WO2024045141A1

WO2024045141A1 - Confidential and performant lambda/function system in cloud

Info

Publication number: WO2024045141A1
Application number: PCT/CN2022/116600
Authority: WO
Inventors: Quoc Do LE; Plamen Petrov; Antonio BARBALACE; Javier PICOREL; Huatao WU; Deping Tang
Original assignee: Huawei Cloud Computing Technologies Co., Ltd.
Priority date: 2022-09-01
Filing date: 2022-09-01
Publication date: 2024-03-07

Abstract

A method and a system for establishing stacks of secured and confidential layers for computing cloud services such as Function as a service (FaaS), which require runtime environment, using trusted execution environments, available in modern CPUs are disclosed. Cloud services allow users to and developers to focus on the application logic with less concern about the infrastructure, and pay only for the computing resources used by their functions. Since functions implemented on cloud often processes sensitive data, security and privacy are of paramount importance. The method handles this issue and further enhances the trust of cloud and particularly FaaS customers, by ensuring the confidentiality, integrity, and freshness of data and code of user functions, and allowing users to verify the integrity of their functions' computation.

Description

CONFIDENTIAL AND PERFORMANT LAMBDA/FUNCTION SYSTEM IN CLOUD

BACKGROUND

Some embodiments described in the present disclosure relate to a cloud computing and, more specifically, but not exclusively, to a method for executing lambda functions on a trusted execution environment, verifiable by chip manufacturer, on the cloud.

Computing needs of many organizations, as well as power end users, are often hard to answer using a local, monolithic server, therefore the practice of using a network of remote server accessible through the internet to store, manage, and process data, namely cloud computing has become prevalent in many applications. Cloud computing enables on-demand computer system resources, such as data storage, specialized processing, processing power, and the like, while delegating the system management to trusted service providers. Function-as-a-Service platforms (FaaS or FAAS) , which allow developers to use an execution environment prepared in advance, have become ubiquitous in the cloud eco-system, since their introduction during the mid-2010s.

Prior art methods used by cloud provider may support efficient resource utilization, for example by packing users same server, and isolation of users’ lambdas computation using sandboxes, however user trust is based on reputation and there is limited support for confidentiality credentials which are verifiable from user perspective.

SUMMARY

It is an object of the present disclosure to describe a system and a method for establishing a trusted execution environment, using trusted execution environments for a user function and a proxy service for integrity and freshness of the data and the code.

The foregoing and other objects are achieved by the features of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

According to an aspect of some embodiments of the present disclosure, there is provided a method for establishing a trusted execution environment using at least one processor, a memory and a network interface, the method comprising:

creating a first trusted execution environment for a proxy service and a second trusted execution environment for a user function;

providing a secured gateway via the network interface for remote access to the first trusted execution environment;

receiving from a user and via the secured gateway a user function and at least one input for the user function;

validating the integrity and freshness of the at least one input using the proxy; and

executing the user function on the at least one input using runtime environment on the second

According to an aspect of some embodiments of the present disclosure, there is provided a One or more computer program products comprising instructions for establishing a trusted execution environment, wherein execution of the instructions by one or more processors of a computing system is to cause a computing system to:

create a first trusted execution environment for a proxy service and a second trusted execution environment for a user function;

provide a secured gateway via the network interface for remote access to the first trusted execution environment;

receive from a user and via the secured gateway a user function and at least one input for the user function;

validate the integrity and freshness of the at least one input using the proxy; and

execute the user function on the at least one input using runtime environment on the second trusted execution environment.

According to an aspect of some embodiments of the present disclosure, there is provided a system comprising at least one processor, a memory and a network interface, wherein the at least one processor is configured to execute instructions for:

executing the user function on the at least one input using runtime environment on the second trusted execution environment.

Optionally, the proxy has stateless architecture.

Optionally, the first trusted execution environment and the second trusted execution environment are provided by the hardware of the at least one processor, and the at least one processor is further configured for providing attestation data to client device via the network interface.

Optionally, the at least one processor is further configured for providing attestation data to a client device via the network interface.

Optionally, further comprising a key management system on a third trusted execution environment configured for communicating with the proxy the user function and the user using transport layer security.

Optionally, the at least one processor is further configured for providing at least one cryptographic key to the user function in response to a remote attestation.

