device capable of performing accelerated functions (e.g., accelerated application functions, accelerated network functions, or other accelerated functions).
- the accelerator 130 is an FPGA, which may be embodied as an integrated circuit including programmable digital logic resources that may be configured after manufacture.
- the FPGA may include, for example, a configurable array of logic blocks in communication over a configurable data interchange.
- the accelerator 130 may be coupled to the compute engine 120 via a high-speed connection interface such as a peripheral bus (e.g., a PCI Express bus) or an inter-processor interconnect (e.g., an in-die interconnect (IDI) or QuickPath Interconect (QPI)), or via any other appropriate interconnect.
- a peripheral bus e.g., a PCI Express bus
- an inter-processor interconnect e.g., an in-die interconnect (IDI) or QuickPath Interconect (QPI)
- IPI in-die interconnect
- QPI QuickPath Interconect
- the accelerator 130 may be incorporated in or otherwise coupled with one or more other components of the edge device 102 , such as a network interface controller (NIC) of the communication subsystem 128 .
- NIC network interface controller
- Each endpoint device 104 may be embodied as any type of computation or computer device capable of performing the functions described herein, including, without limitation, a computer, a mobile computing device, a wearable computing device, a network appliance, a web appliance, a distributed computing system, an autonomous vehicle, an autonomous aerial vehicle, an Internet of Things (IoT) sensor, an IoT gateway, an industrial automation device, a processor-based system, and/or a consumer electronic device.
- each endpoint device 104 may include components and features similar to the edge device 102 , such as a compute engine 120 , I/O subsystem 122 , memory 124 , data storage 126 , communication subsystem 128 , and/or various peripheral devices. Those individual components of each endpoint device 104 may be similar to the corresponding components of the edge device 102 , the description of which is applicable to the corresponding components of the endpoint device 104 and is not repeated for clarity of the present description.
- the edge devices 102 and the endpoint devices 104 may be configured to transmit and receive data with each other and/or other devices of the system 100 over the network 106 .
- the network 106 may be embodied as any number of various wired and/or wireless networks, or hybrids or combinations thereof.
- the network 106 may be embodied as, or otherwise include a mobile access network, a network edge infrastructure, a wired or wireless local area network (LAN), and/or a wired or wireless wide area network (WAN).
- the network 106 may include any number of additional devices, such as additional base stations, access points, computers, routers, and switches, to facilitate communications among the devices of the system 100 .
- the network 106 is embodied as an edge network fabric.
- each edge appliance device 102 a establishes an environment 200 during operation.
- the illustrative environment 200 includes the accelerator 130 and one or more components 206 .
- the accelerator 130 includes an attestation manager 202 and a platform verifier 204 .
- Each component 206 includes an attester 208 .
- the various components of the environment 200 may be embodied as hardware, firmware, software, or a combination thereof.
- one or more of the components of the environment 200 may be embodied as circuitry or collection of electrical devices (e.g., attestation manager circuitry 202 , platform verifier circuitry 204 , and/or component circuitry 206 ).
- one or more of the attestation manager circuitry 202 , the platform verifier circuitry 204 , and/or the component circuitry 206 may form a portion of the compute engine 120 , the I/O subsystem 122 , the memory 124 , the data storage device 126 , the accelerator 130 , and/or other components of the edge device 102 . Additionally, in some embodiments, one or more of the illustrative components may form a portion of another component and/or one or more of the illustrative components may be independent of one another.
- the attestation manager 202 is configured to identify the components 206 included in the edge appliance device 102 a .
- the attestation manager 202 is further configured to perform an attestation process with each component 206 of the edge appliance device 102 a .
- the attestation process generates a component certificate for each component 206 .
- the component certificate is indicative of firmware 210 of the component 206 and/or a hardware or firmware configuration 212 of the component 206 .
- the attestation manager 202 is further configured to receive certified telemetry 214 from each component 206 .
- the certified telemetry 214 is indicative of current utilization of that component 206 .
- the platform verifier 204 is configured to generate an appliance certificate.
- the appliance certificate is indicative of the aggregated component certificate of the components 206 and a current utilization of the edge appliance device 102 a .
- the platform verifier 204 is further configured to provide the appliance certificate to a relying party.
- the relying party may be a remote edge orchestrator device 102 b or a platform active root of trust (e.g., accelerator 130 ).
- the platform active root of trust may be the platform verifier 204 where the platform verifier 204 is implemented in an accelerator 130 such as an FPGA.
- Each component 206 may be embodied as a compute engine 120 or other compute platform (e.g., processor, SoC, or other compute element and motherboard or other associated circuit board), a memory device 124 (e.g., a DIMM or other memory component), data storage device 126 , an accelerator 130 , a functional block, an IP block, or another component of the edge appliance device 102 .
- the components 206 may include one or more disaggregated components, such as memory sleds, storage sleds, compute sleds, accelerator sleds, or other rack-scale design disaggregated components.
- the component 206 includes an attester 208 that is configured to perform an attestation procedure including generating a component certificate for the component 206 .
- the component certificate is indicative of firmware 210 , a hardware or firmware configuration 212 , and/or certified telemetry 214 of the component.
- the component certificate may include or be based on a hash value indicative of the firmware 210 and/or the configuration 212 .
- the configuration 212 may be indicative of hardware features, firmware features, or other configuration of the component 206 .
- the component certificate may be indicative of a trusted execution environment provided by the component 206 , including one or more security properties of the trusted execution environment.
- an edge orchestrator device 102 b establishes an environment 220 during operation.
- the illustrative environment 220 includes a workload orchestrator 222 and an aggregated attestation manager 224 .
- the various components of the environment 220 may be embodied as hardware, firmware, software, or a combination thereof.
- one or more of the components of the environment 220 may be embodied as circuitry or collection of electrical devices (e.g., workload orchestrator circuitry 222 and/or aggregated attestation manager circuitry 224 ).
- one or more of the workload orchestrator circuitry 222 and/or the aggregated attestation manager circuitry 224 may form a portion of the compute engine 120 , the I/O subsystem 122 , the accelerator 130 , and/or other components of the edge device 102 . Additionally, in some embodiments, one or more of the illustrative components may form a portion of another component and/or one or more of the illustrative components may be independent of one another.
- the aggregated attestation manager 224 is configured to receive an appliance certificate from an edge appliance device 102 a .
- the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device 102 a .
- the aggregate component certificate is indicative of a configuration of each component 206 of the edge appliance device 102 a , including the firmware 210 and/or the configuration 210 .
- the aggregated attestation manager 224 is further configured to verify the appliance certificate. Verifying the appliance certificate may include comparing the appliance certificate to an expected certificate that is indicative of an expected configuration 210 of each component 206 the edge appliance device 102 a.
- the workload orchestrator 222 is configured to receive a workload scheduling request indicative of a service level agreement (SLA) requirement associated with a workload.
- the workload orchestrator 222 is further configured to determine whether the edge appliance device 102 a satisfies the SLA requirement based on the appliance certificate, and, if so, to schedule the workload to the edge appliance device 102 a .
- the workload orchestrator 222 may evaluate a security property of a trusted execution environment provided by the component 206 to determine whether the edge appliance device 102 a satisfies the SLA requirement.
- the aggregated attestation manager 224 may be configured to perform similar functions as the attestation manager 202 and/or the platform verifier 204 , whereby attestations between edge appliance devices 102 is managed (similarly to attestations between components 206 at the device level).
- the attestation manager 202 of the edge appliance device 102 may appear to the aggregated attestation manager 224 as though the attestation manager 202 were an attester 208 .
- each attestation manager 202 may forward attestations originating from an attester 208 or each attestation manager 202 may aggregate the attestations into a simplified attestation statement that speaks on behalf of the platform verification result (e.g., from the platform verifier 204 ).
- the edge appliance device 102 a may execute a method 300 for aggregated attestation. It should be appreciated that, in some embodiments, the operations of the method 300 may be performed by one or more components of the environment 200 of the edge appliance device 102 a as shown in FIG. 2 , such as the accelerator 130 .
- the method 300 begins in block 302 , in which the edge appliance device 102 a identifies or otherwise selects the components 206 included in the edge appliance device 102 a .
- the edge appliance device 102 b may select one or more accelerators 130 .
- the edge appliance device 102 b may select one or more compute platforms.
- Each compute platform may include a compute engine 120 and an associated motherboard or other supporting circuitry.
- the edge appliance device 102 b may select one or more memory or storage components.
- the edge appliance device 102 b may select one or more memory DIMMs, nonvolatile flash memory chips, SSDs, 3D XPoint memory DIMMs, or other volatile or nonvolatile memory or storage components.
- the edge appliance device 102 b may select one or more functional blocks, IP blocks, or other sub-components of an SoC or other computer chip.
- the edge appliance device 102 b may select one or more remote and/or disaggregated components 206 .
- the edge appliance device 102 b may identify one or more remote edge devices 102 , such as memory sleds, storage sleds, compute sleds, accelerator sleds, or other racks or rack-scale design disaggregated components.
- remote edge devices 102 such as memory sleds, storage sleds, compute sleds, accelerator sleds, or other racks or rack-scale design disaggregated components.
- the edge appliance device 102 a performs an attestation procedure with a component 206 of the edge appliance device 102 a .
- the edge appliance device 102 a receives a component certificate from the component 206 .
- the component certificate includes a verifiable assertion of the identity and configuration of the component 206 .
- the component certificate may be indicative of the firmware 210 version of the component 206 , particular hardware or firmware features of the component 206 , or other attributes of the component 206 .
