Network supported low latency security-based orchestration
Various aspects of methods, systems, and use cases include security-based orchestration. A method may include evaluating, within a secure environment of an untrusted device, a preamble to determine a set of security requirements. The method may include, providing, to an attestation server, an indication of security parameters for services of the untrusted device corresponding to security requirements of the set of security requirements, and in response to receiving a confirmation from the attestation server, providing a request to the untrusted device outside the secure environment to generate a trusted domain including the services.
1. A device comprising:
processing circuitry operating outside a secure environment;
processing circuitry operating within a secure environment; and
memory including instructions for security-based orchestration, which when executed by the processing circuitry operating within the secure environment, causes the processing circuitry operating within the secure environment to perform operations including:
receiving, from an edge device, a binary file;
evaluating a preamble of the binary file to determine a set of security requirements;
providing, to an attestation server, an indication of security parameters for services of the device corresponding to security requirements of the set of security requirements;
receiving a confirmation from the attestation server based on the indication; and
in response to receiving the confirmation, providing a request to the processing circuitry operating outside the secure environment to generate a trusted domain outside the secure environment to execute the services.
2. The device of claim 1 , wherein evaluating the preamble includes sequentially determining whether a service of the device corresponding to each of the set of security requirements meets a respective security requirement.
3. The device of claim 1 , wherein the instructions further cause the processing circuitry operating within the secure environment to perform operations including executing the services within the trusted domain using the binary file.
4. The device of claim 1 , wherein the set of security requirements include at least one contingent security requirement, the contingent security requirement including a first requirement for a first level of security for a service, and a second requirement for a second level of security for the service requiring less security than the first level.
5. The device of claim 4 , wherein in response to the first level of security not being met at the device, the instructions further cause the processing circuitry operating within the secure environment to perform operations including providing the indication of security parameters for the services includes providing an indication of security parameters corresponding to the second level of security.
6. The device of claim 1 , wherein the set of security requirements include at least two different levels of security for at least two respective services.
7. The device of claim 1 , wherein the edge device is a vehicle.
8. The device of claim 1 , wherein the preamble is in a header of a packet or in a header packet of the binary file.
9. The device of claim 1 , wherein evaluating the preamble includes evaluating a set of execution requirements, and wherein the instructions further cause the processing circuitry operating within the secure environment to perform operations including identifying the services based on both the execution requirements and the security requirements.
10. The device of claim 1 , wherein the instructions further cause the processing circuitry operating within the secure environment to perform operations including:
evaluating a second preamble of a second binary file to determine a second set of security requirements and a second set of execution requirements;
determining that a security requirement of the second set of security requirements or an execution requirement of the second set of execution requirements cannot be met at the device; and
in response to the determination, providing a notification that the respective requirement cannot be met.
11. The device of claim 1 , wherein the device is one of at least two devices receiving the binary file from an orchestration device.
12. The device of claim 1 , wherein the trusted domain is stored and accessible across a network by another device.
13. An apparatus for security-based orchestration, the apparatus comprising:
means for receiving, from an edge device, a binary file at a secure environment of the apparatus;
means for evaluating within the secure environment, a preamble of the binary file to determine a set of security requirements;
means for providing, to an attestation server, an indication of security parameters for services of the apparatus corresponding to security requirements of the set of security requirements;
means for receiving a confirmation from the attestation server based on the indication; and
in response to receiving the confirmation, means for providing a request to the apparatus outside the secure environment to generate a trusted domain including the services.
14. The apparatus of claim 13 , wherein the means for evaluating the preamble include means for sequentially determining whether a service of the apparatus corresponding to each of the set of security requirements meets a respective security requirement.
15. The apparatus of claim 13 , further comprising means for executing the services within the trusted domain using the binary file.
16. A method for security-based orchestration, the method comprising:
receiving, from an edge device, a binary file at a secure environment of a device;
evaluating within the secure environment, a preamble of the binary file to determine a set of security requirements;
providing, to an attestation server, an indication of security parameters for services of the device corresponding to security requirements of the set of security requirements;
receiving a confirmation from the attestation server based on the indication; and
in response to receiving the confirmation, providing a request to the device outside the secure environment to generate a trusted domain including the services.
17. The method of claim 16 , wherein the set of security requirements include at least one contingent security requirement, the contingent security requirement including a first requirement for a first level of security for a service, and a second requirement for a second level of security for the service requiring less security than the first level.
18. The method of claim 17 , wherein when the first level of security is not met at the device, providing the indication of security parameters for the services includes providing an indication of security parameters corresponding to the second level of security.
19. The method of claim 16 , wherein the preamble is in a header of a packet or in a header packet of the binary file.
20. The method of claim 16 , wherein evaluating the preamble includes evaluating a set of execution requirements, and further comprising identifying the services based on both the set of execution requirements and the security requirements.
21. A non-transitory machine-readable medium having a program stored thereon, which when executed by processing circuitry, causes a secure environment of a device to perform operations comprising:
evaluating within the secure environment, a preamble of the program to determine a set of security requirements;
providing, to an attestation server, an indication of security parameters for services of the device corresponding to security requirements of the set of security requirements;
receiving a confirmation from the attestation server based on the indication; and
in response to receiving the confirmation, providing a request to the device outside the secure environment to generate a trusted domain including the services.
22. The non-transitory machine-readable medium of claim 21 , wherein the non-transitory machine-readable medium includes operations for execution in the trusted domain by the services.
23. The non-transitory machine-readable medium of claim 22 , wherein the program is configured to prevent execution of the operations unless the set of security requirements are met.
24. The non-transitory machine-readable medium of claim 21 , wherein the non-transitory machine-readable medium includes routing information.
25. The non-transitory machine-readable medium of claim 21 , wherein the preamble includes a set of execution requirements, and wherein the, program, when executed, causes the processing circuitry to determine whether the device is configured to provide services corresponding to the set of execution requirements and subject to the set of security requirements.