Optionally, the at least one processor is further configured for automatically performing remote attestation by verifying the integrity of user functions.

Optionally, the at least one processor is further configured for Return output to end user via a secure connection.

Optionally, the at least one processor is further configured for encrypting at least one output of the user function and putting the at least one output into a storage backend.

Other systems, methods, features, and advantages of the present disclosure will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the present disclosure, and be protected by the accompanying claims.

Unless otherwise defined, all technical and/or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which embodiments. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of embodiments, exemplary methods and/or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING (S)

Some embodiments are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of embodiments. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments may be practiced.

In the drawings:

FIG. 1 is a schematic illustration of an exemplary system for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 2 is a schematic block diagram of an exemplary basic software for system for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 3 is a flowchart schematically representing an optional flow of operations for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 4 is a schematic block diagram of an exemplary processor vendor provided trusted execution environment, according to some embodiments of the present disclosure;

FIG. 5 is a schematic block diagram of an exemplary processor vendor attestation system with an exemplary associated operation flow, according to some embodiments of the present disclosure;

FIG. 6 is a schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 7 is another schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 8 is an additional schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure;

FIG. 9 is a supplementary schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure; and

FIG. 10 is a further additional schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

DETAILED DESCRIPTION

Cloud application models such as data streaming, GUI, gaming, stock exchange, system control, and the like may be subject to variety of hacking attacks, and impose security requirements on associated function code, data, and executed environment.

Customers may choose function as a service (FaaS) platforms based on provider’s reputation, and that impose a challenge for new or smaller competitors, as well as competitors offering global service where eavesdropping concerns exist.

Customers may be reluctant to trust cloud provider and administrators with root access, which may attack while having privileged accesses such as sudo, and access to: the entire software stack, including the operating system (OS) . The disclosure may be accompanied with measures to mitigate attacks other than the above, such as denial of service (DoS) attacks, side-channel attacks, microarchitectural attacks, and the like.

Customer may be concerned about the security, in sense of confidentiality, integrity, isolation and safe execution and freshness, when executing lambda/function user code in the cloud. Freshness may be secured using a simple nonce-based protocol or using trusted counters.

Some implementations of the proposed framework run the user code in sandboxes for transparency, providing unmodified programming APIs for the application programmers and Get/Select interface, REST API, and/or the like.

Some implementations of the present disclosure may deploy user functions in sandboxes such as virtual machines (VM) and enable user functions in sandbox to run inside a trusted execution environment (TEE) .

Some implementations of the present disclosure may transparently and automatically perform remote attestation, for example for verifying the integrity of user functions, and provide secrets encryption and/or decryption keys to user function running inside a TEE.

Some implementations of the present disclosure may also verify the integrity and the freshness of input data.

Some implementations of the present disclosure may execute user function computation inside the TEE, and return output to end user via a secure connection and/or encrypt and put output into storage.

Execute users software, for example lambda functions, insides TEEs and sandboxes may ensure confidentiality and integrity of user software, including sensitive user data, blocking interference with the software execution, including from attackers with privileged access.

Providing attestation mechanisms may enable users to ensure their lambda function is running inside TEEs. Remote attestation mechanism helps users to establish the trust of the cloud provider infrastructure. Transparent and automatic attestation helps users to deploy confidential scalable services. Furthermore, the remote attestation mechanism provided by central processing unit (CPU) vendors, attest only the FaaS runtime inside the TEE, however the user code may be subject to man in the middle and other attacks which may be backed by root access.

Some implementations of the present disclosure may provide mechanisms to guarantee integrity and freshness protection of input data and code from a file system or storage system, such as proxy-based approach to get data from a storage system. The proxy may ensure the integrity and freshness of the input data, and run inside TEEs, thus can be attested by users.

The proxy may have a stateless architecture thus, be scalable in distributed settings and provide a scalable key management system (KMS) . The KMS may also run inside TEEs, and users can attest it before uploading secrets such as certificates, encryption or decryption keys, for their software via a transport layer service (TLS) . The KMS may be integrated with the existing KMS of a cloud provider and support backup and update mechanism for fault tolerance.

