Secure policy ingestion into trusted execution environments
Before a composition is ingested into a runtime environment at a runtime device, the composition may be verified at an authoring trusted execution environment (TEE) operating on an authoring device. A user can operate an untrusted computing platform (e.g., a personal computer, laptop computer, tablet computer, etc.) to write code, generate data, or create some other composition. Since this composition is created on an untrusted device, the authoring TEE may output the composition on a trusted peripheral device to a user for review and approval. Responsive to receiving approval at the trusted peripheral device, the authoring TEE can sign the composition with a local key and forward the composition for execution by the runtime device. The signature can be utilized by the runtime device to prove that it was reviewed and verified by an authorized user operating the authoring device.
1. A method to verify compositions in an authoring trusted execution environment (TEE) that operates on an authoring device, comprising:
receiving, at the authoring device, a composition generated on a rich execution environment (REE) on an untrusted computing platform, the composition being generated for utilization on a runtime device;
using a trusted peripheral device that supports a user interface and is associated with the authoring TEE operating on the authoring device to expose the composition on the user interface to a user for review;
at the trusted peripheral device, receiving user input approving the composition as being trusted;
responsive to the received user input approval, signing the composition using a private key to verify that the composition is trusted; and
delivering the signed composition to a runtime TEE operating on the runtime device where the composition is utilized.
2. The method of claim 1 , in which the composition is any one of code, data, or policies.
3. The method of claim 1 , further comprising transforming the composition into human-consumable form and exposing the composition in human-consumable form on the trusted peripheral device.
4. The method of claim 1 , further comprising:
forwarding the composition to a remote service, wherein the remote service is configured with a decompiler to transform the composition into human-consumable form; and
receiving the transformed composition from the remote service for exposure on the trusted peripheral device.
5. The method of claim 1 , further comprising transforming the composition into machine-consumable form for delivery to and ingestion by the runtime device.
6. The method of claim 1 , further comprising:
forwarding the composition to a remote service, wherein the remote service is configured with a compiler to transform the composition into machine-consumable form; and
receiving the transformed composition from the remote service for delivery to and ingestion by the runtime device.
7. The method of claim 1 , in which the trusted peripheral device includes a security device unique to an authorized user to approve the composition, and the security device includes a fingerprint scanner, retina scanner, keypad for a personal identification number (PIN), near-field communication (NFC) receiver, or a keyboard for an alpha-numeric password.
8. The method of claim 1 , in which the trusted peripheral device is configured with limited functionality of outputting the composition and receiving approval or denial input from a user, wherein the limited functionality includes prohibiting editing, augmenting, or modification of compositions.
9. The method of claim 1 , in which the private key is associated with a trusted platform module (TPM) of the authoring TEE, and the private key is unique to the TPM.
10. An authoring device, comprising:
one or more processors; and
a hardware-based memory device comprising instructions which, when executed by the one or more processors operating in an authoring trusted execution environment (TEE) that operates on the authoring device, cause the authoring device to:
receive, at the authoring device, a composition generated on a rich execution environment (REE) on an untrusted computing platform, the composition being generated for utilization on a runtime device;
use a trusted peripheral device that supports a user interface and is associated with the authoring TEE operating on the authoring device to expose the composition on the user interface to a user for review;
at the trusted peripheral device, receive user input approving the composition as being trusted;
responsive to the received user input approval, sign the composition using a private key to verify that the composition is trusted; and
deliver the signed composition to a runtime TEE operating on the runtime device where the composition is utilized.
11. The authoring device of claim 10 , in which the composition is any one of code, data, or policies.
12. The authoring device of claim 10 , in which the executed instructions further cause the authoring device to transform the composition into human-consumable form and expose the composition in human-consumable form on the trusted peripheral device.
13. The authoring device of claim 10 , in which the executed instructions further cause the authoring device to:
forward the composition to a remote service, wherein the remote service is configured with a decompiler to transform the composition into human-consumable form; and
receive the transformed composition from the remote service for exposure on the trusted peripheral device.
14. The authoring device of claim 10 , in which the executed instructions further cause the authoring device to transform the composition into machine-consumable form for delivery to and execution by the runtime device.
15. One or more hardware-based non-transitory computer-readable memory devices storing instructions which, when executed by one or more processors disposed in an authoring device, cause the authoring device to:
receive, at the authoring device, a composition generated on a rich execution environment (REE) on an untrusted computing platform, the composition being generated for utilization on a runtime device;
use a trusted peripheral device that supports a user interface and is associated with an authoring trusted execution environment (TEE) that operates on the authoring device to expose the composition on the user interface to a user for review;
at the trusted peripheral device, receive user input approving the composition as being trusted;
responsive to the received user input approval, sign the composition using a private key to verify that the composition is trusted; and
deliver the signed composition to a runtime TEE operating on the runtime device where the composition is utilized.
16. The one or more hardware-based non-transitory computer-readable memory devices of claim 15 , in which the composition is any one of code, data, or policies.
17. The one or more hardware-based non-transitory computer-readable memory devices of claim 15 , in which the executed instructions further cause the authoring device to transform the composition into human-consumable form and expose the composition in human-consumable form on the trusted peripheral device.
18. The one or more hardware-based non-transitory computer-readable memory devices of claim 15 , in which the executed instructions further cause the authoring device to:
forward the composition to a remote service, wherein the remote service is configured with a decompiler to transform the composition into human-consumable form; and
receive the transformed composition from the remote service for exposure on the trusted peripheral device.
19. The one or more hardware-based non-transitory computer-readable memory devices of claim 15 , in which the trusted peripheral device is configured with limited functionality of outputting the composition and receiving approval or denial input from a user.
20. The one or more hardware-based non-transitory computer-readable memory devices of claim 19 , in which the limited functionality includes prohibiting editing, augmenting, or modification of compositions.