- the component certificate may be indicative of particular security attributes of a trusted execution environment provided by the edge appliance device 102 a .
- the security attributes may indicate cryptographic or isolation protections available to code or data processed by the edge appliance device 102 a , such as secret keys or other sensitive data.
- the edge appliance device 102 a and the component 206 may perform any appropriate attestation protocol.
- the component 206 may perform Implicit Identity Based Device Attestation as published by the Trusted Computing Group (TCG).
- TCG Trusted Computing Group
- the attester 208 of the component 206 may be embodied as or otherwise include a trusted Device Identifier Composition Engine (DICE).
- the DICE measures a first mutable code of the component 206 (e.g., part or all of the firmware 210 ) and securely combines the measurement with a unique device secret (e.g., using a hash or one-way function) to generate a compound device identifier (CDI).
- CDI compound device identifier
- the component 206 derives an asymmetric key pair based on the CDI that is used as a device identity for the component 206 , and generates a certificate based on that key pair.
- the component 206 may derive an alias key based on the firmware 210 (e.g., based on updatable firmware 210 ) and use the device identifier to generate an alias certificate.
- the device certificate and the alias certificate are indicative of the identity of the component 206 (e.g., a unique device secret) and the configuration of component 206 (e.g., the contents of part or all of the firmware 210 ). Accordingly, the device certificate and/or the alias certificate may be used as the component certificate for the component 206 .
- the edge appliance device 102 a may verify the component certificate of the component 206 .
- the edge appliance device 102 a may verify the certificate using any appropriate verification technique. For example, for Implicit Identity Based Device Attestation, the edge appliance device 102 a may verify the certificate using the public key of the Device Identifier of the component 206 .
- the public key may be provided by the component 206 , and in some embodiments the public key may be certified by a trusted party such as a manufacturer, vendor, or other entity associated with the component 206 . If the certificate is not successfully verified, the edge appliance device 102 a may generate an error or otherwise indicate that the verification was not successful. Upon successful verification, the method 300 proceeds to block 320 .
- the edge appliance device 102 a may receive certified telemetry 214 from the component 206 .
- the certified telemetry 214 is indicative of utilization of the component 206 .
- the telemetry 214 may indicate processor utilization of a compute engine 120 , memory or storage utilization, or other utilization statistics.
- the telemetry 214 may be certified by the component 206 , for example by being signed with the device identifier, alias identifier, or other key of the component 206 .
- the edge appliance device 102 a may verify the certified telemetry 214 , for example using the device certificate.
- the edge appliance device 102 a determines whether additional components 206 remain for attestation. If so, the method 300 loops back to block 314 to continue performing attestation for the remaining components 206 . If no additional components remain, the method 300 advances to block 324 .
- the edge appliance device 102 a generates an appliance certificate.
- the appliance certificate is based on an aggregate certificate of all of the component certificates and the current utilization of the edge appliance device 102 a .
- the edge appliance device 102 a may concatenate the certificates of all the components 206 along with the current utilization, and then generate the appliance certificate over that concatenation.
- the edge appliance device 102 a provides the appliance certificate to a relying party.
- the edge appliance device 102 a may provide the appliance certificate to a remote edge orchestrator device 102 b .
- the edge appliance device 102 b may provide the appliance certificate to another edge device 102 .
- the appliance certificate may be provided to a platform active root of trust (e.g., an accelerator 130 ) of another edge device 102 .
- the system 100 may perform nested, aggregated attestation. After providing the appliance attestation, the method 300 loops back to block 302 to continue performing attestation.
- the edge orchestrator device 102 b may execute a method 400 for attestation and orchestration. It should be appreciated that, in some embodiments, the operations of the method 400 may be performed by one or more components of the environment 220 of the edge orchestrator device 102 b as shown in FIG. 2 .
- the method 400 begins in block 402 , in which the edge orchestrator device 102 b receives a workload scheduling request from a tenant. The request may identify one or more virtual machines, function as a service (FaaS) instances, or other workloads to be executed by an edge appliance device 102 a .
- the edge orchestrator device 102 b receives a service level agreement (SLA) requirement for the workload request.
- the SLA requirement may identify one or more processing capacity, latency, storage, or other requirements associated with the workload.
- the edge orchestrator device 102 b identifies the edge appliance device 102 a to execute the workload. For example, the edge orchestrator device 102 b may select the edge appliance device 102 a from a pool of available edge devices 102 . In some embodiments, the edge orchestrator device 102 b may compose the edge appliance device 102 a from multiple disaggregated components. For example, the edge orchestrator device 102 b may compose the edge appliance device 102 a from multiple compute sleds, accelerator sleds, memory sleds, storage sleds, and/or other edge devices 102 .
- the edge orchestrator device 102 b receives an appliance certificate from the edge appliance device 102 a .
- the appliance certificate is indicative of an aggregated component certificate for the components 206 of the edge appliance device 102 a and the current utilization of the edge appliance device 102 a.
- the edge orchestrator device 102 b verifies the appliance certificate.
- the edge orchestrator device 102 b may verify the component certificate for each component 206 of the edge appliance device 102 a , as well as the utilization information of the appliance certificate.
- the edge orchestrator device 102 b may compare each component certificate against a corresponding expected certificate.
- the expected certificate may be associated with, for example, an expected identity or expected firmware 210 version for each particular component 206 of the edge appliance device 102 a .
- the edge orchestrator device 102 b checks whether the appliance certificate was verified. If not, the method 400 loops back to block 402 to process additional workload requests. The edge orchestrator device 102 b may indicate an error or otherwise indicate that the appliance certificate was not verified. Referring back to block 414 , if the appliance certificate is successfully verified, the method 400 advances to block 416 .
- the edge orchestrator device 102 b compares the SLA requirement to the certified components 206 and utilization of the edge appliance device 102 a . For example, the edge orchestrator 102 b may determine whether the components 206 of the edge appliance device 102 a provide features or particular components requested by the SLA requirement. As another example, the edge orchestrator 102 b may determine whether the edge appliance device 102 a is capable of meeting performance or latency standards requested by the SLA requirement, based on the current utilization of the edge appliance device 102 a . In some embodiments, in block 418 the edge orchestrator device 102 b may evaluate one or more security capabilities of a trusted execution environment provided by the edge appliance device 102 a . For example, a compute engine 120 may provide a trusted execution environment such as an Intel® SGX secure enclave. The appliance certificate may indicate cryptographic or other isolation protections provided by the trusted execution environment to code, keys, or other sensitive data.
- a trusted execution environment such as an Intel® SGX secure enclave.
- the edge orchestrator device 102 b determines whether the edge appliance device 102 a satisfies the SLA requirement. If not, the method 400 loops back to block 402 to process additional workload requests. In some embodiments, the edge orchestrator device 102 b may indicate an error or otherwise indicate that the SLA requirement cannot be satisfied. Additionally or alternatively, in some embodiments the edge orchestrator device 102 b may suggest a reduced SLA based on the capabilities indicated in the appliance certificate. Referring back to block 420 , if the SLA requirements can be satisfied, the method 400 branches to block 422 , in which the edge orchestrator 102 b schedules the workload with the edge appliance device 102 a .
- the edge appliance device 102 a executes the workload using the components 206 .
- the workload may be executed within a trusted execution environment with protections indicated by the application certificate as described above.
- the method 400 loops back to block 402 to continue processing workload scheduling requests.
- diagram 500 shows an edge architecture that may include the system 100 .
- the edge architecture includes multiple tiers 502 , 504 , 506 , 508 .
- Each tier includes multiple nodes that may communicate via an edge fabric to other nodes of the same tier and/or nodes at other tiers.
- the endpoint devices 104 may be included in the things/endpoint tier 502 .
- the things/endpoint tier 502 may include large numbers of endpoint devices 104 that are heterogeneous, may be mobile, and are widely distributed geographically.
- the access/edge tier 504 may include access network components such as wireless towers, access points, base stations, intermediate nodes, gateways, fog nodes, central offices, and other access network or edge components.
- Components of the access/edge tier 504 may be distributed at the building, small cell, neighborhood, or cell scale. Thus, components of the access/edge tier 504 may be relatively close in physical proximity to components of the things/endpoint tier 502 .
- the core network tier 506 may include core network routers, network gateways, servers, and other more-centralized computing devices. Components of the core network tier 506 may be distributed regionally or nationally.
- the cloud/Internet tier 508 may include Internet backbone routers, cloud service providers, datacenters, and other cloud resources. The components of the cloud/Internet tier 508 may be distributed globally.
- the edge devices 102 may be included in all of the access/edge tier 504 , the core network tier 506 , and/or the cloud/Internet tier 508 .
- the edge architecture is organized according to a logical gradient 510 from global, cloud-based components toward local, endpoint devices.
- Components that are closer to the network edge i.e., closer to the endpoint tier 502
- network communications among components closer to the network edge may be faster and/or have lower latency as compared to communications that traverse through tiers closer to the network core.
- the same logical gradient 510 may apply to components within a tier.
- the access/edge tier 504 may include numerous, widely spread base stations, street cabinets, and other access nodes as well as less-numerous but more sophisticated central offices or other aggregation nodes.
- the system 100 may improve latency and performance as compared to traditional cloud-computing based FaaS architectures.
- the foregoing systems and methods may implemented in any environment (e.g., smart factories, smart cities, smart buildings, and the like) in which the devices are arranged and interoperate in a manner similar to that described with reference to FIG. 1 , though the names of the individual devices may differ from one implementation to the next.