Advantages for the cloud service provider may comprise enhancing the trust from customers, especially foreign customers, by providing evidently confidential FaaS for customers with confidentiality, integrity, and freshness of the cloud storage service.

Advantages for the cloud user may comprise ability to deploy confidential, complex and scalable services on the cloud with high security guarantees with a low overhead, and reduces latency for distributed services with automatic remote attestation and key management system. Furthermore, datasets may be protected not only in sense of confidentiality and integrity but also in freshness, while reducing confidential computing service costs.

Before explaining at least one embodiment in detail, it is to be understood that embodiments are not necessarily limited in its application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the Examples. Implementations described herein are capable of other embodiments or of being practiced or carried out in various ways.

Embodiments may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the embodiments.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.

Computer readable program instructions for carrying out operations of embodiments may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN) , or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider) . In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA) , or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of embodiments.

Aspects of embodiments are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) , and computer program products according to embodiments. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.

These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function (s) . In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

Referring now to the drawings, FIG. 1 is a schematic illustration of an exemplary system for trusted cloud function service, according to some embodiments of the present disclosure. An exemplary computer system 100 may be used for executing execute processes such as 300 for providing trusted cloud function service. Further details about these exemplary processes follow as FIG. 3 is described.

Various aspects of the present disclosure are described by narrative text, flowcharts, block diagrams of computer systems and/or block diagrams of the machine logic included in computer program product (CPP) embodiments. With respect to any flowcharts, depending upon the technology involved, the operations may be performed in a different order than what is shown in a given flowchart. For example, again depending upon the technology involved, two operations shown in successive flowchart blocks may be performed in reverse order, as a single integrated step, concurrently, or in a manner at least partially overlapping in time.

A computer program product embodiment ("CPP embodiment" or “CPP” ) is a term used in the present disclosure to describe any set of one, or more, storage media (also called "mediums" ) collectively included in a set of one, or more, storage devices that collectively include machine readable code corresponding to instructions and/or data for performing computer operations specified in a given CPP claim. A "storage device" is any tangible device that can retain and store instructions for use by a computer processor. Without limitation, the computer readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these mediums include: diskette, hard disk, random access memory (RAM) , read-only memory (ROM) , erasable programmable read-only memory (EPROM or Flash memory) , static random access memory (SRAM) , compact disc read-only memory (CD-ROM) , digital versatile disk (DVD) , memory stick, floppy disk, mechanically encoded device (such as punch cards or pits /lands formed in a major surface of a disc) or any suitable combination of the foregoing. A computer readable storage medium, as that term is used in the present disclosure, is not to be construed as storage in the form of transitory signals per se, such propagating electromagnetic signals, light pulses passing through a fiber optic cable, electrical signals communicated through a wire, and/or other transmission media. As will be understood by those of skill in the art, data is typically moved at some occasional points in time during normal operations of a storage device, such as during access, de-fragmentation or garbage collection, but this does not render the storage device as transitory because the data is not transitory while it is stored.

Computing environment 100 contains an example of an environment for the execution of at least some of the computer code involved in performing the disclosed methods, such as system for trusted cloud function service. In addition to block 200, computing environment 100 includes, for example, computer 102, wide area network (WAN) 108, end user device (EUD) 132, remote server 104, public cloud 150, and private cloud 106. In this embodiment, computer 102 includes processor set 110 (including processing circuitry 120 and cache 122) , communication fabric 160, volatile memory 112, persistent storage 116 (including operating system 122 and block 200, as identified above) , peripheral device set 114 (including user interface (UI) , device set 126, storage 124, and Internet of Things (IoT) sensor set 128) , and network module 118. Remote server 104 includes remote database 130. Public cloud 150 includes gateway 140, cloud orchestration module 146, host physical machine set 142, virtual machine set 148, and container set 144.

COMPUTER 102 may take the form of a desktop computer, laptop computer, tablet computer, smart phone, smart watch or other wearable computer, mainframe computer, quantum computer or any other form of computer or mobile device now known or to be developed in the future that is capable of running a program, accessing a network or querying a database, such as remote database 130. As is well understood in the art of computer technology, and depending upon the technology, performance of a computer-implemented method may be distributed among multiple computers and/or between multiple locations. On the other hand, in this presentation of computing environment 100, detailed discussion is focused on a single computer, specifically computer 102, to keep the presentation as simple as possible. Computer 102 may be located in a cloud, as shown in in FIG. 1, however the computer 102 may also be located outside a cloud. On the other hand, computer 102 is not required to be in a cloud except to any extent as may be affirmatively indicated.

