Secure your IoT Edge compute today with enclaves

by | Sep 21, 2020 | Uncategorized | 0 comments

This article is contributed. See the original author and article here.

Today excited to announce the general availability of Azure IoT Edge security with enclaves that helps protect sensitive assets and workloads at runtime when deployed to an IoT Edge enclave enabled device. 

 

A major roadblock to edge computing and Internet of Things (IoT) experiences is the risk of exposing sensitive assets and workloads to exfiltration or malicious tampering.  Sensitive assets include proprietary algorithms, private data, artificial intelligence models, and real-time computational insights, while sensitive workloads entail edge computing on sensitive assets which in some cases create valuable insights that generate actions to directly control critical infrastructure.  While these assets and workloads can be secured in transit and storage using encryption, they become vulnerable at runtime when they are decrypted for execution.  The lack of solutions protecting the confidentiality of sensitive assets and workloads has held back IoT solution operators from distributing rich cloud computing experiences to the edge, until now.

 

Figure 1: Deploying trusted applications (TA) with IoT Edge.Figure 1: Deploying trusted applications (TA) with IoT Edge.

 

The solution builds on the robust edge compute application deployment mechanism of Azure IoT Edge to encrypted workloads (and data) known as trusted applications or simply TA, to Azure IoT Edge enclave enabled devices for safe and secured execution inside of enclaves.  The TA is encrypted from when it leaves the developer build machine to when it lands inside of the devices trusted execution environment (TEE) or enclave where it is decrypted for safe execution.

 

We previously announced a public preview of  this solution in a blog post where we detailed the types of blocking challenges and showed how a true solution requires deep integrations and collaboration with ecosystem partners.  These integrations and collaboration are necessary to abstract the complexities away from IoT solution builders so they can focus on respective business transformations.  We highlighted one example of the requisite collaboration of ecosystem partners to simplify this experience.  We have since maintained focus and now observing dividends such as from this example alone, a solution builder is now able to:

 

In general, the ability to deploy TA is available now on IoT Edge certified enclave enabled devices built on Arm TrustZone® and Intel® Software Extension Guard (SGX®) technologies.   Building on Open Enclave SDK means you only develop once and deploy to both Arm and Intel platforms.  Moreover, Open Enclave SDK automatically opens possibilities for rich cloud-edge confidential computing patterns such as:

  • Asymmetrical compute workload distribution e.g. train ML models in the cloud rich environment and only inference in resource constrained edge devices.
  • Cloud-to-edge end-to-end confidential computing with workloads encrypted everywhere except for TEE at the edge or in the cloud e.g.  deploy the same workload in Azure IoT Edge enclave at the edge or Azure Confidential Computing virtual machines in the cloud.

 

Our commitment to simplifying confidential computing in collaboration with a wide ecosystem of partners is yielding greater maturity to Open Enclave SDK, developer tooling, and availability of commercial off-the-shelf IoT Edge enclave enabled devices.  We now offer secure deployments of trusted applications from cloud to edge at scale because of these accomplishments.

 

What’s Next

Simplifying confidential computing is a massive undertaking anywhere and more so at the edge where collaboration between many ecosystem roles and stakeholders must thrive to succeed.  Delivering an end-to-end deployment experiences is a major success milestone but there’s always opportunity for continuous improvements, such as in attestations in which you can check out our progress with Microsoft Azure Attestation. 

 

We now invite you to unleash your rich edge compute experiences with greater confidence:

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Submit a Comment