- the above systems and methods may improve the accuracy, efficiency, and/or safety with which one or more manufacturing operations are performed, particularly in instances in which the operations are to be performed in real time or near real time (e.g., in which low latency is of high importance).
- the above systems and methods may improve the accuracy, efficiency, and/or safety in the operation of traffic control systems, environmental monitoring systems, and/or other automated or semi-automated systems.
- the above disclosure may applied to improve the operations of any systems that rely on sensors to collect and act upon the collected information (e.g., threat detection and evacuation management systems, video monitoring systems, elevator control systems, etc.).
- the methods 300 and/or 400 may be embodied as various instructions stored on a computer-readable media, which may be executed by the compute engine 120 , the I/O subsystem 122 , the accelerator 130 , and/or other components of the edge device 102 to cause the edge device 102 to perform the respective method 300 and/or 400 .
- the computer-readable media may be embodied as any type of media capable of being read by the edge device 102 including, but not limited to, the memory 124 , the data storage device 126 , firmware devices, other memory or data storage devices of the edge device 102 , portable media readable by a peripheral device of the edge device 102 , and/or other media.
- An embodiment of the technologies disclosed herein may include any one or more, and any combination of, the examples described below.
- Example 1 includes an edge appliance device for appliance attestation, the edge appliance device comprising an attestation manager to perform an attestation process with a component of the edge appliance device to generate a component certificate; and a platform verifier to (i) generate an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device, and (ii) provide the appliance certificate to a relying party.
- Example 2 includes the subject matter of Example 1, and wherein the edge appliance device comprises an accelerator, and wherein the accelerator comprises the attestation manager and the platform verifier.
- Example 3 includes the subject matter of any of Examples 1 and 2, and wherein the platform verifier is further to receive certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component; and to generate the appliance certificate comprises to generate the appliance certificate based on the current utilization of the component.
- Example 4 includes the subject matter of any of Examples 1-3, and wherein the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- Example 5 includes the subject matter of any of Examples 1-4, and wherein the component comprises a disaggregated resource of the edge appliance device.
- Example 6 includes the subject matter of any of Examples 1-5, and wherein the attestation manager is further to (i) identify a plurality of components of the edge appliance device, wherein the plurality of components comprises the component, and (ii) perform, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components; and the appliance certificate is indicative of the component certificate of each component of the plurality of components.
- Example 7 includes the subject matter of any of Examples 1-6, and wherein to perform the attestation process comprises to receive a component certificate indicative of a trusted execution environment provided by the component.
- Example 8 includes the subject matter of any of Examples 1-7, and wherein the component certificate is indicative of a security property of the trusted execution environment.
- Example 9 includes the subject matter of any of Examples 1-8, and wherein to perform the attestation process comprises to securely receive a component certificate indicative of a hardware configuration and a firmware configuration of the component.
- Example 10 includes the subject matter of any of Examples 1-9, and wherein the component certificate comprises a hash value indicative of the hardware configuration and the firmware configuration of the component.
- Example 11 includes the subject matter of any of Examples 1-10, and wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a remote orchestrator device.
- Example 12 includes the subject matter of any of Examples 1-11, and wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a platform active root of trust.
- Example 13 includes a computing device for appliance orchestration, the computing device comprising a workload orchestrator to receive a workload scheduling request, wherein the workload scheduling request is indicative of a service level agreement requirement associated with a workload; and an aggregated attestation manager to receive an appliance certificate from an edge appliance device, wherein the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device, wherein the aggregate component certificate is indicative of a configuration of each component of a plurality of components of the edge appliance device; wherein the workload orchestrator is further to (i) determine whether the edge appliance device satisfies the service level agreement requirement based on the appliance certificate, and (ii) schedule the workload to the edge appliance device in response to a determination that the edge appliance device satisfies the service level agreement requirement.
- Example 14 includes the subject matter of Example 13, and wherein the aggregated attestation manager is further to verify the appliance certificate in response to receipt of the appliance certificate; wherein to schedule the workload further comprises to schedule the workload in response to verification of the appliance certificate.
- Example 15 includes the subject matter of any of Examples 13 and 14, and wherein to verify the appliance certificate comprises to compare the appliance certificate to an expected certificate, wherein the expected certificate is indicative of an expected configuration of each component of the plurality of components of the edge appliance device.
- Example 16 includes the subject matter of any of Examples 13-15, and wherein the appliance certificate is indicative of trusted execution environment provided by the edge appliance device.
- Example 17 includes the subject matter of any of Examples 13-16, and wherein to determine whether the edge appliance device satisfies the service level agreement requirement comprises to evaluate a security property of the trusted execution environment.
- Example 18 includes a method for appliance attestation, the method comprising performing, by an edge appliance device, an attestation process with a component of the edge appliance device to generate a component certificate; generating, by the edge appliance device, an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device; and providing, by the edge appliance device, the appliance certificate to a relying party.
- Example 19 includes the subject matter of Example 18, and wherein performing the attestation process comprises performing the attestation process by an accelerator of the edge appliance device; generating the appliance certificate comprises generating the appliance certificate by the accelerator; and providing the appliance certificate comprises providing the appliance certificate by the accelerator.
- Example 20 includes the subject matter of any of Examples 18 and 19, and further including receiving, by the edge appliance device, certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component; wherein generating the appliance certificate comprises generating the appliance certificate based on the current utilization of the component.
- Example 21 includes the subject matter of any of Examples 18-20, and wherein the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- Example 22 includes the subject matter of any of Examples 18-21, and wherein the component comprises a disaggregated resource of the edge appliance device.
- Example 23 includes the subject matter of any of Examples 18-22, and further including identifying, by the edge appliance device, a plurality of components of the edge appliance device, wherein the plurality of components comprises the component; and performing, by the edge appliance device, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components; wherein the appliance certificate is indicative of the component certificate of each component of the plurality of components.
- Example 24 includes the subject matter of any of Examples 18-23, and wherein performing the attestation process comprises receiving a component certificate indicative of a trusted execution environment provided by the component.
- Example 25 includes the subject matter of any of Examples 18-24, and wherein the component certificate is indicative of a security property of the trusted execution environment.
- Example 26 includes the subject matter of any of Examples 18-25, and wherein performing the attestation process comprises securely receiving a component certificate indicative of a hardware configuration and a firmware configuration of the component.
- Example 27 includes the subject matter of any of Examples 18-26, and wherein the component certificate comprises a hash value indicative of the hardware configuration and the firmware configuration of the component.
- Example 28 includes the subject matter of any of Examples 18-27, and wherein providing the appliance certificate to the relying party comprises providing the appliance certificate to a remote orchestrator device.
- Example 29 includes the subject matter of any of Examples 18-28, and wherein providing the appliance certificate to the relying party comprises providing the appliance certificate to a platform active root of trust.
- Example 30 includes a method for appliance orchestration, the method comprising receiving, by a computing device, a workload scheduling request, wherein the workload scheduling request is indicative of a service level agreement requirement associated with a workload; receiving, by the computing device, an appliance certificate from an edge appliance device, wherein the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device, wherein the aggregate component certificate is indicative of a configuration of each component of a plurality of components of the edge appliance device; determining, by the computing device, whether the edge appliance device satisfies the service level agreement requirement based on the appliance certificate; and scheduling, by the computing device, the workload to the edge appliance device in response to determining that the edge appliance device satisfies the service level agreement requirement.
- Example 31 includes the subject matter of Example 30, and further including verifying, by the computing device, the appliance certificate in response to receiving the appliance certificate; wherein scheduling the workload further comprises scheduling the workload in response to verifying the appliance certificate.
- Example 32 includes the subject matter of any of Examples 30 and 31, and wherein verifying the appliance certificate comprises comparing the appliance certificate to an expected certificate, wherein the expected certificate is indicative of an expected configuration of each component of the plurality of components of the edge appliance device.
- Example 33 includes the subject matter of any of Examples 30-32, and wherein the appliance certificate is indicative of trusted execution environment provided by the edge appliance device.
- Example 34 includes the subject matter of any of Examples 30-33, and wherein determining whether the edge appliance device satisfies the service level agreement requirement comprises evaluating a security property of the trusted execution environment.
- Example 35 includes a computing device comprising a processor; and a memory having stored therein a plurality of instructions that when executed by the processor cause the computing device to perform the method of any of Examples 18-34.
- Example 36 includes one or more non-transitory, computer readable storage media comprising a plurality of instructions stored thereon that in response to being executed result in a computing device performing the method of any of Examples 18-34.
- Example 37 includes a computing device comprising means for performing the method of any of Examples 18-34.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Technologies for accelerated orchestration and attestation include multiple edge devices. An edge appliance device performs an attestation process with each of its components to generate component certificates. The edge appliance device generates an appliance certificate that is indicative of the component certificates and a current utilization of the edge appliance device and provides the appliance certificate to a relying party. The relying party may be an edge orchestrator device. The edge orchestrator device receives a workload scheduling request with a service level agreement requirement. The edge orchestrator device verifies the appliance certificate and determines whether the service level agreement requirement is satisfied based on the appliance certificate. If satisfied, the workload is scheduled to the edge appliance device. Attestation and generation of the appliance certificate by the edge appliance device may be performed by an accelerator of the edge appliance device. Other embodiments are described and claimed.
Description
- This patent arises from a continuation of U.S. patent application Ser. No. 16/368,980, (now U.S. Patent ______) which was filed on Mar. 29, 2019. U.S. patent application Ser. No. 16/368,980 is hereby incorporated herein by reference in its entirety. Priority to U.S. patent application Ser. No. 16/368,980 is hereby claimed.