PROCESSOR SET 110 includes one, or more, computer processors of any type now known or to be developed in the future. For example, a processor set may include one or more of a central processing unit (CPU) , a microcontroller, a parallel processor, supporting multiple data such as a digital signal processing (DSP) unit, a graphical processing unit (GPU) module, and the like, as well as optical processors, quantum processors, and processing units based on technologies that may be developed in the future. Processing circuitry 120 may be distributed over multiple packages, for example, multiple, coordinated integrated circuit chips. Processing circuitry 120 may implement multiple processor threads and/or multiple processor cores. Cache 122 is memory that is located in the processor chip package (s) and is typically used for data or code that should be available for rapid access by the threads or cores running on processor set 110. Cache memories may be organized into multiple levels. The processor set 110 may be designed for working with qubits and performing quantum computing.

Computer readable program instructions are typically loaded onto computer 102 to cause a series of operational steps to be performed by processor set 110 of computer 102 and thereby effect a computer-implemented method, such that the instructions thus executed will instantiate the methods specified in flowcharts and/or narrative descriptions of computer-implemented methods included in this document (collectively referred to as “the disclosed methods” ) . These computer readable program instructions are stored in various types of computer readable storage media, such as cache 122 and the other storage media discussed below. The program instructions, and associated data, are accessed by processor set 110 to control and direct performance of the disclosed methods. In computing environment 100, at least some of the instructions for performing the disclosed methods may be stored in block 200 in persistent storage 116.

COMMUNICATION FABRIC 160 is the signal conduction paths that allow the various components of computer 102 to communicate with each other. Typically, this fabric is made of switches and electrically conductive paths, such as the switches and electrically conductive paths that make up busses, bridges, physical input /output ports and the like. Other types of signal communication paths may be used, such as fiber optic communication paths and/or wireless communication paths.

VOLATILE MEMORY 112 is any type of volatile memory now known or to be developed in the future. Examples include dynamic type random access memory (RAM) or static type RAM. Typically, the volatile memory is characterized by random access, but this is not required unless affirmatively indicated. In computer 102, the volatile memory 112 is located in a single package and is internal to computer 102, but, alternatively or additionally, the volatile memory may be distributed over multiple packages and/or located externally with respect to computer 102.

PERSISTENT STORAGE 116 is any form of non-volatile storage for computers that is now known or to be developed in the future. The non-volatility of this storage means that the stored data is maintained regardless of whether power is being supplied to computer 102 and/or directly to persistent storage 116. Persistent storage 116 may be a read only memory (ROM) , but typically at least a portion of the persistent storage allows writing of data, deletion of data and re-writing of data. Some familiar forms of persistent storage include magnetic disks and solid state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems or open source Portable Operating System Interface type operating systems that employ a kernel. The code included in block 200 typically includes at least some of the computer code involved in performing the disclosed methods.

PERIPHERAL DEVICE SET 114 includes the set of peripheral devices of computer 102. Data communication connections between the peripheral devices and the other components of computer 102 may be implemented in various ways, such as Bluetooth connections, Near-Field Communication (NFC) connections, connections made by cables (such as universal serial bus (USB) type cables) , insertion type connections (for example, secure digital (SD) card) , connections made though local area communication networks and even connections made through wide area networks such as the internet. In various embodiments, UI device set 126 may include components such as a display screen, speaker, microphone, wearable devices (such as goggles and smart watches) , keyboard, mouse, printer, touchpad, game controllers, and haptic devices. Storage 124 is external storage, such as an external hard drive, or insertable storage, such as an SD card. Storage 124 may be persistent and/or volatile. In some embodiments, storage 124 may take the form of a quantum computing storage device for storing data in the form of qubits. In embodiments where computer 102 is required to have a large amount of storage (for example, where computer 102 locally stores and manages a large database) then this storage may be provided by peripheral storage devices designed for storing very large amounts of data, such as a storage area network (SAN) that is shared by multiple, geographically distributed computers. IoT sensor set 128 is made up of sensors that can be used in Internet of Things applications. For example, one sensor may be a thermometer and another sensor may be a motion detector.

