  Beyond point solutions, the vision of edge computing is to enable web
services to deploy their edge functions in a multi-tenant infrastructure
present at the edge of mobile networks. However, edge functions can be rendered
useless because of one critical issue: Web services are delivered over
end-to-end encrypted connections, so edge functions cannot operate on encrypted
traffic without compromising security or degrading performance. Any solution to
this problem must interoperate with existing protocols like TLS, as well as
with new emerging security protocols for client and IoT devices. The edge
functions must remain invisible to client-side endpoints but may require
explicit control from their service-side web services. Finally, a solution must
operate within overhead margins which do not obviate the benefits of the edge.
  To address this problem, this paper presents SPX - a solution for edge-ready
and end-to-end secure protocol extensions, which can efficiently maintain
end-to-edge-to-end ($E^3$) security semantics. Using our SPX prototype, we
allow edge functions to operate on encrypted traffic, while ensuring that
security semantics of secure protocols still hold. SPX uses Intel SGX to bind
the communication channel with remote attestation and to provide a solution
that not only defends against potential attacks but also results in low
performance overheads, and neither mandates any changes on the end-user side
nor breaks interoperability with existing protocols.