- Certain cloud computing architectures may provide function as a service (FaaS) services. Typical FaaS systems allow a client to invoke a particular function on-demand, without executing a dedicated service process. A FaaS function may be performed by an appliance composed of multiple components. The number or amount of users executing FaaS services may be unbounded.
- The concepts described herein are illustrated by way of example and not by way of limitation in the accompanying figures. For simplicity and clarity of illustration, elements illustrated in the figures are not necessarily drawn to scale. Where considered appropriate, reference labels have been repeated among the figures to indicate corresponding or analogous elements.
-
FIG. 1 is a simplified block diagram of at least one embodiment of a system for accelerated orchestration and attestation; -
FIG. 2 is a simplified block diagram of at least one embodiment of various environments of the system ofFIG. 1 ; -
FIG. 3 is a simplified flow diagram of at least one embodiment of a method for aggregated attestation that may be executed by an edge appliance device of the system ofFIGS. 1-2 ; -
FIG. 4 is a simplified flow diagram of at least one embodiment of a method for attestation and orchestration that may be executed by an edge orchestrator device of the system ofFIGS. 1-2 ; and -
FIG. 5 is a simplified block diagram of at least one embodiment of an edge architecture that may include the system ofFIGS. 1-2 . - While the concepts of the present disclosure are susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will be described herein in detail. It should be understood, however, that there is no intent to limit the concepts of the present disclosure to the particular forms disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives consistent with the present disclosure and the appended claims.
- References in the specification to “one embodiment,” “an embodiment,” “an illustrative embodiment,” etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may or may not necessarily include that particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described. Additionally, it should be appreciated that items included in a list in the form of “at least one A, B, and C” can mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C). Similarly, items listed in the form of “at least one of A, B, or C” can mean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).
- The disclosed embodiments may be implemented, in some cases, in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried by or stored on a transitory or non-transitory machine-readable (e.g., computer-readable) storage medium, which may be read and executed by one or more processors. Furthermore, the disclosed embodiments may be initially encoded as a set of preliminary instructions (e.g., encoded on a machine-readable storage medium) that may require a preliminary processing operations to prepare the instructions for execution on a destination device. The preliminary processing may include combining the instructions with data present on a device, translating the instructions to a different format, performing compression, decompression, encryption, and/or decryption, combining multiple files that include different sections of the instructions, integrating the instructions with other code present on a device, such as a library, an operating system, etc., or similar operations. The preliminary processing may be performed by the source compute device (e.g., the device that is to send the instructions), the destination compute device (e.g., the device that is to execute the instructions), or an intermediary device. A machine-readable storage medium may be embodied as any storage device, mechanism, or other physical structure for storing or transmitting information in a form readable by a machine (e.g., a volatile or non-volatile memory, a media disc, or other media device).
- In the drawings, some structural or method features may be shown in specific arrangements and/or orderings. However, it should be appreciated that such specific arrangements and/or orderings may not be required. Rather, in some embodiments, such features may be arranged in a different manner and/or order than shown in the illustrative figures. Additionally, the inclusion of a structural or method feature in a particular figure is not meant to imply that such feature is required in all embodiments and, in some embodiments, may not be included or may be combined with other features.
- Referring now to
FIG. 1 , asystem 100 for accelerated orchestration and attestation includesmultiple edge devices 102 andmultiple endpoint devices 104. In use, as described further below, one ormore edge devices 102 may be composed into or otherwise establish anedge appliance device 102 to perform a function-as-a-service (FaaS) request or other service. Theedge appliance device 102 generates an appliance certificate using accelerated logic. The appliance certificate attests to the configuration and utilization of one or more components of theedge appliance device 102. Theedge appliance device 102 provides the appliance certificate to an orchestrator, such as anedge orchestrator device 102. Theedge orchestrator device 102 verifies the appliance certificate and compares the appliance certificate to a service level agreement (SLA) requirement associated with a tenant workload. Thus, thesystem 100 allows for verification of the complete root of trust for components of an edge appliance, with low latency. Additionally, thesystem 100 allows for a workload plan to be verified before issuing an SLA, which extends the root of trust verification to extend into workload scheduling. - Each
edge device 102 may be embodied as any type of device capable of performing the functions described herein. For example, theedge device 102 may be embodied as, without limitation, a computer, a server, a workstation, a multiprocessor system, a distributed computing device, a switch, a router, a network device, a virtualized system (e.g., one or more functions executed in virtualized environment(s), such as virtual machine(s) or container(s), in which the underlying hardware resources appear as physical hardware to software executing in the virtualized environment(s), but are separated from the software by an abstraction layer), and/or a consumer electronic device. Additionally or alternatively, theedge device 102 may be embodied as a one or more compute sleds, memory sleds, or other racks, sleds, computing chassis, or other components of a physically disaggregated computing device. As shown inFIG. 1 , theillustrative edge device 102 includes acompute engine 120, an I/O subsystem 122, amemory 124, adata storage device 126, and acommunication subsystem 128. Additionally, in some embodiments, one or more of the illustrative components may be incorporated in, or otherwise form a portion of, another component. For example, thememory 124, or portions thereof, may be incorporated in thecompute engine 120 in some embodiments. - The
compute engine 120 may be embodied as any type of compute engine capable of performing the functions described herein. For example, thecompute engine 120 may be embodied as a single or multi-core processor(s), digital signal processor, microcontroller, field-programmable gate array (FPGA), or other configurable circuitry, application-specific integrated circuit (ASIC), or other processor or processing/controlling circuit or virtualized version thereof. Similarly, thememory 124 may be embodied as any type of volatile or non-volatile memory or data storage capable of performing the functions described herein. In operation, thememory 124 may store various data and software used during operation of theedge device 102 such as operating systems, applications, programs, libraries, and drivers. As shown, thememory 124 may be communicatively coupled to thecompute engine 120 via the I/O subsystem 122, which may be embodied as circuitry and/or components to facilitate input/output operations with thecompute engine 120, thememory 124, and other components of theedge device 102. For example, the I/O subsystem 122 may be embodied as, or otherwise include, memory controller hubs, input/output control hubs, sensor hubs, host controllers, firmware devices, communication links (i.e., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.) and/or other components and subsystems to facilitate the input/output operations. In some embodiments, thememory 124 may be directly coupled to thecompute engine 120, for example via an integrated memory controller hub. Additionally, in some embodiments, the I/O subsystem 122 may form a portion of a system-on-a-chip (SoC) and be incorporated, along with thecompute engine 120, thememory 124, theaccelerator 130, and/or other components of theedge device 102, on a single integrated circuit chip. - The
data storage device 126 may be embodied as any type of device or devices configured for short-term or long-term storage of data such as, for example, memory devices and circuits, memory cards, hard disk drives, solid-state drives, non-volatile flash memory, or other data storage devices. Thecommunications subsystem 128 may be embodied as any communication circuit, device, or collection thereof, capable of enabling communications between theedge device 102 and other remote devices over thenetwork 106. Thecommunications subsystem 128 may be configured to use any one or more communication technology (e.g., wired or wireless communications) and associated protocols (e.g., Ethernet, Bluetooth®, WiMAX, 3G, 4G LTE, 5G, etc.) to effect such communication. - The
accelerator 130 may be embodied as a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a coprocessor, or other digital logic device capable of performing accelerated functions (e.g., accelerated application functions, accelerated network functions, or other accelerated functions). Illustratively, theaccelerator 130 is an FPGA, which may be embodied as an integrated circuit including programmable digital logic resources that may be configured after manufacture. The FPGA may include, for example, a configurable array of logic blocks in communication over a configurable data interchange. Theaccelerator 130 may be coupled to thecompute engine 120 via a high-speed connection interface such as a peripheral bus (e.g., a PCI Express bus) or an inter-processor interconnect (e.g., an in-die interconnect (IDI) or QuickPath Interconect (QPI)), or via any other appropriate interconnect. In some embodiments, theaccelerator 130 may be incorporated in or otherwise coupled with one or more other components of theedge device 102, such as a network interface controller (NIC) of thecommunication subsystem 128. - Each
endpoint device 104 may be embodied as any type of computation or computer device capable of performing the functions described herein, including, without limitation, a computer, a mobile computing device, a wearable computing device, a network appliance, a web appliance, a distributed computing system, an autonomous vehicle, an autonomous aerial vehicle, an Internet of Things (IoT) sensor, an IoT gateway, an industrial automation device, a processor-based system, and/or a consumer electronic device. As such, eachendpoint device 104 may include components and features similar to theedge device 102, such as acompute engine 120, I/O subsystem 122,memory 124,data storage 126,communication subsystem 128, and/or various peripheral devices. Those individual components of eachendpoint device 104 may be similar to the corresponding components of theedge device 102, the description of which is applicable to the corresponding components of theendpoint device 104 and is not repeated for clarity of the present description. - As discussed in more detail below, the
edge devices 102 and theendpoint devices 104 may be configured to transmit and receive data with each other and/or other devices of thesystem 100 over thenetwork 106. Thenetwork 106 may be embodied as any number of various wired and/or wireless networks, or hybrids or combinations thereof. For example, thenetwork 106 may be embodied as, or otherwise include a mobile access network, a network edge infrastructure, a wired or wireless local area network (LAN), and/or a wired or wireless wide area network (WAN). As such, thenetwork 106 may include any number of additional devices, such as additional base stations, access points, computers, routers, and switches, to facilitate communications among the devices of thesystem 100. In the illustrative embodiment, thenetwork 106 is embodied as an edge network fabric. - Referring now to
