Intel Corporation

Haidong Xia

Ravi L Sahita

Vedvyas Shanbhogue

Vincent R Scarlata

Mona Vij

Dror Caspi

Anjo Lucas Vahldiek-Oberwagner

Kshitij Arun Doshi

Wei Wang

Rameshkumar G Illikkal

Baruch Chaikin

Arumugam Thiyagarajah

Jun Nakajima

Yeluri Raghuram

Anil Rao

Samuel Ortiz

Isaku Yamahata

Andrzej Kuriata

Teck Joo Goh

Sudhir Bangalore

Thomas Adelmeyer

Uttam Shetty

Sharon Yaniv

Sean Christopherson

Vinay Awasthi

Mourad Cherfaoui

Dayeol Lee

Kekuut Hoomkwap

Wei Peng

Raghavender Nagarajan

Various systems and methods are described for implementing trust authority or trust attestation verification operations, including for Trust-as-a-Service or Attestation-as-a-Service implementations, in accordance with the techniques discussed herein. In various examples, operations and configurations are described to enable service-to-service attestation using a trust authority, to operate an attestation service, and to coordinate trust operations between relying and requesting parties.

Attestation-as-a-service for confidential computing

Techniques for migration of a source protected virtual machine from a source platform to a destination platform are descried. A method of an aspect includes enforcing that bundles of state, of a first protected virtual machine (VM), received at a second platform over a stream, during an in-order phase of a migration of the first protected VM from a first platform to the second platform, are imported to a second protected VM of the second platform, in a same order that they were exported from the first protected VM. Receiving a marker over the stream marking an end of the in-order phase. Determining that all bundles of state exported from the first protected VM prior to export of the marker have been imported to the second protected VM. Starting an out-of-order phase of the migration based on the determination that said all bundles of the state exported have been imported.

Methods, apparatus, systems, and instructions to migrate protected virtual machines

In function-as-a-service (FaaS) environments, a client makes use of a function executing within a trusted execution environment (TEE) on a FaaS server. Multiple tenants of the FaaS platform may provide functions to be executed by the FaaS platform via a gateway. Each tenant may provide code and data for any number of functions to be executed within any number of TEEs on the FaaS platform and accessed via the gateway. Additionally, each tenant may provide code and data for a single surrogate attester TEE. The client devices of the tenant use the surrogate attester TEE to attest each of the other TEEs of the tenant and establish trust with the functions in those TEEs. Once the functions have been attested, the client devices have confidence that the other TEEs of the tenant are running on the same platform as the gateway.

Scalable attestation for trusted execution environments

Scalable cloning and replication for trusted execution environments is described. An example of a computer-readable storage medium includes instructions for receiving a selection of a point to capture a snapshot of a baseline trust domain (TD) or secure enclave, the TD or secure enclave being associated with a trusted execution environment (TEE) of a processor utilized for processing of a workload; initiating cloning of the TD or secure enclave from a source platform to an escrow platform; generating an escrow key to export the snapshot to the escrow platform; and exporting a state of the TD or secure enclave to the escrow platform, the state being sealed with a sealing key.

Scalable cloning and replication for trusted execution environments

Growing community of inventors

Folsom, CA, United States of America

Haidong Xia