Granted Patent B2

US 12,450,332 · App. 18/236,352 · Granted Oct 21, 2025

Inventors: Michael Kaplan (New York, NY); Bernard Wong (Waterloo, CA); Nicholas John Mussallem (San Rafael, CA); Stephen John Buttolph (Brooklyn, NY); Patrick Robert O'Grady (Palo Alto, CA); Kevin Sekniqi (Sunny Isles Beach, FL); Ted Yin (Mountain View, CA)

Assignee: Ava Labs, Inc.

G06F21/53H04L67/1012

Abstract

Claims (56)

1. A computer-implemented method for providing an application trusted execution environment, the method comprising:

performing first attestation of a first application enclave from multiple application enclaves for a plurality of applications, to gain trust in executing the application enclaves for the plurality of applications;

receiving a request from a client;

selecting a first load balancer from multiple load balancers to forward the request to the application enclaves;

encrypting, by the first load balancer, a request body of the request in an application layer, based on a type of the request;

performing second attestation of the first load balancer based on an attestation report; and

routing, by an enclave server of the load balancer, the request from the load balancer to an application enclave of the application enclaves for execution of an application of the plurality of applications in the application trusted execution environment.

2. The computer-implemented method of claim 1 , wherein the request from the client includes to store a public data, further comprising assigning a sensitivity level to the request, storing the public data in a database, and enabling a server operator in the database to read and modify the public data.

3. The computer-implemented method of claim 1 , wherein the request from the client includes an account balance, further comprising assigning a sensitivity level to the request, and storing the account balance in an encrypted Merkle trie accessible to an authorized application enclave.

4. The computer-implemented method of claim 1 , wherein performing the attestation of a first application enclave comprises:

determining, by the first load balancer and for each application enclave, cryptographic information comprising at least one of: a shared cryptographic key, a cryptographic credential, or a hash authentication of an application configured to be executed by the application enclaves; and

verifying, based on the cryptographic information, a validity or authenticity of each of the application enclaves.

5. The computer-implemented method of claim 1 , wherein receiving the request comprises receiving a type of an application layer request corresponding to the request.

6. The computer-implemented method of claim 1 , wherein selecting the first load balancer comprises:

initializing each of the load balancers as a stateless application; and determining the load balancers based on a domain name system (DNS) record.

7. The computer-implemented method of claim 1 , further comprising determining a sensitivity level of the request based on a trusted environment parameter depending on whether the request or information associated with the request requires encryption.

8. The computer-implemented method of claim 6 , wherein routing the request from the first load balancer to the first application enclave comprises determining, based on a trusted environment parameter, a visibility of client information associated with the request according to a sensitivity level of the request.

9. The computer-implemented method of claim 1 , further comprising:

encrypting the request body of the request in the application layer, based on corresponding shared cryptographic information with each of the application enclaves; and

performing, by the first load balancer, user input sanitization.

10. The computer-implemented method of claim 1 , further comprising:

encrypting, based on a sensitivity level and prior to sending the request to at least one of the application enclaves, information associated with the request via an encryption mechanism shared with the at least one of the application enclaves;

selecting the first application enclave based on the sensitivity level or a type of application; validating a response from the first application enclave as authentic; and

encrypting the response prior to returning the response to the client.

11. A system for providing an application trusted execution environment, comprising: one or more processors; and

a memory comprising instructions stored thereon, which when executed by the one or more processors, causes the one or more processors to perform:

performing first attestation of each application enclave of a plurality of application enclaves for a plurality of applications;

receiving a request from a client;

selecting a load balancer of a plurality of load balancers to forward the request to the plurality of application enclaves;

encrypting, by the load balancer, prior to sending the request to at least one of the plurality of application enclaves, information associated with the request via an encryption mechanism shared with the at least one of the plurality of application enclaves;

performing second attestation of the load balancer based on an attestation report; and

routing, by an enclave server, the request from the load balancer to an application enclave of the plurality of application enclaves for execution of an application of the plurality of applications in the application trusted execution environment.

12. The system of claim 11 , wherein the instructions that cause the one or more processors to perform performing the attestation of each application enclave cause the one or more processors to determine, by the load balancer and for each application enclave, a shared cryptographic key to encrypt and authenticate requests from each application enclave.

13. The system of claim 11 , wherein the one or more processors further execute instructions to verify that a hash authentication of an application configured to be executed by the plurality of application enclaves matches an expected version.

14. The system of claim 11 , wherein the instructions that cause the one or more processors to perform receiving the request cause the one or more processors to perform receiving a type of application programming interface (API) request corresponding to the request.

15. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform determining a sensitivity level of the request based on a trusted environment parameter, depending on whether the request or information associated with the request requires encryption.

16. The system of claim 11 , wherein the instructions that cause the one or more processors to perform selecting the load balancer cause the one or more processors to perform:

initializing each of the plurality of load balancers as a stateless application;

determining the plurality of load balancers based on a domain name system record; and

routing the request from the load balancer to the application enclave and determining, based on a trusted environment parameter, a visibility of client information associated with the request according to a sensitivity level of the request.

17. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform encrypting, by the load balancer, a request body of a request to an application layer, based on corresponding shared cryptographic information with each of the plurality of application enclaves.

18. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform:

performing, by the load balancer, user input sanitization.

19. The system of claim 11 , further comprising stored sequences of instructions, which when executed by the one or more processors, cause the one or more processors to perform:

selecting the application enclave based on a sensitivity level or a type of application; and

validating a response from the application enclave as authentic prior to returning the response to the client.

20. A non-transitory computer-readable storage medium comprising instructions stored thereon, which when executed by one or more processors, cause the one or more processors to perform operations for providing an application trusted execution environment, comprising:

performing attestation of each application enclave of a plurality of application enclaves for a plurality of applications;

receiving a request from a client;

selecting a load balancer of a plurality of load balancers to forward the request to the plurality of application enclaves;

encrypting, prior to sending the request to at least one of the plurality of application enclaves, information associated with the request via an encryption mechanism shared with the at least one of the plurality of application enclaves;

selecting an application enclave of the plurality of application enclaves based on the application;

encrypting, by the first load balancer, a request body of the request in an application layer, based on a type of the request;

performing second attestation of the first load balancer based on an attestation report;

routing, by an enclave server, the request from the load balancer to the application enclave for execution of an application of the plurality of applications in the application trusted execution environment; and

validating a response from the application enclave as authentic prior to returning the response to the client.

Assignments (1)

Continuity (2)

References Cited (28)