2020-03-24 DCAP attestation
Date
Mar 24, 2020
Goals
To look in to how to use the datacenter attestation primitives
Discussion items
A presentation on DCAP attestation primitives for Intel SGX TEEs with Avalon (Proxy Model) by Mr. Dan Middleton from Intel, covering the following topics
Basics of attestation
Use the lab to demonstrate creating an attestation at one CSP
and then verifying it in a (virtual) on-prem datacenter
The attestation flow enables more distributed communication patterns than what we have today.
The added flexibility also means there are a lot of possible paths to choose which can seem confusing.
In order to get started, here's a lab that chooses one concrete path.
https://github.com/hyperledger-labs/dancap
The video of the session is here:
Comments
Mar 31, 2020
(edited)
Here's my notes on this presentation:
DCAP: Data Center Attestation Protocol for Intel SGX
Summary:
Introductory material on Confidential Computing, Trusted Execution Environments (TEEs), and Avalon
Motivation for using DCAP (replaces centralized Intel Attestation Service (IAS))
Local DCAP attestation verification lab demo
Integration of DCAP with Avalon
Links:
Dan Middletons's DCAP lab; includes extensive tips in README.md file
https://github.com/hyperledger-labs/dancap
Intel SGX error code header file
SGX_QL_NETWORK_ERROR = SGX_QL_MK_ERROR(0x0019), // Network or proxy errorhttps://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h
Getting started with Azure Confidential Computing (for Intel SGX)
https://software.intel.com/en-us/articles/get-started-with-azure-confidential-computing
(Note the excellent comment at end of this article with Intel SGX tips by .... me )
Terms
ACC - Azure Confidential Computing - uses Intel SGX in the Azure cloud
Attestation - proof that something (such as code or data) was checked for validity (such as with signature validation)
Confidential computing - protection of data in use by performing computation within hardware-based trusted execution environments
Intel SGX - Intel Software Guard Extensions (a TEE implementation)
PCCS - Provisioning Certificate Caching Service -- used by DCAP service for self-signed certs