FIG. 2 , in an illustrative embodiment, eachedge appliance device 102 a establishes anenvironment 200 during operation. Theillustrative environment 200 includes theaccelerator 130 and one ormore components 206. Theaccelerator 130 includes anattestation manager 202 and aplatform verifier 204. Eachcomponent 206 includes anattester 208. The various components of theenvironment 200 may be embodied as hardware, firmware, software, or a combination thereof. As such, in some embodiments, one or more of the components of theenvironment 200 may be embodied as circuitry or collection of electrical devices (e.g.,attestation manager circuitry 202,platform verifier circuitry 204, and/or component circuitry 206). It should be appreciated that, in such embodiments, one or more of theattestation manager circuitry 202, theplatform verifier circuitry 204, and/or thecomponent circuitry 206 may form a portion of thecompute engine 120, the I/O subsystem 122, thememory 124, thedata storage device 126, theaccelerator 130, and/or other components of theedge device 102. Additionally, in some embodiments, one or more of the illustrative components may form a portion of another component and/or one or more of the illustrative components may be independent of one another. - The
attestation manager 202 is configured to identify thecomponents 206 included in theedge appliance device 102 a. Theattestation manager 202 is further configured to perform an attestation process with eachcomponent 206 of theedge appliance device 102 a. The attestation process generates a component certificate for eachcomponent 206. The component certificate is indicative offirmware 210 of thecomponent 206 and/or a hardware orfirmware configuration 212 of thecomponent 206. Theattestation manager 202 is further configured to receivecertified telemetry 214 from eachcomponent 206. Thecertified telemetry 214 is indicative of current utilization of thatcomponent 206. - The
platform verifier 204 is configured to generate an appliance certificate. The appliance certificate is indicative of the aggregated component certificate of thecomponents 206 and a current utilization of theedge appliance device 102 a. Theplatform verifier 204 is further configured to provide the appliance certificate to a relying party. For example, the relying party may be a remoteedge orchestrator device 102 b or a platform active root of trust (e.g., accelerator 130). For example, the platform active root of trust may be theplatform verifier 204 where theplatform verifier 204 is implemented in anaccelerator 130 such as an FPGA. - Each
component 206 may be embodied as acompute engine 120 or other compute platform (e.g., processor, SoC, or other compute element and motherboard or other associated circuit board), a memory device 124 (e.g., a DIMM or other memory component),data storage device 126, anaccelerator 130, a functional block, an IP block, or another component of theedge appliance device 102. In some embodiments, thecomponents 206 may include one or more disaggregated components, such as memory sleds, storage sleds, compute sleds, accelerator sleds, or other rack-scale design disaggregated components. Thecomponent 206 includes anattester 208 that is configured to perform an attestation procedure including generating a component certificate for thecomponent 206. The component certificate is indicative offirmware 210, a hardware orfirmware configuration 212, and/orcertified telemetry 214 of the component. For example, the component certificate may include or be based on a hash value indicative of thefirmware 210 and/or theconfiguration 212. Theconfiguration 212 may be indicative of hardware features, firmware features, or other configuration of thecomponent 206. For example, the component certificate may be indicative of a trusted execution environment provided by thecomponent 206, including one or more security properties of the trusted execution environment. - Still referring to
FIG. 2 , in the illustrative embodiment, anedge orchestrator device 102 b establishes anenvironment 220 during operation. Theillustrative environment 220 includes aworkload orchestrator 222 and an aggregatedattestation manager 224. The various components of theenvironment 220 may be embodied as hardware, firmware, software, or a combination thereof. As such, in some embodiments, one or more of the components of theenvironment 220 may be embodied as circuitry or collection of electrical devices (e.g.,workload orchestrator circuitry 222 and/or aggregated attestation manager circuitry 224). It should be appreciated that, in such embodiments, one or more of theworkload orchestrator circuitry 222 and/or the aggregatedattestation manager circuitry 224 may form a portion of thecompute engine 120, the I/O subsystem 122, theaccelerator 130, and/or other components of theedge device 102. Additionally, in some embodiments, one or more of the illustrative components may form a portion of another component and/or one or more of the illustrative components may be independent of one another. - The aggregated
attestation manager 224 is configured to receive an appliance certificate from anedge appliance device 102 a. As described above, the appliance certificate is indicative of an aggregate component certificate and a current utilization of theedge appliance device 102 a. The aggregate component certificate is indicative of a configuration of eachcomponent 206 of theedge appliance device 102 a, including thefirmware 210 and/or theconfiguration 210. The aggregatedattestation manager 224 is further configured to verify the appliance certificate. Verifying the appliance certificate may include comparing the appliance certificate to an expected certificate that is indicative of an expectedconfiguration 210 of eachcomponent 206 theedge appliance device 102 a. - The
workload orchestrator 222 is configured to receive a workload scheduling request indicative of a service level agreement (SLA) requirement associated with a workload. Theworkload orchestrator 222 is further configured to determine whether theedge appliance device 102 a satisfies the SLA requirement based on the appliance certificate, and, if so, to schedule the workload to theedge appliance device 102 a. For example, theworkload orchestrator 222 may evaluate a security property of a trusted execution environment provided by thecomponent 206 to determine whether theedge appliance device 102 a satisfies the SLA requirement. - Additionally or alternatively, in some embodiments the aggregated
attestation manager 224 may be configured to perform similar functions as theattestation manager 202 and/or theplatform verifier 204, whereby attestations betweenedge appliance devices 102 is managed (similarly to attestations betweencomponents 206 at the device level). In those embodiments, theattestation manager 202 of theedge appliance device 102 may appear to the aggregatedattestation manager 224 as though theattestation manager 202 were anattester 208. In those embodiments, eachattestation manager 202 may forward attestations originating from anattester 208 or eachattestation manager 202 may aggregate the attestations into a simplified attestation statement that speaks on behalf of the platform verification result (e.g., from the platform verifier 204). - Referring now to
FIG. 3 , in use, theedge appliance device 102 a may execute amethod 300 for aggregated attestation. It should be appreciated that, in some embodiments, the operations of themethod 300 may be performed by one or more components of theenvironment 200 of theedge appliance device 102 a as shown inFIG. 2 , such as theaccelerator 130. Themethod 300 begins inblock 302, in which theedge appliance device 102 a identifies or otherwise selects thecomponents 206 included in theedge appliance device 102 a. In some embodiments, inblock 304, theedge appliance device 102 b may select one ormore accelerators 130. In some embodiments, inblock 306 theedge appliance device 102 b may select one or more compute platforms. Each compute platform may include acompute engine 120 and an associated motherboard or other supporting circuitry. In some embodiments, inblock 308 theedge appliance device 102 b may select one or more memory or storage components. For example, theedge appliance device 102 b may select one or more memory DIMMs, nonvolatile flash memory chips, SSDs, 3D XPoint memory DIMMs, or other volatile or nonvolatile memory or storage components. In some embodiments, inblock 310 theedge appliance device 102 b may select one or more functional blocks, IP blocks, or other sub-components of an SoC or other computer chip. In some embodiments, inblock 312 theedge appliance device 102 b may select one or more remote and/or disaggregatedcomponents 206. For example, theedge appliance device 102 b may identify one or moreremote edge devices 102, such as memory sleds, storage sleds, compute sleds, accelerator sleds, or other racks or rack-scale design disaggregated components. - In
block 314, theedge appliance device 102 a performs an attestation procedure with acomponent 206 of theedge appliance device 102 a. During the attestation procedure, inblock 316 theedge appliance device 102 a receives a component certificate from thecomponent 206. The component certificate includes a verifiable assertion of the identity and configuration of thecomponent 206. Thus, the component certificate may be indicative of thefirmware 210 version of thecomponent 206, particular hardware or firmware features of thecomponent 206, or other attributes of thecomponent 206. For example, the component certificate may be indicative of particular security attributes of a trusted execution environment provided by theedge appliance device 102 a. The security attributes may indicate cryptographic or isolation protections available to code or data processed by theedge appliance device 102 a, such as secret keys or other sensitive data. - The
edge appliance device 102 a and thecomponent 206 may perform any appropriate attestation protocol. For example, in some embodiments, thecomponent 206 may perform Implicit Identity Based Device Attestation as published by the Trusted Computing Group (TCG). In those embodiments, theattester 208 of thecomponent 206 may be embodied as or otherwise include a trusted Device Identifier Composition Engine (DICE). The DICE measures a first mutable code of the component 206 (e.g., part or all of the firmware 210) and securely combines the measurement with a unique device secret (e.g., using a hash or one-way function) to generate a compound device identifier (CDI). Thecomponent 206 derives an asymmetric key pair based on the CDI that is used as a device identity for thecomponent 206, and generates a certificate based on that key pair. In some embodiments, thecomponent 206 may derive an alias key based on the firmware 210 (e.g., based on updatable firmware 210) and use the device identifier to generate an alias certificate. Thus, the device certificate and the alias certificate are indicative of the identity of the component 206 (e.g., a unique device secret) and the configuration of component 206 (e.g., the contents of part or all of the firmware 210). Accordingly, the device certificate and/or the alias certificate may be used as the component certificate for thecomponent 206. - In
block 318, theedge appliance device 102 a may verify the component certificate of thecomponent 206. Theedge appliance device 102 a may verify the certificate using any appropriate verification technique. For example, for Implicit Identity Based Device Attestation, theedge appliance device 102 a may verify the certificate using the public key of the Device Identifier of thecomponent 206. The public key may be provided by thecomponent 206, and in some embodiments the public key may be certified by a trusted party such as a manufacturer, vendor, or other entity associated with thecomponent 206. If the certificate is not successfully verified, theedge appliance device 102 a may generate an error or otherwise indicate that the verification was not successful. Upon successful verification, themethod 300 proceeds to block 320. - In
