Confidential computing environment including devices connected to a network interface device
Examples described herein relate to extending a first trust domain of a service to a service mesh interface executed in a network interface device and to at least one device coupled to the network interface device. In some examples, extending the first trust domain of the service to the service mesh interface executed in the network interface device and to the at least one device coupled to the network interface device includes causing execution of the service mesh interface in a second trust domain in the network interface device; providing a third trust domain for the at least one device, when connected to the network interface device; and extending the first trust domain into the second trust domain or the third trust domain.
1 . At least one non-transitory computer-readable medium, comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
execute an orchestrator to extend a first trust domain of a service to a service mesh interface executed in a network interface device and to at least one device coupled to the network interface device;
wherein the extend the first trust domain of the service to the service mesh interface executed in the network interface device and to the at least one device coupled to the network interface device comprises:
cause execution of the service mesh interface in a second trust domain in the network interface device; and
extend the first trust domain into the second trust domain.
2 . The computer-readable medium of claim 1 , wherein the extend the first trust domain of the service to the service mesh interface executed in the network interface device and to the at least one device coupled to the network interface device comprises:
provide a third trust domain for the at least one device, when connected to the network interface device; and
extend the first trust domain into the third trust domain.
3 . The computer-readable medium of claim 1 , comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
execute the orchestrator to:
assign a unique identity per assignable interface for access to the at least one device and
perform attestation of the at least one device based on the unique identity and a firmware signature.
4 . The computer-readable medium of claim 3 , wherein connections based on the assignable interface do not share keys after authentication.
5 . The computer-readable medium of claim 2 , comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
assign the at least one device to the third trust domain based on authentication of the at least one device.
6 . The computer-readable medium of claim 1 , wherein the at least one device comprises one or more of: a storage device, accelerator, graphics processing unit (GPU), general purpose GPU (GPGPU), and/or a memory device.
7 . The computer-readable medium of claim 2 , wherein the service mesh interface is associated with an infrastructure provider and the first and third trust domains are provided for a tenant.
8 . The computer-readable medium of claim 2 , wherein the service mesh interface is associated with a tenant and the first, second, and third trust domains are provided for the tenant.
9 . The computer-readable medium of claim 1 , wherein the network interface device comprises one or more of: a network interface controller (NIC), a remote direct memory access (RDMA)-enabled NIC, SmartNIC, router, switch, forwarding element, infrastructure processing unit (IPU), or data processing unit (DPU).
10 . A method comprising:
providing a confidential computing security environment for multiple tenants to execute one or more services within multiple associated trust domains,
wherein: one or more services associated with a tenant access a service mesh interface within a trust domain, wherein the service mesh interface is executed by a network interface device and the one or more services associated with the tenant are to access at least one device coupled to the network interface device via at least one secure channel; and
performing attestation to determine whether the trust domain is to be extended to communicate with a trust domain of the service mesh interface and the at least one secure channel.
11 . The method of claim 10 , wherein the at least one secure channel is associated with an assignable interface for access to the at least one device.
12 . The method of claim 10 , comprising:
performing attestation of the at least one device based on at least one device identity and at least one firmware signature.
13 . The method of claim 10 , wherein the at least one device comprises one or more of: a storage device, accelerator, graphics processing unit (GPU), general purpose GPU (GPGPU), and/or a memory device.
14 . The method of claim 10 , wherein the service mesh interface is provided by an infrastructure provider.
15 . The method of claim 10 , wherein the service mesh interface is associated with the tenant associated with the one or more services.
16 . An apparatus comprising:
a network interface device comprising:
a network interface;
at least one processor; and
circuitry to:
execute a service mesh interface in a first trust domain in the at least one processor;
provide a second trust domain for one or more devices connected to the network interface device via one or more device interfaces;
perform attestation to determine whether a trust domain is to be extended to communicate with the first trust domain and the second trust domain;
extend the trust domain in which a service is executed to include the first trust domain and the second trust domain; and
transmit one or more packets to the service mesh interface from the service.
17 . The apparatus of claim 16 , wherein the circuitry is to:
assign the one or more devices to the second trust domain based on authentication of the one or more devices.
18 . The apparatus of claim 16 , wherein the one or more devices comprise one or more of: a storage device, accelerator, graphics processing unit (GPU), general purpose GPU (GPGPU), and/or a memory device.
19 . The apparatus of claim 16 , wherein the service mesh interface is associated with an infrastructure provider and the first and second trust domains are provided for a tenant.