Multi-tenant data protection in edge computing environments
Various approaches for implementing multi-tenant data protection are described. In an edge computing system deployment, a system includes memory and processing circuitry coupled to the memory. The processing circuitry is configured to obtain a workflow execution plan that includes workload metadata defining a plurality of workloads associated with a plurality of edge service instances executing respectively on one or more edge computing devices. The workload metadata is translated to obtain workload configuration information for the plurality of workloads. The workload configuration information identifies a plurality of memory access configurations and service authorizations identifying at least one edge service instance authorized to access one or more of the memory access configurations. The memory is partitioned into a plurality of shared memory regions using the memory access configurations. A memory access request for accessing one of the shared memory regions is processed based on the service authorizations.
1. A system comprising:
memory; and
processing circuitry coupled to the memory, the processing circuitry to:
partition the memory into a plurality of shared memory regions associated with a plurality of memory address ranges using a plurality of memory access configurations, the plurality of shared memory regions of the memory configured for shared access among a plurality of edge computing devices based at least on a mapping between the plurality of memory address ranges and identification information of the plurality of edge computing devices;
configure a shared memory region of the plurality of shared memory regions of the memory for shared access by the plurality of edge computing devices based on data in a memory access configuration of the plurality of memory access configurations, the data including the mapping and identifying a memory address range of the plurality of memory address ranges for an edge computing device of the plurality of edge computing devices, the memory address range configured in the shared memory region;
configure the shared memory region of the plurality of shared memory regions for a raw mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the raw mode access, the shared memory region includes an encrypted memory portion storing encrypted data, the encrypted memory portion specified by an encrypted address range, and the encrypted memory portion enabled for read and write access by the at least two edge computing devices;
process a memory access request for accessing the shared memory region in accordance with the memory access configuration, the memory access request received via a communication network from an edge computing device of the plurality of edge computing devices; and
complete processing of the memory access request based on granting the edge computing device access to the memory address range configured in the shared memory region.
2. The system of claim 1 , wherein the processing circuitry is to:
configure the shared memory region of the plurality of shared memory regions for a protected mode access by an edge computing device of the plurality of edge computing devices, wherein during the protected mode access, the shared memory region stores data of the edge computing device, and the data being isolated in a trusted execution environment within the shared memory region.
3. The system of claim 1 , wherein the processing circuitry is to:
configure the shared memory region of the plurality of shared memory regions for a shared plain mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared plain mode access, the shared memory region stores data enabled for secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices.
4. The system of claim 3 , wherein the processing circuitry is to:
configure the shared memory region of the plurality of shared memory regions for a shared homomorphic protected mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared homomorphic protected mode access, the shared memory region stores data enabled for the secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices and the data is encrypted using homomorphic encryption.
5. The system of claim 1 , wherein the processing circuitry is to:
obtain a plurality of device identifications of devices authorized to access the plurality of shared memory regions using the plurality of memory access configurations, the plurality of device identifications corresponding to the plurality of edge computing devices.
6. The system of claim 5 , wherein the plurality of memory access configurations further identify particular one or more edge computing devices of the plurality of edge computing devices authorized to access each memory region of the plurality of memory regions.
7. The system of claim 1 , wherein the processing circuitry is to:
detect data is stored in the shared memory region of the plurality of shared memory regions, the data being shared between one or more edge computing devices of the plurality of edge computing devices.
8. The system of claim 7 , wherein the processing circuitry is to:
replicate the data into a virtual memory region, the virtual memory region associated with at least one additional virtual memory region of the one or more edge computing devices, wherein replicating the data into the virtual memory region causes replication of the data from the virtual memory region to the at least one additional virtual memory region of the one or more edge computing devices.
9. A method comprising:
partitioning a memory into a plurality of shared memory regions associated with a plurality of memory address ranges using a plurality of memory access configurations, the plurality of shared memory regions of the memory configured for shared access among a plurality of edge computing devices based at least on a mapping between the plurality of memory address ranges and identification information of the plurality of edge computing devices;
configuring a shared memory region of the plurality of shared memory regions of the memory for shared access by the plurality of edge computing devices based on data in a memory access configuration of the plurality of memory access configurations, the data including the mapping and identifying a memory address range of the plurality of memory address ranges for an edge computing device of the plurality of edge computing devices, the memory address range configured in the shared memory region;
configuring the shared memory region of the plurality of shared memory regions for a raw mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the raw mode access, the shared memory region includes an encrypted memory portion storing encrypted data, the encrypted memory portion specified by an encrypted address range, and the encrypted memory portion enabled for read and write access by the at least two edge computing devices;
processing a memory access request for accessing the shared memory region in accordance with the memory access configuration, the memory access request received via a communication network from an edge computing device of the plurality of edge computing devices; and
completing the processing of the memory access request based on granting the edge computing device access to the memory address range configured in the shared memory region.