NETWORK MODULE 118 is the collection of computer software, hardware, and firmware that allows computer 102 to communicate with other computers through WAN 108. Network module 118 may include hardware, such as modems or Wi-Fi signal transceivers, software for packetizing and/or de-packetizing data for communication network transmission, and/or web browser software for communicating data over the internet. In some embodiments, network control functions and network forwarding functions of network module 118 are performed on the same physical hardware device. In other embodiments (for example, embodiments that utilize software-defined networking (SDN) ) , the control functions and the forwarding functions of network module 118 are performed on physically separate devices, such that the control functions manage several different network hardware devices. Computer readable program instructions for performing the dislcosed methods can typically be downloaded to computer 102 from an external computer or external storage device through a network adapter card or network interface included in network module 118.

WAN 108 is any wide area network (for example, the internet) capable of communicating computer data over non-local distances by any technology for communicating computer data, now known or to be developed in the future. In some embodiments, the WAN may be replaced and/or supplemented by local area networks (LANs) designed to communicate data between devices located in a local area, such as a Wi-Fi network. The WAN and/or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and edge servers.

END USER DEVICE (EUD) 132 is any computer system that is used and controlled by an end user (for example, a customer of an enterprise that operates computer 102) , and may take any of the forms discussed above in connection with computer 102. EUD 132 typically receives helpful and useful data from the operations of computer 102. For example, in a hypothetical case where computer 102 is designed to provide a recommendation to an end user, this recommendation would typically be communicated from network module 118 of computer 102 through WAN 108 to EUD 132. In this way, EUD 132 can display, or otherwise present, the recommendation to an end user. In some embodiments, EUD 132 may be a client device, such as thin client, heavy client, mainframe computer, desktop computer and so on.

REMOTE SERVER 104 is any computer system that serves at least some data and/or functionality to computer 102. Remote server 104 may be controlled and used by the same entity that operates computer 102. Remote server 104 represents the machine (s) that collect and store helpful and useful data for use by other computers, such as computer 102. For example, in a hypothetical case where computer 102 is designed and programmed to provide a recommendation based on historical data, then this historical data may be provided to computer 102 from remote database 130 of remote server 104.

CLOUD SERVICE 150 is a set of computer systems available for use by multiple entities that provides on-demand availability of computer system resources and/or other computer capabilities, especially data storage (cloud storage) and computing power, without direct active management by the user. Cloud computing typically leverages sharing of resources to achieve coherence and economies of scale. The direct and active management of the computing resources of public cloud 150 is performed by the computer hardware and/or software of cloud orchestration module 146. The computing resources provided by public cloud 150 are typically implemented by virtual computing environments that run on various computers making up the computers of host physical machine set 142, which is the universe of physical computers in and/or available to public cloud 150. The virtual computing environments (VCEs) typically take the form of virtual machines from virtual machine set 148 and/or containers from container set 144. It is understood that these VCEs may be stored as images and may be transferred among and between the various physical machine hosts, either as images or after instantiation of the VCE. Cloud orchestration module 146 manages the transfer and storage of images, deploys new instantiations of VCEs and manages active instantiations of VCE deployments. Gateway 140 is the collection of computer software, hardware, and firmware that allows public cloud 150 to communicate through WAN 108.

Some further explanation of virtualized computing environments (VCEs) will now be provided. VCEs can be stored as “images. ” A new active instance of the VCE can be instantiated from the image. Two familiar types of VCEs are virtual machines and containers. A container is a VCE that uses operating-system-level virtualization. This refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances, called containers. These isolated user-space instances typically behave as real computers from the point of view of programs running in them. A computer program running on an ordinary operating system can utilize all resources of that computer, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, programs running inside a container can only use the contents of the container and devices assigned to the container, a feature which is known as containerization.

Referring now to FIG. 2 which is a schematic block diagram of an exemplary basic software for system for trusted cloud function service, according to some embodiments of the present disclosure.

This exemplary software 200 comprises code for three trusted execution environments (TEEs) . A Key Management System (KMS) , which communicates using transport layer service (TLS) with a Lamnda user code over Runtime environment, and a Proxy. The proxy communicates using TLS both with the user code and with a storage unit, a client, and or/the like. It should be noted that some implementations may include more than one of the components in the same TEE, and/or communicate using methods other than TLS.