block 320, theedge appliance device 102 a may receivecertified telemetry 214 from thecomponent 206. Thecertified telemetry 214 is indicative of utilization of thecomponent 206. For example, thetelemetry 214 may indicate processor utilization of acompute engine 120, memory or storage utilization, or other utilization statistics. Thetelemetry 214 may be certified by thecomponent 206, for example by being signed with the device identifier, alias identifier, or other key of thecomponent 206. Theedge appliance device 102 a may verify thecertified telemetry 214, for example using the device certificate. - In
block 322, theedge appliance device 102 a determines whetheradditional components 206 remain for attestation. If so, themethod 300 loops back to block 314 to continue performing attestation for the remainingcomponents 206. If no additional components remain, themethod 300 advances to block 324. - In
block 324, theedge appliance device 102 a generates an appliance certificate. The appliance certificate is based on an aggregate certificate of all of the component certificates and the current utilization of theedge appliance device 102 a. For example, theedge appliance device 102 a may concatenate the certificates of all thecomponents 206 along with the current utilization, and then generate the appliance certificate over that concatenation. - In
block 326, theedge appliance device 102 a provides the appliance certificate to a relying party. In some embodiments, inblock 328 theedge appliance device 102 a may provide the appliance certificate to a remoteedge orchestrator device 102 b. In some embodiments, inblock 330 theedge appliance device 102 b may provide the appliance certificate to anotheredge device 102. For example, the appliance certificate may be provided to a platform active root of trust (e.g., an accelerator 130) of anotheredge device 102. Thus, thesystem 100 may perform nested, aggregated attestation. After providing the appliance attestation, themethod 300 loops back to block 302 to continue performing attestation. - Referring now to
FIG. 4 , in use, theedge orchestrator device 102 b may execute amethod 400 for attestation and orchestration. It should be appreciated that, in some embodiments, the operations of themethod 400 may be performed by one or more components of theenvironment 220 of theedge orchestrator device 102 b as shown inFIG. 2 . Themethod 400 begins inblock 402, in which theedge orchestrator device 102 b receives a workload scheduling request from a tenant. The request may identify one or more virtual machines, function as a service (FaaS) instances, or other workloads to be executed by anedge appliance device 102 a. Inblock 404, theedge orchestrator device 102 b receives a service level agreement (SLA) requirement for the workload request. The SLA requirement may identify one or more processing capacity, latency, storage, or other requirements associated with the workload. - In
block 406, theedge orchestrator device 102 b identifies theedge appliance device 102 a to execute the workload. For example, theedge orchestrator device 102 b may select theedge appliance device 102 a from a pool ofavailable edge devices 102. In some embodiments, theedge orchestrator device 102 b may compose theedge appliance device 102 a from multiple disaggregated components. For example, theedge orchestrator device 102 b may compose theedge appliance device 102 a from multiple compute sleds, accelerator sleds, memory sleds, storage sleds, and/orother edge devices 102. - In
block 408, theedge orchestrator device 102 b receives an appliance certificate from theedge appliance device 102 a. As described above, the appliance certificate is indicative of an aggregated component certificate for thecomponents 206 of theedge appliance device 102 a and the current utilization of theedge appliance device 102 a. - In
block 410 theedge orchestrator device 102 b verifies the appliance certificate. Theedge orchestrator device 102 b may verify the component certificate for eachcomponent 206 of theedge appliance device 102 a, as well as the utilization information of the appliance certificate. Inblock 412, theedge orchestrator device 102 b may compare each component certificate against a corresponding expected certificate. The expected certificate may be associated with, for example, an expected identity or expectedfirmware 210 version for eachparticular component 206 of theedge appliance device 102 a. Inblock 414, theedge orchestrator device 102 b checks whether the appliance certificate was verified. If not, themethod 400 loops back to block 402 to process additional workload requests. Theedge orchestrator device 102 b may indicate an error or otherwise indicate that the appliance certificate was not verified. Referring back to block 414, if the appliance certificate is successfully verified, themethod 400 advances to block 416. - In
block 416, theedge orchestrator device 102 b compares the SLA requirement to thecertified components 206 and utilization of theedge appliance device 102 a. For example, theedge orchestrator 102 b may determine whether thecomponents 206 of theedge appliance device 102 a provide features or particular components requested by the SLA requirement. As another example, theedge orchestrator 102 b may determine whether theedge appliance device 102 a is capable of meeting performance or latency standards requested by the SLA requirement, based on the current utilization of theedge appliance device 102 a. In some embodiments, inblock 418 theedge orchestrator device 102 b may evaluate one or more security capabilities of a trusted execution environment provided by theedge appliance device 102 a. For example, acompute engine 120 may provide a trusted execution environment such as an Intel® SGX secure enclave. The appliance certificate may indicate cryptographic or other isolation protections provided by the trusted execution environment to code, keys, or other sensitive data. - In
block 420, theedge orchestrator device 102 b determines whether theedge appliance device 102 a satisfies the SLA requirement. If not, themethod 400 loops back to block 402 to process additional workload requests. In some embodiments, theedge orchestrator device 102 b may indicate an error or otherwise indicate that the SLA requirement cannot be satisfied. Additionally or alternatively, in some embodiments theedge orchestrator device 102 b may suggest a reduced SLA based on the capabilities indicated in the appliance certificate. Referring back to block 420, if the SLA requirements can be satisfied, themethod 400 branches to block 422, in which theedge orchestrator 102 b schedules the workload with theedge appliance device 102 a. Theedge appliance device 102 a executes the workload using thecomponents 206. For example, the workload may be executed within a trusted execution environment with protections indicated by the application certificate as described above. After scheduling the workload, themethod 400 loops back to block 402 to continue processing workload scheduling requests. - Referring now to
FIG. 5 , diagram 500 shows an edge architecture that may include thesystem 100. As shown, the edge architecture includesmultiple tiers endpoint devices 104 may be included in the things/endpoint tier 502. The things/endpoint tier 502 may include large numbers ofendpoint devices 104 that are heterogeneous, may be mobile, and are widely distributed geographically. The access/edge tier 504 may include access network components such as wireless towers, access points, base stations, intermediate nodes, gateways, fog nodes, central offices, and other access network or edge components. Components of the access/edge tier 504 may be distributed at the building, small cell, neighborhood, or cell scale. Thus, components of the access/edge tier 504 may be relatively close in physical proximity to components of the things/endpoint tier 502. Thecore network tier 506 may include core network routers, network gateways, servers, and other more-centralized computing devices. Components of thecore network tier 506 may be distributed regionally or nationally. The cloud/Internet tier 508 may include Internet backbone routers, cloud service providers, datacenters, and other cloud resources. The components of the cloud/Internet tier 508 may be distributed globally. As shown, the edge devices 102 (e.g., theedge appliance devices 102 a and/or theedge orchestrator devices 102 b) may be included in all of the access/edge tier 504, thecore network tier 506, and/or the cloud/Internet tier 508. - As shown, the edge architecture is organized according to a
logical gradient 510 from global, cloud-based components toward local, endpoint devices. Components that are closer to the network edge (i.e., closer to the endpoint tier 502) may be smaller but more numerous, with fewer processing resources and lower power consumption, as compared to components that are closer to the network core (i.e., closer to the cloud/Internet tier 508). However, network communications among components closer to the network edge may be faster and/or have lower latency as compared to communications that traverse through tiers closer to the network core. The samelogical gradient 510 may apply to components within a tier. For example, the access/edge tier 504 may include numerous, widely spread base stations, street cabinets, and other access nodes as well as less-numerous but more sophisticated central offices or other aggregation nodes. Thus, by including key caching functionality in the access/edge tier 504 or other components close to the network edge (e.g., logically close to the endpoint devices 104), thesystem 100 may improve latency and performance as compared to traditional cloud-computing based FaaS architectures. - In addition to the mobile edge computing implementation described above, it should be appreciated that the foregoing systems and methods may implemented in any environment (e.g., smart factories, smart cities, smart buildings, and the like) in which the devices are arranged and interoperate in a manner similar to that described with reference to
FIG. 1 , though the names of the individual devices may differ from one implementation to the next. For example, in a smart factory, the above systems and methods may improve the accuracy, efficiency, and/or safety with which one or more manufacturing operations are performed, particularly in instances in which the operations are to be performed in real time or near real time (e.g., in which low latency is of high importance). In a smart city, the above systems and methods may improve the accuracy, efficiency, and/or safety in the operation of traffic control systems, environmental monitoring systems, and/or other automated or semi-automated systems. Likewise, in a smart building, the above disclosure may applied to improve the operations of any systems that rely on sensors to collect and act upon the collected information (e.g., threat detection and evacuation management systems, video monitoring systems, elevator control systems, etc.). - It should be appreciated that, in some embodiments, the
methods 300 and/or 400 may be embodied as various instructions stored on a computer-readable media, which may be executed by thecompute engine 120, the I/O subsystem 122, theaccelerator 130, and/or other components of theedge device 102 to cause theedge device 102 to perform therespective method 300 and/or 400. The computer-readable media may be embodied as any type of media capable of being read by theedge device 102 including, but not limited to, thememory 124, thedata storage device 126, firmware devices, other memory or data storage devices of theedge device 102, portable media readable by a peripheral device of theedge device 102, and/or other media. - Illustrative examples of the technologies disclosed herein are provided below. An embodiment of the technologies may include any one or more, and any combination of, the examples described below.