10. The method of claim 9 , further comprising:
configuring the shared memory region of the plurality of shared memory regions for a protected mode access by an edge computing device of the plurality of edge computing devices, wherein during the protected mode access, the shared memory region stores data of the edge computing device, and the data being isolated in a trusted execution environment within the shared memory region.
11. The method of claim 9 , further comprising:
configuring the shared memory region of the plurality of shared memory regions for a shared plain mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared plain mode access, the shared memory region stores data enabled for secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices.
12. The method of claim 11 , further comprising:
configuring the shared memory region of the plurality of shared memory regions for a shared homomorphic protected mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared homomorphic protected mode access, the shared memory region stores data enabled for the secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices and the data is encrypted using homomorphic encryption.
13. The method of claim 9 , further comprising:
decoding the plurality of memory access configurations to obtain a plurality of device identifications of devices authorized to access the plurality of shared memory regions, the plurality of device identifications corresponding to the plurality of edge computing devices,
wherein the plurality of memory access configurations further identify particular one or more edge computing devices of the plurality of edge computing devices authorized to access each shared memory region of the plurality of shared memory regions.
14. The method of claim 9 , further comprising:
detecting data is stored in the shared memory region of the plurality of shared memory regions, the data being shared between one or more edge computing devices of the plurality of edge computing devices; and
replicating the data into a virtual memory region, the virtual memory region associated with at least one additional virtual memory region of the one or more edge computing devices, wherein replicating the data into the virtual memory region causes replication of the data from the virtual memory region to the at least one additional virtual memory region of the one or more edge computing devices.
15. A non-transitory computer-readable storage medium that stores instructions for execution by one or more processors of a computing device to cause the computing device to perform operations comprising:
partitioning a memory into a plurality of shared memory regions associated with a plurality of memory address ranges using a plurality of memory access configurations, the plurality of shared memory regions of the memory configured for shared access among a plurality of edge computing devices based at least on a mapping between the plurality of memory address ranges and identification information of the plurality of edge computing devices;
configuring a shared memory region of the plurality of shared memory regions of the memory for shared access by the plurality of edge computing devices based on data in a memory access configuration of the plurality of memory access configurations, the data including the mapping and identifying a memory address range of the plurality of memory address ranges for an edge computing device of the plurality of edge computing devices, the memory address range configured in the shared memory region;
configuring the shared memory region of the plurality of shared memory regions for a raw mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the raw mode access, the shared memory region includes an encrypted memory portion storing encrypted data, the encrypted memory portion specified by an encrypted address range, and the encrypted memory portion enabled for read and write access by the at least two edge computing devices;
processing a memory access request for accessing the shared memory region in accordance with the memory access configuration, the memory access request received via a communication network from an edge computing device of the plurality of edge computing devices; and
completing the processing of the memory access request based on granting the edge computing device access to the memory address range configured in the shared memory region.
16. The non-transitory computer-readable storage medium of claim 15 , the operations further comprising:
configuring the shared memory region of the plurality of shared memory regions for one of:
a protected mode access by an edge computing device of the plurality of edge computing devices, wherein during the protected mode access, the shared memory region stores data of the edge computing device, and the data being isolated in a trusted execution environment within the shared memory region;
a shared plain mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared plain mode access, the shared memory region stores data enabled for secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices; and
a shared homomorphic protected mode access by at least two edge computing devices of the plurality of edge computing devices, wherein during the shared homomorphic protected mode access, the shared memory region stores data enabled for the secure shared access among the at least two edge computing devices or by applications executing on the at least two edge computing devices and the data is encrypted using homomorphic encryption.
17. The non-transitory computer-readable storage medium of claim 15 , the operations further comprising:
decoding the plurality of memory access configurations to obtain a plurality of device identifications of devices authorized to access the plurality of shared memory regions, the plurality of device identifications corresponding to the plurality of edge computing devices,
wherein the plurality of memory access configurations further identify particular one or more edge computing devices of the plurality of edge computing devices authorized to access each shared memory region of the plurality of shared memory regions.
18. The non-transitory computer-readable storage medium of claim 15 , the operations further comprising:
detecting data is stored in the shared memory region of the plurality of shared memory regions, the data being shared between one or more edge computing devices of the plurality of edge computing devices; and
replicating the data into a virtual memory region, the virtual memory region associated with at least one additional virtual memory region of the one or more edge computing devices, wherein replicating the data into the virtual memory region causes replication of the data from the virtual memory region to the at least one additional virtual memory region of the one or more edge computing devices.