Granted Patent B2

US 10,754,703 · App. 14/977,952 · Granted Aug 25, 2020

Abstract

Claims (43)

1. A computing apparatus, comprising:

a hardware platform comprising a computing resource;

a bespoke sensor to measure at least one parameter of usage of the computing resource;

a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave; and

a trusted compute meter (TCM) agent comprising logic to operate within the first TEE independently of an operating system of the apparatus, the bespoke sensor, and a secure communication channel to communicatively couple the TCM agent logic to the bespoke sensor, wherein the TCM is to:

receive an external workload;

provision a workload enclave within the first TEE;

execute the external workload within the workload enclave; and

measure resource usage of the external workload via the bespoke sensor, wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,

wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure communication between the TCM agent of the first TEE and the TMME.

2. The computing apparatus of claim 1 , wherein the bespoke sensor is to provide fine-grained compute or energy consumption data for the external workload.

3. The computing apparatus of claim 1 , further comprising a secure interface to configure the bespoke sensor.

4. The computing apparatus of claim 1 , wherein the TCM agent is to provision the workload enclave within a scope selected from at least two different scopes, wherein each scope has different security features from the other scope.

5. The computing apparatus of claim 1 , wherein TCM agent logic further comprises a processing device selected from a group consisting of a central processing unit, graphical processing unit, and a neural network processor.

6. The computing apparatus of claim 1 , wherein the TCM agent is to provision a first workload enclave for a first workload, and a second workload enclave for a second workload, wherein the first workload enclave and second workload enclave are logically separate and mutually exclusive.

7. The computing apparatus of claim 1 , wherein the bespoke sensor is to measure the external workload independently of the workload enclave and of an operating system running on the computing apparatus.

8. The computing apparatus of claim 1 , wherein the TCM agent is further to save data of the bespoke sensor as part of a workload state.

9. The computing apparatus of claim 1 , wherein the TCM agent is further to snapshot and seal data from the bespoke sensor to the workload enclave based on a configurable event.

10. The computing apparatus of claim 1 , wherein the TCM agent is to execute within a TCM enclave separate from and mutually exclusive of the workload enclave.

11. The computing apparatus of claim 1 , wherein the TCM agent is further to convert raw data from the bespoke sensor into a billing-appropriate unit in a format different from the raw data.

12. The computing apparatus of claim 1 , wherein the at least one parameter is selected from the group consisting of power consumption, processor cycles consumed, memory consumed, storage consumed, energy transmission, and volume of communication.

13. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to instruct a processor to provide a trusted compute meter (TCM) agent to operate independently of a host operating system and to communicate securely with a bespoke sensor, wherein the TCM agent is to be provided within a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave, to:

receive an external workload for execution on a hardware platform comprising a computing resource;

provision a workload enclave to execute the external workload;

execute the external workload within the workload enclave using the computing resource; and

measure resource usage of the external workload via a bespoke sensor configured to measure at least one parameter of usage of the computing resource, wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,

wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure communication between the TCM agent of the first TEE and the TMME.

14. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the bespoke sensor is to provide fine-grained compute or energy consumption data for the external workload.

15. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is to provision the workload enclave within a scope selected from at least two different scopes, wherein each scope has different security features from the other scope.

16. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is to provision a first workload enclave for a first workload, and a second workload enclave for a second workload, wherein the first workload enclave and second workload enclave are logically separate and mutually exclusive.

17. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the bespoke sensor is to measure the external workload independently of the workload enclave and of an operating system.

18. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to save data of the bespoke sensor as part of a workload state.

19. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to snapshot and seal data from the bespoke sensor to the workload enclave based on a configurable event.

20. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TCM agent is further to convert raw data from the bespoke sensor into a billing-appropriate unit in a format different from the raw data.

21. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the at least one parameter is selected from the group consisting of power consumption, processor cycles consumed, memory consumed, storage consumed, energy transmission, and volume of communication.

22. A method of providing a trusted compute meter (TCM) agent, comprising:

receiving an external workload for execution on a computing resource;

provisioning a workload enclave to execute the external workload within a first trusted execution environment (TEE) comprising a processor configured to provide instructions to provide trusted access to a memory enclave;

executing the external workload within the workload enclave using the computing resource; and

measuring resource usage of the external workload via a bespoke sensor configured to measure at least one parameter of usage of the computing resource and to securely communicate with the TCM agent independently of a host operating system,

wherein the bespoke sensor is wholly owned by the TCM agent and is restricted from interacting with other system resources,

wherein the bespoke sensor is managed at a hardware level by a trusted meter management engine (TMME) in a second TEE, and wherein the TMME provides secure communication between the TCM agent of the first TEE and the TMME.

23. The method of claim 22 , further comprising saving data of the bespoke sensor as part of a workload state.

Assignments (21)