Verifying trust postures of heterogeneous confidential computing clusters
Disclosed are systems, apparatuses, methods, and computer-readable media for providing security postures for a service provided by a heterogenous system. A method for verifying trust by a service node includes receiving a request for a security information of the service node from a client device, wherein the request includes information identifying a service to receive from the service node, identifying a related node to communicate with the service node based on the service, after identifying the related node, requesting a security information of the related node, generating a composite security information from the security information of the service node and the security information of the related node, and sending the composite security information to the client device. The composite security information provides security claims for a service implemented by a heterogenous devices that have different trusted execution environments.
1. A method for verifying trust by a service node, the method comprising:
receiving a request for a security information of the service node from a client device, wherein the request includes information identifying a service to receive from the service node;
identifying a related service node to communicate with the service node based on the service, wherein the related service node is associated with the service;
after identifying the related service node, requesting a security information of the related service node;
generating a composite security information from the security information of the service node and the security information of the related service node, including:
identifying affirming claims and detracting claims in the security information of the service node and the security information of the related service node, the affirming claims being in support of providing security, and the detracting claims being opposed to provide security;
including in the composite security information matching affirming claims which appear in both the security information of the service node and the security information of the related service node;
excluding from the composite security information affirming claims which appear in one but not both of the security information of the service node and the security information of the related service node;
including in the composite security information any detracting claims that appear in either of the security information of the service node and the security information of the related service node; and
sending the composite security information to the client device.
2. The method of claim 1 , wherein the security information includes a plurality of claims related to a type of verification, wherein the type of verification includes at least one a hardware verification, a unique identify verification, a data integrity verification, a boot verification, and an executable verification.
3. The method of claim 2 , first comprising: in response to receiving the security information from the related service node, identifying implicit claims in the security information of the related service node, and appending the implicit claims to the security information from the related service node.
4. The method of claim 1 , further comprising:
executing a spanning tree algorithm to identify candidate nodes associated with the service from addressable nodes, wherein the related service node is selected from the candidate nodes.
5. The method of claim 1 , wherein the service node comprises a first trusted module and the related service node comprises a second trusted module, and wherein the first trusted module is different from the second trusted module.
6. The method of claim 1 , further comprising:
transmitting a request to a management node to identify candidate related service nodes; and
receiving a list of the candidate related service nodes from a management node that determines which candidate nodes are qualified to deliver the service.
7. A service node for providing trust postures of a heterogenous system, comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions and cause the processor to:
receive a request for a security information of the service node from a client device, wherein the request includes information identifying a service to receive from the service node;
identify a related service node to communicate with the service node based on the service, wherein the related service node is associated with the service;
after identifying the related service node, request a security information of the related service node;
generate a composite security information from the security information of the service node and the security information of the related service node, including:
identify affirming claims and detracting claims in the security information of the service node and the security information of the related service node, the affirming claims being in support of providing security, and the detracting claims being opposed to provide security;
include in the composite security information matching affirming claims which appear in both the security information of the service node and the security information of the related service node;
exclude from the composite security information affirming claims which appear in one but not both of the security information of the service node and the security information of the related service node;
include in the composite security information any detracting claims that appear in either of the security information of the service node and the security information of the related service node; and
send the composite security information to the client device.
8. The service node of claim 7 , wherein the security information includes a plurality of claims related to a type of verification, wherein the type of verification includes at least one a hardware verification, a unique identify verification, a data integrity verification, a boot verification, and an executable verification.
9. The service node of claim 7 , wherein the processor is configured to execute the instructions and cause the processor to:
executing a spanning tree algorithm to identify candidate nodes associated with the service from addressable nodes, wherein the related service node is selected from the candidate nodes.
10. The service node of claim 7 , wherein the service node comprises a first trusted module and the related service node comprises a second trusted module, and wherein the first trusted module is different from the second trusted module.
11. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
receive a request for a security information of a service node from a client device, wherein the request includes information identifying a service to receive from the service node;
identify a related service node to communicate with the service node based on the service, wherein the related service node is associated with the service;
after identifying the related service node, request a security information of the related service node;
generate a composite security information from the security information of the service node and the security information of the related service node, including:
identify affirming claims and detracting claims in the security information of the service node and the security information of the related service node, the affirming claims being in support of providing security, and the detracting claims being opposed to provide security;
include in the composite security information matching affirming claims which appear in both the security information of the service node and the security information of the related service node;
exclude from the composite security information affirming claims which appear in one but not both of the security information of the service node and the security information of the related service node;
include in the composite security information any detracting claims that appear in either of the security information of the service node and the security information of the related service node; and
send the composite security information to the client device.