- Example 1 includes an edge appliance device for appliance attestation, the edge appliance device comprising an attestation manager to perform an attestation process with a component of the edge appliance device to generate a component certificate; and a platform verifier to (i) generate an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device, and (ii) provide the appliance certificate to a relying party.
- Example 2 includes the subject matter of Example 1, and wherein the edge appliance device comprises an accelerator, and wherein the accelerator comprises the attestation manager and the platform verifier.
- Example 3 includes the subject matter of any of Examples 1 and 2, and wherein the platform verifier is further to receive certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component; and to generate the appliance certificate comprises to generate the appliance certificate based on the current utilization of the component.
- Example 4 includes the subject matter of any of Examples 1-3, and wherein the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- Example 5 includes the subject matter of any of Examples 1-4, and wherein the component comprises a disaggregated resource of the edge appliance device.
- Example 6 includes the subject matter of any of Examples 1-5, and wherein the attestation manager is further to (i) identify a plurality of components of the edge appliance device, wherein the plurality of components comprises the component, and (ii) perform, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components; and the appliance certificate is indicative of the component certificate of each component of the plurality of components.
- Example 7 includes the subject matter of any of Examples 1-6, and wherein to perform the attestation process comprises to receive a component certificate indicative of a trusted execution environment provided by the component.
- Example 8 includes the subject matter of any of Examples 1-7, and wherein the component certificate is indicative of a security property of the trusted execution environment.
- Example 9 includes the subject matter of any of Examples 1-8, and wherein to perform the attestation process comprises to securely receive a component certificate indicative of a hardware configuration and a firmware configuration of the component.
- Example 10 includes the subject matter of any of Examples 1-9, and wherein the component certificate comprises a hash value indicative of the hardware configuration and the firmware configuration of the component.
- Example 11 includes the subject matter of any of Examples 1-10, and wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a remote orchestrator device.
- Example 12 includes the subject matter of any of Examples 1-11, and wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a platform active root of trust.
- Example 13 includes a computing device for appliance orchestration, the computing device comprising a workload orchestrator to receive a workload scheduling request, wherein the workload scheduling request is indicative of a service level agreement requirement associated with a workload; and an aggregated attestation manager to receive an appliance certificate from an edge appliance device, wherein the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device, wherein the aggregate component certificate is indicative of a configuration of each component of a plurality of components of the edge appliance device; wherein the workload orchestrator is further to (i) determine whether the edge appliance device satisfies the service level agreement requirement based on the appliance certificate, and (ii) schedule the workload to the edge appliance device in response to a determination that the edge appliance device satisfies the service level agreement requirement.
- Example 14 includes the subject matter of Example 13, and wherein the aggregated attestation manager is further to verify the appliance certificate in response to receipt of the appliance certificate; wherein to schedule the workload further comprises to schedule the workload in response to verification of the appliance certificate.
- Example 15 includes the subject matter of any of Examples 13 and 14, and wherein to verify the appliance certificate comprises to compare the appliance certificate to an expected certificate, wherein the expected certificate is indicative of an expected configuration of each component of the plurality of components of the edge appliance device.
- Example 16 includes the subject matter of any of Examples 13-15, and wherein the appliance certificate is indicative of trusted execution environment provided by the edge appliance device.
- Example 17 includes the subject matter of any of Examples 13-16, and wherein to determine whether the edge appliance device satisfies the service level agreement requirement comprises to evaluate a security property of the trusted execution environment.
- Example 18 includes a method for appliance attestation, the method comprising performing, by an edge appliance device, an attestation process with a component of the edge appliance device to generate a component certificate; generating, by the edge appliance device, an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device; and providing, by the edge appliance device, the appliance certificate to a relying party.
- Example 19 includes the subject matter of Example 18, and wherein performing the attestation process comprises performing the attestation process by an accelerator of the edge appliance device; generating the appliance certificate comprises generating the appliance certificate by the accelerator; and providing the appliance certificate comprises providing the appliance certificate by the accelerator.
- Example 20 includes the subject matter of any of Examples 18 and 19, and further including receiving, by the edge appliance device, certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component; wherein generating the appliance certificate comprises generating the appliance certificate based on the current utilization of the component.
- Example 21 includes the subject matter of any of Examples 18-20, and wherein the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
- Example 22 includes the subject matter of any of Examples 18-21, and wherein the component comprises a disaggregated resource of the edge appliance device.
- Example 23 includes the subject matter of any of Examples 18-22, and further including identifying, by the edge appliance device, a plurality of components of the edge appliance device, wherein the plurality of components comprises the component; and performing, by the edge appliance device, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components; wherein the appliance certificate is indicative of the component certificate of each component of the plurality of components.
- Example 24 includes the subject matter of any of Examples 18-23, and wherein performing the attestation process comprises receiving a component certificate indicative of a trusted execution environment provided by the component.
- Example 25 includes the subject matter of any of Examples 18-24, and wherein the component certificate is indicative of a security property of the trusted execution environment.
- Example 26 includes the subject matter of any of Examples 18-25, and wherein performing the attestation process comprises securely receiving a component certificate indicative of a hardware configuration and a firmware configuration of the component.
- Example 27 includes the subject matter of any of Examples 18-26, and wherein the component certificate comprises a hash value indicative of the hardware configuration and the firmware configuration of the component.
- Example 28 includes the subject matter of any of Examples 18-27, and wherein providing the appliance certificate to the relying party comprises providing the appliance certificate to a remote orchestrator device.
- Example 29 includes the subject matter of any of Examples 18-28, and wherein providing the appliance certificate to the relying party comprises providing the appliance certificate to a platform active root of trust.
- Example 30 includes a method for appliance orchestration, the method comprising receiving, by a computing device, a workload scheduling request, wherein the workload scheduling request is indicative of a service level agreement requirement associated with a workload; receiving, by the computing device, an appliance certificate from an edge appliance device, wherein the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device, wherein the aggregate component certificate is indicative of a configuration of each component of a plurality of components of the edge appliance device; determining, by the computing device, whether the edge appliance device satisfies the service level agreement requirement based on the appliance certificate; and scheduling, by the computing device, the workload to the edge appliance device in response to determining that the edge appliance device satisfies the service level agreement requirement.
- Example 31 includes the subject matter of Example 30, and further including verifying, by the computing device, the appliance certificate in response to receiving the appliance certificate; wherein scheduling the workload further comprises scheduling the workload in response to verifying the appliance certificate.
- Example 32 includes the subject matter of any of Examples 30 and 31, and wherein verifying the appliance certificate comprises comparing the appliance certificate to an expected certificate, wherein the expected certificate is indicative of an expected configuration of each component of the plurality of components of the edge appliance device.
- Example 33 includes the subject matter of any of Examples 30-32, and wherein the appliance certificate is indicative of trusted execution environment provided by the edge appliance device.
- Example 34 includes the subject matter of any of Examples 30-33, and wherein determining whether the edge appliance device satisfies the service level agreement requirement comprises evaluating a security property of the trusted execution environment.
- Example 35 includes a computing device comprising a processor; and a memory having stored therein a plurality of instructions that when executed by the processor cause the computing device to perform the method of any of Examples 18-34.
- Example 36 includes one or more non-transitory, computer readable storage media comprising a plurality of instructions stored thereon that in response to being executed result in a computing device performing the method of any of Examples 18-34.
- Example 37 includes a computing device comprising means for performing the method of any of Examples 18-34.
Claims (20)
1. An edge appliance device for appliance attestation, the edge appliance device comprising:
an attestation manager to perform an attestation process with a component of the edge appliance device to generate a component certificate; and
a platform verifier to (i) generate an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device, and (ii) provide the appliance certificate to a relying party.
2. The edge appliance device of claim 1 , wherein the edge appliance device comprises an accelerator, and wherein the accelerator comprises the attestation manager and the platform verifier.
3. The edge appliance device of claim 1 , wherein:
the platform verifier is further to receive certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component; and
to generate the appliance certificate comprises to generate the appliance certificate based on the current utilization of the component.
4. The edge appliance device of claim 1 , wherein the component comprises an accelerator, a compute platform, a memory component, a storage component, or a functional block of the edge appliance device.
5. The edge appliance device of claim 1 , wherein the component comprises a disaggregated resource of the edge appliance device.
6. The edge appliance device of claim 1 , wherein:
the attestation manager is further to (i) identify a plurality of components of the edge appliance device, wherein the plurality of components comprises the component, and (ii) perform, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components; and
the appliance certificate is indicative of the component certificate of each component of the plurality of components.
7. The edge appliance device of claim 1 , wherein to perform the attestation process comprises to receive a component certificate indicative of a trusted execution environment provided by the component.
8. The edge appliance device of claim 7 , wherein the component certificate is indicative of a security property of the trusted execution environment.
9. The edge appliance device of claim 1 , wherein to perform the attestation process comprises to securely receive a component certificate indicative of a hardware configuration and a firmware configuration of the component.
10. The edge appliance device of claim 9 , wherein the component certificate comprises a hash value indicative of the hardware configuration and the firmware configuration of the component.
11. The edge appliance device of claim 1 , wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a remote orchestrator device.
12. The edge appliance device of claim 1 , wherein to provide the appliance certificate to the relying party comprises to provide the appliance certificate to a platform active root of trust.
