Allowing remote attestation of trusted execution environment enclaves via proxy
A method for executing a trusted execution environment (TEE) based application in a cloud includes receiving, by a proxy, a request from a client, requesting, by the proxy from an attestation service, attestation, and sending, by the proxy to the client, a result of the attestation.
1. A method for executing a trusted execution environment (TEE) based application in a cloud computing system, the method comprising:
receiving, by a proxy, a request from a client;
requesting, by the proxy from an attestation service, attestation; and
sending, by the proxy to the client, a result of the attestation,
wherein the proxy is provided by a cloud service provider that operates the cloud computing system, and
wherein the proxy is configured to manage enclave provisioning in the cloud for an application of the client.
2. The method according to claim 1 , wherein managing enclave provisioning in the cloud includes deploying enclaves for executing the application of the client, attesting deployed application enclaves, and provisioning secrets of the application of the client to the deployed application enclaves.
3. The method according to claim 2 , wherein the secrets of the application of the client include an application secret key.
4. The method according to claim 2 , wherein managing enclave provisioning in the cloud further includes verifying that deployment of a new enclave does not violate a deployment policy defined by the client.
5. The method according to claim 4 , wherein the deployment policy specifies an upper bound to a number of enclaves that can be run simultaneously in the cloud.
6. The method according to claim 5 , wherein the deployment policy further specifies lease renewal periods for the deployed enclaves and permissible locations at which application enclaves can be deployed.
7. The method according to claim 2 , wherein the proxy assigns, to each of the deployed application enclaves, an enclave status.
8. The method according to claim 7 , wherein the proxy maintains a list of deployed application enclaves that includes a status associated with each application enclave.
9. The method according to claim 1 , wherein the proxy is configured to store, at a storage layer, identifiers of the application of the client.
10. The method according to claim 9 , wherein the storage layer is a Byzantine Fault Tolerant (BFL) storage layer.
11. The method according to claim 9 , wherein the identifiers of the application of the client include an integrity measurement result of the application of the client and an application secret key.
12. A system for executing a trusted execution environment (TEE) based application in a cloud computing system, the system comprising:
a processor readable memory including a secure storage layer; and
one or more processors configured to: receive a request from a client; request, from an attestation service, attestation; and send, to the client, a result of the attestation,
wherein the one or more processors are included in a proxy provided by a cloud service provider that operates the cloud computing system, and
wherein the proxy is configured to manage enclave provisioning in the cloud for an application of the client.
13. A non-transitory computer readable medium having stored thereon instructions for performing a method for executing a trusted execution environment (TEE) based application in a cloud computing system, the method comprising:
receiving, by a proxy, a request from a client;
requesting, by the proxy from an attestation service, attestation; and
sending, by the proxy to the client, a result of the attestation,
wherein the proxy is provided by a cloud service provider that operates the cloud computing system, and
wherein the proxy is configured to manage enclave provisioning in the cloud for an application of the client.