The software components shown may run inside sandboxes on virtual machines, containers, bare-metal servers, and/or the like and may be supported by hardware protection.

Referring now to FIG. 3, which is flowchart schematically representing an optional flow of operations for trusted cloud function service, according to some embodiments of the present disclosure. The processing circuitry 120 may execute the exemplary process 300 for a variety of purposes involving distributed database based services, complex processing, logistics, analytics and/or the like.

The exemplary process 300 starts, as shown in 302, with creating a first trusted execution environment for a proxy service and a second trusted execution environment for a user function.

The first trusted execution environment and the second trusted execution environment are provided by the hardware of at least one of the at least one processor, and the at least one processor is further configured for providing attestation data to client device via the network interface, for example through TLS. The proxy may stateless architecture, however alternative implementations may use different proxy architectures. Enclaves are an example of trusted execution environments. Lambda functions are examples of user functions.

The exemplary process 300 continues, as shown in 304, with providing a secured gateway via the network interface for remote access to the first trusted execution environment. TLS is an example of a network interface, and may use the network module 118. The gateway may be used to communication between the trusted execution environments and the user through a device 132 or on another machine.

Some implementations may require users to perform attestation before providing any secrets and/or the like to trusted execution environments.

The exemplary process 300 optionally continues, as shown in 305, with providing at least one cryptographic key to the user function in response to a remote attestation.

Some implementation include a key management system, which may run on one of the TEEs, or on a third trusted execution environment, which may be configured for communicating with the proxy, the user function, and the user, for example using transport layer security.

One or more users may trigger or perform attestation to make sure no unauthorized agent modified code or data of the key management system (KMS) . Followingly, users may submit security policy that contains keys and/or configuration of their lambda function and/or the function as a service (FaaS) application.

The exemplary process 300 continues, as shown in 306, with receiving from a user and via the secured gateway a user function and at least one input for the user function. The input may be encrypted, and received using TLS, through the network module 118, as the users deploy their FaaS code and/or data via the secure gateway.

Followingly, as shown in 307, the process 300 may continue by automatically performing remote attestation by verifying the integrity of user functions.

The attestation may be requested by an application running on a user computer, which may request and receive a report from the TEE. Followingly the process may send a quote from the process running on the TEE, to the user computer. The user computer may followingly send the quote to a system operated by the vendor of the TEE supporting processor for attestation through the internet. Followingly, when the quote is valid, the attestation may be sent from the system operated by the vendor to the user computer.

The KMS may replace the role of users performing attestation for the other components, for example the FaaS runtime, user code, and proxy service.

When the attestation passes, the KMS may provide keys to the user unction or FaaS application in the TEE, followingly the function may decrypt the input data when it is executed.

When FaaS application reads input data via the proxy, the proxy may check the integrity and the freshness of the input data make sure no attacker modified or replaced the data with old version of data, malicious data and/or the like.

Followingly, provided that the attestation is successful, the KMS may provide keys to the FaaS application, so that the FaaS application decrypt the input data when it is executed.

The exemplary process 300 continues, as shown in 308, with validating the integrity and freshness of the at least one input using the proxy service.

The validation may be done using encryption and decryption keys, which may be transmitted via the secured gateway.

The exemplary process 300 continues, as shown in 310, with executing the user function on the at least one input using runtime environment on the second trusted execution environment.

The TEE supporting at least one processor may execute the function, using software infrastructure of the runtime environment, such as Java, JavaScript, Python, C libraries, and/or the like, and may be provided by the cloud service. When the cloud service provider maintains the operating system, runtime environment and infrastructure that are needed to execute the user function code, users may benefit from optimizations to the hardware provided by the cloud and focus on the high level aspects of programming.

Followingly, the process may comprise storing the data, which may be encrypted, and/or return output to end user via a secure connection.

Referring now to FIG. 4 is a schematic block diagram of an exemplary processor vendor provided trusted execution environment, according to some embodiments of the present disclosure.

In this exemplary system 400, one or more components of the processing circuitry 120 is an Intel Skylake ^TM central processing unit (CPU) , which comprises a Memory Encryption Engine, facilitating secure communication with enclave page cache (EPC) which is a physical memory feature, accessing memory such as 112 in an encrypted manner and giving rise to enclave having virtual memory, to which access from the operating system 122 is forbidden, and may not be snooped.

Referring now to FIG. 5 which is a schematic block diagram of an exemplary processor vendor attestation system with an exemplary associated operation flow, according to some embodiments of the present disclosure.

In this example of the environment 500 a verifier process on a user computer sends a request (1) to an application running on an enclave TEE, which sends a report (2) to Intel quoting enclave (QE) . Followingly the QE sends a quote (3) back to the application enclave which forwards it to the verifier on the user computer. The user computer sends the quote to Intel Attestation service (IAS) through the internet, and providing the quote is valid, returns a Verify quote (4) to the verifier on the user computer.

Intel SGX may be used for lambda functions. However SGX supports only for single machine, and does not support transparent/automatic remote attestation, SGX also does not support key management system, or distributed systems.

User application may be distributed micro-services, requiring transparent/automatic remote attestation mechanism and a key management system to make the proposed systems work in practice. Additionally, ensuring confidentiality, integrity and freshness of input data, and of the user code may be required.

Referring now to FIG. 6 which is a schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

This exemplary system 600 may deploy user software comprising one or more functions, into a Lambda sandbox, which may be also referred to simply as a sandbox, and let it execute them remotely thereon. Alternative, the sandbox may be check-pointed and restarted from a saved image. The sandbox may be a virtual machine, container, isolates, or the like. Any mechanism that enables separation between the user software and other software systems.

Sandbox may execute in a cloud node, a physical for example metal or a virtual node, which may include one or more processing unit on the processing circuitry from a selection of CPU, GPU, TPU, FPGA and the like, in the machine itself or in another storage layer, and also smartNIC, smartSSD, and the like.

The virtual machine may run a software stack comprising an operating system (OS) kernel, a Runtime, the user code, for example Lambda functions, and other layers.

Referring now to FIG. 7 which is another schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

This exemplary system 700 may support transparent and automatic remote attestation, using a Key Management System (KMS) while protecting the code and data against privileged attackers who may have root access.

Referring now to FIG. 8 which is an additional schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

In order to Support integrity and freshness protection for input data from a file system and storage system, some implementations of the disclosure, such as 800, also comprise a proxy-based approach to get data from a storage system, and/or write data thereto. This proxy may ensure the integrity and freshness of the input data, for example by using a monotonic counter services based approach.

The proxy may also run inside a TEE and therefore may be verified by end users, and maintain scalability.

Referring now to FIG. 9 which is a supplementary schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

Some implementations of the disclosure, such as 900, Support a secure, scalable and reliable KMS to manage secrets and configurations of users lambda functions. The KMS may be integrated with the KMS of cloud provider, however allow users to attest the system, and the TEEs. Secret keys for service may be generated inside TEEs. The system may also provide backup and update mechanisms

Referring now to FIG. 10 which is a further additional schematic block diagram of an exemplary cloud setup for a system for trusted cloud function service, according to some embodiments of the present disclosure.

This exemplary system 1000 there are compute servers running cloud native services in TEEs such as enclave, and communicate using TLS with user code FunctionGraph associated with the data servers, also in an enclave. The key management system, also inside an enclave, may generate keys, and provide attestation and key transferring via TLS. The enclaves may run over a host, virtual machine (VM) , a container, and/or the like.

The descriptions of the various embodiments have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

It is expected that during the life of a patent maturing from this application many relevant hardware vendor secured environments will be developed and the scope of the term trusted execution environment is intended to include all such new technologies a priori.

As used herein the term “about” refers to ± 10 %.

The terms "comprises" , "comprising" , "includes" , "including" , “having” and their conjugates mean "including but not limited to" . This term encompasses the terms "consisting of" and "consisting essentially of" .

The phrase "consisting essentially of" means that the composition or method may include additional ingredients and/or steps, but only if the additional ingredients and/or steps do not materially alter the basic and novel characteristics of the claimed composition or method.

As used herein, the singular form "a" , "an" and "the" include plural references unless the context clearly dictates otherwise. For example, the term "a compound" or "at least one compound" may include a plurality of compounds, including mixtures thereof.

The word “exemplary” is used herein to mean “serving as an example, instance or illustration” . Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments and/or to exclude the incorporation of features from other embodiments.

The word “optionally” is used herein to mean “is provided in some embodiments and not provided in other embodiments” . Any particular embodiment may include a plurality of “optional” features unless such features conflict.

Throughout this application, various embodiments may be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and should not be construed as an inflexible limitation on the scope of embodiments. Accordingly, the description of a range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range. For example, description of a range such as from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., as well as individual numbers within that range, for example, 1, 2, 3, 4, 5, and 6. This applies regardless of the breadth of the range.

Whenever a numerical range is indicated herein, it is meant to include any cited numeral (fractional or integral) within the indicated range. The phrases “ranging/ranges between” a first indicate number and a second indicate number and “ranging/ranges from” a first indicate number “to” a second indicate number are used herein interchangeably and are meant to include the first and second indicated numbers and all the fractional and integral numerals therebetween.

It is appreciated that certain features of embodiments, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of embodiments, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable subcombination or as suitable in any other described embodiment. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

Although embodiments have been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.

It is the intent of the applicant (s) that all publications, patents and patent applications referred to in this specification are to be incorporated in their entirety by reference into the specification, as if each individual publication, patent or patent application was specifically and individually noted when referenced that it is to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present disclosure. To the extent that section headings are used, they should not be construed as necessarily limiting. In addition, any priority document (s) of this application is/are hereby incorporated herein by reference in its/their entirety.

Claims

A system comprising at least one processor, a memory and a network interface, wherein the at least one processor is configured to execute instructions for:

creating a first trusted execution environment for a proxy service and a second trusted execution environment for a user function;

providing a secured gateway via the network interface for remote access to the first trusted execution environment;

receiving from a user and via the secured gateway a user function and at least one input for the user function;

validating the integrity and freshness of the at least one input using the proxy service; and

executing the user function on the at least one input using runtime environment on the second trusted execution environment.
The system of claim 1, wherein the proxy has stateless architecture.
The system of claim 1, wherein the first trusted execution environment and the second trusted execution environment are provided by the hardware of the at least one processor.
The system of claim 1, further comprising a key management system on a third trusted execution environment configured for communicating with the proxy the user function and the user using transport layer security.
The system of claim 4, wherein the at least one processor is further configured for providing at least one cryptographic key to the user function in response to a remote attestation.
The system of claim 1, wherein the at least one processor is further configured for automatically performing remote attestation by verifying the integrity of user functions.
The system of claim 1, wherein the at least one processor is further configured for Return output to end user via a secure connection.
The system of claim 1, wherein the at least one processor is further configured for encrypting at least one output of the user function and putting the at least one output into a storage backend.
A method for establishing a trusted execution environment using at least one processor, a memory and a network interface, the method comprising:

creating a first trusted execution environment for a proxy service and a second trusted execution environment for a user function;

providing a secured gateway via the network interface for remote access to the first trusted execution environment;

receiving from a user and via the secured gateway a user function and at least one input for the user function;

validating the integrity and freshness of the at least one input using the proxy service; and

executing the user function on the at least one input using runtime environment on the second trusted execution environment.
The method of claim 9, wherein the proxy has stateless architecture.
The method of claim 9, wherein the first trusted execution environment and the second trusted execution environment are provided by the hardware of the at least one processor.
The method of claim 9, further comprising a key management system on a third trusted execution environment configured for communicating with the proxy the user function and the user using transport layer security.
The method of claim 12, further comprising providing at least one cryptographic key to the user function in response to a remote attestation.
The method of claim 9, further comprising automatically performing remote attestation by verifying the integrity of user functions.
One or more computer program products comprising instructions for establishing a trusted execution environment, wherein execution of the instructions by one or more processors of a computing system is to cause a computing system to:

create a first trusted execution environment for a proxy service and a second trusted execution environment for a user function;

provide a secured gateway via the network interface for remote access to the first trusted execution environment;

receive from a user and via the secured gateway a user function and at least one input for the user function;

validate the integrity and freshness of the at least one input using the proxy service; and

execute the user function on the at least one input using runtime environment on the second trusted execution environment.