Sharing container data inside a tenant's pod under different trusted execution environments (TEEs)
In a multitenant environment, confidential containers for the tenant having a trusted execution environment (TEE) which have security attested, can share data within the pod or between pods. The ability to share data for confidential containers of the same tenant eliminates the need to have multiple copies for different confidential containers. Thus, a storage device can store shared data specific to a tenant of the multitenant environment, and a caching service backed by protected hardware can manage access to the shared data. Management of the shared data can include attesting a key for a confidential container to verify that the confidential container is part of the TEE for a pod for the tenant, and access the shared data from the storage device for the confidential container based on the attested key.
1 . A system, comprising:
a storage device to store shared data specific to a tenant of a multitenant environment, the shared data to be shared by multiple hardware-protected confidential containers of a group of confidential containers for the tenant having a trusted execution environment (TEE), the group of confidential containers to share a runtime configuration; and
a processor associated with a first container of the multiple confidential containers of the group to execute a caching service for the first container to manage access to the shared data for the group, the caching service to cache a copy of the shared data from the storage device to a shared cache accessible by a second container of the multiple confidential containers of the group, attest a key for the second container to verify that the second container is part of the group for the tenant and part of the TEE, and access the shared data with the attested key from the shared cached to enable the second container to execute on the shared data without the second container needing to cache the shared data.
2 . The system of claim 1 , wherein the storage device is to store the shared data in accordance with an encrypted filesystem.
3 . The system of claim 1 , wherein the multiple confidential containers of the group have a common public key.
4 . The system of claim 3 , wherein each of the multiple confidential containers of the group has a unique private key.
5 . The system of claim 4 , wherein, to access the shared data, the first container is to provide its unique private key to the caching service, and receive a symmetric key from the caching service to decrypt the shared data.
6 . The system of claim 1 , wherein, when the first container is protected by a same virtual machine level of protection, the caching service is to cache the shared data unencrypted for the first container.
7 . The system of claim 1 , wherein, when the first container is protected by a different virtual machine level of protection, the caching service is to cache the shared data encrypted for the first container.
8 . The system of claim 1 , wherein the multiple confidential containers include a bare metal confidential container.
9 . The system of claim 1 , wherein the multiple confidential containers include a confidential virtual machine.
10 . The system of claim 1 , wherein the multiple confidential containers include an execution environment protected by TRUSTED EXECUTION TECHNOLOGY (TXT) available from INTEL CORPORATION, an execution environment protected by TRUST DOMAIN EXTENSION (TDX) available from INTEL CORPORATION, an execution environment protected by SOFTWARE GUARD EXTENSION (SGX) available from INTEL CORPORATION, an execution environment protected by TRUSTZONE available from ARM LIMITED, or an execution environment protected by SECURE ENCRYPTED VIRTUALIZATION (SEV) available from ADVANCED MICRO DEVICES, INC.
11 . A method for sharing data, comprising:
caching a copy of shared data from a storage device to a shared cache with a first container of multiple confidential containers of a hardware-protected trusted execution environment (TEE) of a group of confidential containers of a tenant, the shared data specific to the tenant of a multitenant environment;
receiving a request for the shared data from a second container of the multiple confidential containers;
attesting a key for the second container;
verifying that the second container is part of the TEE of the group for the tenant; and
accessing the shared data with the attested key from the shared cached to enable the second container to execute on the shared data without the second container needing to cache the shared data.
12 . The method of claim 11 , wherein the multiple confidential containers of the group have a common public key.
13 . The method of claim 12 , wherein each of the multiple confidential containers of the group has a unique private key.
14 . The method of claim 13 , wherein attesting the key for the first container comprises receiving the unique private key for the first container, and wherein providing a symmetric key to the first container to decrypt the shared data.
15 . The method of claim 11 , wherein accessing the shared data from the storage device comprises caching the shared data unencrypted for the first container when the first container is protected by a same virtual machine level of protection as a caching service that attests the key.
16 . The method of claim 11 , wherein accessing the shared data from the storage device comprises caching the shared data encrypted for the first container when the first container is protected by a different virtual machine level of protection as a caching service that attests the key.
17 . A non-transitory computer readable storage medium having content stored thereon, which when executed causes a machine to perform a method for sharing data including: caching a copy of shared data from a storage device to a shared cache with a first container of multiple confidential containers of a hardware-protected trusted execution environment (TEE) of a group of confidential containers of a tenant, the shared data specific to the tenant of a multitenant environment; receiving a request for the shared data from a second container of the multiple confidential containers; attesting a key for the second container; verifying that the second container is part of the TEE of the group for the tenant; and accessing the shared data with the attested key from the shared cached to enable the second container to execute on the shared data without the second container needing to cache the shared data.
18 . The non-transitory computer readable storage medium of claim 17 , wherein the multiple confidential containers of the group have a common public key and each of the multiple confidential containers of the group has a unique private key.
19 . The non-transitory computer readable storage medium of claim 18 , wherein attesting the key for the first container comprises receiving the unique private key for the first container, and wherein providing a symmetric key to the first container to decrypt the shared data.
20 . The non-transitory computer readable storage medium of claim 17 , wherein accessing the shared data from the storage device comprises caching the shared data unencrypted for the first container when the first container is protected by a same virtual machine level of protection as a caching service that attests the key.
21 . The non-transitory computer readable storage medium of claim 17 , wherein accessing the shared data from the storage device comprises caching the shared data encrypted for the first container when the first container is protected by a different virtual machine level of protection as a caching service that attests the key.