13. One or more computer-readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause an edge appliance device to:
perform an attestation process with a component of the edge appliance device to generate a component certificate;
generate an appliance certificate, wherein the appliance certificate is indicative of the component certificate and current utilization of the edge appliance device; and
provide the appliance certificate to a relying party.
14. The one or more computer-readable storage media of claim 13 , wherein:
to perform the attestation process comprises to perform the attestation process by an accelerator of the edge appliance device;
to generate the appliance certificate comprises to generate the appliance certificate by the accelerator; and
to provide the appliance certificate comprises to provide the appliance certificate by the accelerator.
15. The one or more computer-readable storage media of claim 13 , further comprising a plurality of instructions stored thereon that, in response to being executed, cause the edge appliance device to:
receive certified telemetry from the component, wherein the certified telemetry is indicative of current utilization of the component;
wherein to generate the appliance certificate comprises to generate the appliance certificate based on the current utilization of the component.
16. The one or more computer-readable storage media of claim 13 , further comprising a plurality of instructions stored thereon that, in response to being executed, cause the edge appliance device to:
identify a plurality of components of the edge appliance device, wherein the plurality of components comprises the component; and
perform, for each component of the plurality of components, an attestation process to generate a component certificate for each component of the plurality of components;
wherein the appliance certificate is indicative of the component certificate of each component of the plurality of components.
17. The one or more computer-readable storage media of claim 13 , wherein to perform the attestation process comprises to securely receive a component certificate indicative of a hardware configuration and a firmware configuration of the component.
18. A virtualized system for appliance orchestration, the virtualized system comprising:
a workload orchestrator to receive a workload scheduling request, wherein the workload scheduling request is indicative of a service level agreement requirement associated with a workload; and
an aggregated attestation manager to receive an appliance certificate from an edge appliance device, wherein the appliance certificate is indicative of an aggregate component certificate and a current utilization of the edge appliance device, wherein the aggregate component certificate is indicative of a configuration of each component of a plurality of components of the edge appliance device;
wherein the workload orchestrator is further to (i) determine whether the edge appliance device satisfies the service level agreement requirement based on the appliance certificate, and (ii) schedule the workload to the edge appliance device in response to a determination that the edge appliance device satisfies the service level agreement requirement.
19. The virtualized system of claim 18 , wherein:
the aggregated attestation manager is further to verify the appliance certificate in response to receipt of the appliance certificate;
wherein to schedule the workload further comprises to schedule the workload in response to verification of the appliance certificate.
20. The virtualized system of claim 19 , wherein to verify the appliance certificate comprises to compare the appliance certificate to an expected certificate, wherein the expected certificate is indicative of an expected configuration of each component of the plurality of components of the edge appliance device.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/891,780 US20230045505A1 (en) | 2019-03-29 | 2022-08-19 | Technologies for accelerated orchestration and attestation with edge device trust chains |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/368,980 US11444846B2 (en) | 2019-03-29 | 2019-03-29 | Technologies for accelerated orchestration and attestation with edge device trust chains |
US17/891,780 US20230045505A1 (en) | 2019-03-29 | 2022-08-19 | Technologies for accelerated orchestration and attestation with edge device trust chains |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/368,980 Continuation US11444846B2 (en) | 2019-03-29 | 2019-03-29 | Technologies for accelerated orchestration and attestation with edge device trust chains |
Publications (1)
Publication Number | Publication Date |
---|---|
US20230045505A1 true US20230045505A1 (en) | 2023-02-09 |
Family
ID=67299474
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/368,980 Active US11444846B2 (en) | 2019-03-29 | 2019-03-29 | Technologies for accelerated orchestration and attestation with edge device trust chains |
US17/891,780 Pending US20230045505A1 (en) | 2019-03-29 | 2022-08-19 | Technologies for accelerated orchestration and attestation with edge device trust chains |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/368,980 Active US11444846B2 (en) | 2019-03-29 | 2019-03-29 | Technologies for accelerated orchestration and attestation with edge device trust chains |
Country Status (3)
Country | Link |
---|---|
US (2) | US11444846B2 (en) |
EP (1) | EP3716107B1 (en) |
CN (2) | CN111756542A (en) |
Families Citing this family (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11621976B2 (en) * | 2017-08-02 | 2023-04-04 | British Telecommunications Public Limited Company | Malicious host detection |
US11734458B2 (en) * | 2019-02-26 | 2023-08-22 | Intel Corporation | Extensible layered trusted computing base for computing devices |
US11456880B2 (en) * | 2019-03-25 | 2022-09-27 | Micron Technology, Inc. | Cryptographically secure mechanism for remotely controlling an autonomous vehicle |
US11924060B2 (en) | 2019-09-13 | 2024-03-05 | Intel Corporation | Multi-access edge computing (MEC) service contract formation and workload execution |
US20210081353A1 (en) * | 2019-09-17 | 2021-03-18 | Micron Technology, Inc. | Accelerator chip connecting a system on a chip and a memory chip |
US20220255916A1 (en) * | 2019-09-30 | 2022-08-11 | Intel Corporation | Methods and apparatus to attest objects in edge computing environments |
US20220207127A1 (en) * | 2020-12-30 | 2022-06-30 | Dell Products, L.P. | Console-based validation of secure assembly and delivery of information handling systems |
CN113422683B (en) * | 2021-03-04 | 2023-05-26 | 上海数道信息科技有限公司 | Edge cloud cooperative data transmission method, system, storage medium and terminal |
US20220405391A1 (en) * | 2021-06-21 | 2022-12-22 | Micron Technology, Inc. | Secure Identity Chaining between Components of Trusted Computing Base |
US20230032343A1 (en) * | 2021-07-30 | 2023-02-02 | International Business Machines Corporation | Conditions-based container orchestration |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6459682B1 (en) * | 1998-04-07 | 2002-10-01 | International Business Machines Corporation | Architecture for supporting service level agreements in an IP network |
US20190109877A1 (en) * | 2017-10-11 | 2019-04-11 | Microsoft Technology Licensing, Llc | Secure application metering |
Family Cites Families (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9794247B2 (en) * | 2006-08-22 | 2017-10-17 | Stmicroelectronics, Inc. | Method to prevent cloning of electronic components using public key infrastructure secure hardware device |
CN104756131B (en) * | 2012-09-19 | 2017-07-11 | 交互数字专利控股公司 | Layering certification |
US9380019B2 (en) * | 2013-08-26 | 2016-06-28 | Verisign, Inc. | Command performance monitoring |
US9590810B2 (en) * | 2015-04-13 | 2017-03-07 | Infineon Technologies Ag | Device security |
US10169591B2 (en) * | 2015-12-07 | 2019-01-01 | Amazon Technologies, Inc. | Chained security systems |
BR112019000113A2 (en) * | 2016-07-07 | 2019-04-09 | Huawei Tech Co Ltd | Network resource management method, device, and system |
US10440096B2 (en) | 2016-12-28 | 2019-10-08 | Intel IP Corporation | Application computation offloading for mobile edge computing |
US10104039B1 (en) | 2017-09-28 | 2018-10-16 | Cloudflare, Inc. | Establishing and using a tunnel from an origin server in a distributed edge compute and routing service |
US10884814B2 (en) | 2018-09-28 | 2021-01-05 | Intel Corporation | Mobile edge-cloud security infrastructure |
-
2019
- 2019-03-29 US US16/368,980 patent/US11444846B2/en active Active
-
2020
- 2020-02-18 EP EP20158073.5A patent/EP3716107B1/en active Active
- 2020-03-16 CN CN202010181408.9A patent/CN111756542A/en active Pending
- 2020-03-16 CN CN202311083665.9A patent/CN116980139A/en active Pending
-
2022
- 2022-08-19 US US17/891,780 patent/US20230045505A1/en active Pending
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6459682B1 (en) * | 1998-04-07 | 2002-10-01 | International Business Machines Corporation | Architecture for supporting service level agreements in an IP network |
US20190109877A1 (en) * | 2017-10-11 | 2019-04-11 | Microsoft Technology Licensing, Llc | Secure application metering |
Also Published As
Publication number | Publication date |
---|---|
US11444846B2 (en) | 2022-09-13 |
EP3716107A1 (en) | 2020-09-30 |
CN116980139A (en) | 2023-10-31 |
EP3716107B1 (en) | 2022-07-20 |
CN111756542A (en) | 2020-10-09 |
US20190230002A1 (en) | 2019-07-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20230045505A1 (en) | Technologies for accelerated orchestration and attestation with edge device trust chains | |
US11334382B2 (en) | Technologies for batching requests in an edge infrastructure | |
US20230396669A1 (en) | Technologies for transparent function as a service arbitration for edge systems | |
US11082525B2 (en) | Technologies for managing sensor and telemetry data on an edge networking platform | |
US11706158B2 (en) | Technologies for accelerating edge device workloads | |
US11972001B2 (en) | Technologies for securely providing remote accelerators hosted on the edge to client compute devices | |
US20220075653A1 (en) | Scheduling method and apparatus, and related device | |
US11880714B2 (en) | Technologies for providing dynamic selection of edge and local accelerator resources | |
US11265235B2 (en) | Technologies for capturing processing resource metrics as a function of time | |
US11606417B2 (en) | Technologies for matching security requirements of function-as-a-service in edge clouds | |
US11171831B2 (en) | Technologies for autonomous edge compute instance optimization and auto-healing using local hardware platform QoS services | |
US9270703B1 (en) | Enhanced control-plane security for network-accessible services | |
US20220200788A1 (en) | Technologies for accelerated hierarchical key caching in edge systems | |
US20230136615A1 (en) | Virtual pools and resources using distributed networked processing units |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |