Security and confidential computing axel simon office of the CTO - - PowerPoint PPT Presentation

▶
security and confidential computing
SMART_READER_LITE
LIVE PREVIEW

Security and confidential computing axel simon office of the CTO - - PowerPoint PPT Presentation

Aug 19, 2022 13 likes •549 views

Security and confidential computing axel simon office of the CTO enarx.io The Problem The Need for Confidentiality and Integrity Banking & Finance Government & Public Sector Telco IoT HIPAA GDPR

slide-1
SLIDE 1

Security and confidential computing

axel simon

  • ffice of the CTO

enarx.io

slide-2
SLIDE 2

The Problem

slide-3
SLIDE 3

The Need for Confidentiality and Integrity

  • Banking & Finance
  • Government & Public Sector
  • Telco
  • IoT
  • HIPAA
  • GDPR
  • Sensitive enterprise functions
  • Defense
  • Human Rights NGOs
  • ...
slide-4
SLIDE 4

Virtualization Stack

Middleware Userspace Kernel Firmware Hypervisor BIOS | EFI CPU | Management Engine Bootloader Application

slide-5
SLIDE 5

Container Stack

Middleware Userspace Container Engine Firmware Bootloader BIOS | EFI CPU | Management Engine Hypervisor Kernel Application

slide-6
SLIDE 6

Virtualization Stack

as seen by xkcd (xkcd.com/2166)

slide-7
SLIDE 7

Trusted Execution Environments

slide-8
SLIDE 8

What’s a TEE?

Middleware Userspace Kernel Firmware Hypervisor BIOS | EFI CPU | Management Engine Bootloader Application

TEE

slide-9
SLIDE 9

What’s a TEE?

Middleware Userspace Kernel Firmware Hypervisor BIOS | EFI CPU | Management Engine Bootloader Application

TEE Only the CPU has access

slide-10
SLIDE 10

What’s a TEE?

Middleware Userspace Kernel Firmware Hypervisor BIOS | EFI CPU | Management Engine Bootloader Application

TEE Only the CPU has access What happens when

  • ther layers try to

access?

slide-11
SLIDE 11

What’s a TEE?

Middleware Userspace Kernel Firmware Hypervisor BIOS | EFI CPU | Management Engine Bootloader Application

TEE Only the CPU has access What happens when

  • ther layers try to

access? Blocked by CPU

slide-12
SLIDE 12

Trusted Execution Environments

TEE TEE is a protected area within the host, for execution of sensitive workloads Host

slide-13
SLIDE 13

TEE provides:

  • Memory Confidentiality
  • Integrity Protection
  • General compute
  • HWRNG

Trusted Execution Environments

TEE TEE is a protected area within the host, for execution of sensitive workloads Host

slide-14
SLIDE 14

TEE provides:

  • Memory Confidentiality
  • Integrity Protection
  • General compute
  • HWRNG

Trusted Execution Environments

TEE Host

  • Q. “But how do I know that it’s a

valid TEE?” Tenant

slide-15
SLIDE 15

TEE provides:

  • Memory Confidentiality
  • Integrity Protection
  • General compute
  • HWRNG

Trusted Execution Summary

Tenant TEE

  • Q. “But how do I know that it’s a

valid TEE?”

  • A. Attestation

Host Attestation

slide-16
SLIDE 16

TEE provides:

  • Memory Confidentiality
  • Integrity Protection
  • General compute
  • HWRNG

Trusted Execution Summary

Tenant TEE Attestation Attestation includes:

  • Diffie-Hellman Public Key
  • Hardware Root of Trust
  • TEE Measurement

Code + Data (Encrypted) Host

slide-17
SLIDE 17

Trusted Execution Models

  • 1. Attestation is discussed here: https://patents.google.com/patent/US20190042463A1/en?oq=20190042463

Process-Based

  • Intel SGX (not upstream)
  • RISC-V Sanctum (no hardware)

VM-Based

  • AMD SEV
  • IBM PEF (no hardware)
  • Intel MKTME (no attestation¹)

Not a TEE: TrustZone, TPM

slide-18
SLIDE 18

Trusted Execution: Process-Based

PROS

  • Access to system APIs from Keep

CONS

  • Unfiltered system API calls from Keep
  • Application redesign required
  • Untested security boundary
  • Fantastic for malware
  • Lock-in
slide-19
SLIDE 19

Trusted Execution: Virtual Machine-Based

PROS

  • Strengthening of existing boundary
  • Run application on existing stacks
  • Bidirectional isolation
  • Limits malware

CONS

  • Hardware emulation
  • Heavy weight for microservices
  • CPU architecture lock-in
  • Duplicated kernel pages
  • Host-provided BIOS
slide-20
SLIDE 20

Introducing Enarx

slide-21
SLIDE 21

The Enarx 5-bullet overview

  • Uses TEEs (SGX, SEV, etc.) for confidential workloads
slide-22
SLIDE 22

The Enarx 5-bullet overview

  • Uses TEEs (SGX, SEV, etc.) for confidential workloads
  • Easy development and deployment using Wasm
slide-23
SLIDE 23

The Enarx 5-bullet overview

  • Uses TEEs (SGX, SEV, etc.) for confidential workloads
  • Easy development and deployment using Wasm
  • Strong security design principles
slide-24
SLIDE 24

The Enarx 5-bullet overview

  • Uses TEEs (SGX, SEV, etc.) for confidential workloads
  • Easy development and deployment using Wasm
  • Strong security design principles
  • Cloud-native → Openshift, kubernetes
slide-25
SLIDE 25

The Enarx 5-bullet overview

  • Uses TEEs (SGX, SEV, etc.) for confidential workloads
  • Easy development and deployment using Wasm
  • Strong security design principles
  • Cloud-native → Openshift, kubernetes
  • Open source: project, not production-ready (yet)
slide-26
SLIDE 26

Where do we want to be?

Enarx

slide-27
SLIDE 27

What’s the full picture?

27

Enarx Keep “Server” “Client” Tenant

Attestation handshake Workload delivery (encrypted)

Host

CPU + firmware Workload runs

slide-28
SLIDE 28

Enarx Architecture

VM-Based Keep Process-Based Keep SGX Sanctum SEV PEF WebAssembly WASI Language Bindings (libc, etc.)

W3C standards

Application MKTME

slide-29
SLIDE 29

Enarx Architecture

VM-Based Keep Process-Based Keep SGX SEV WebAssembly WASI Language Bindings (libc, etc.)

W3C standards

Application Intel AMD

slide-30
SLIDE 30

Breaking things down with SGX

Process-Based Keep SGX Application

slide-31
SLIDE 31

Breaking things down with SGX

Process-Based Keep Application SGX

slide-32
SLIDE 32

Breaking things down with SGX

Process-Based Keep SGX Application

slide-33
SLIDE 33

CONFIDENTIAL Designator

SGX demo

slide-34
SLIDE 34

Breaking things down with SEV

VM-Based Keep SEV Application

slide-35
SLIDE 35

Breaking things down with SEV

VM-Based Keep SEV Application

slide-36
SLIDE 36

Breaking things down with SEV

VM-Based Keep SEV Application

slide-37
SLIDE 37

CONFIDENTIAL Designator

SEV demo

slide-38
SLIDE 38

Where we’d like to be

VM-Based Keep SEV Process-Based Keep SGX Application

slide-39
SLIDE 39

Where we’d like to be

VM-Based Keep SEV Process-Based Keep SGX Application

slide-40
SLIDE 40

Where we’d like to be

VM-Based Keep SEV Process-Based Keep SGX Application Application Same binary

slide-41
SLIDE 41

Where we’d like to be Where we are

VM-Based Keep SEV Process-Based Keep SGX Application Application Same binary

slide-42
SLIDE 42

CONFIDENTIAL Designator

slide-43
SLIDE 43

CONFIDENTIAL Designator

slide-44
SLIDE 44

Layers - process-based Keep

Trusted via Measurement Root of Trust Distrusted CPU (Intel) Kernel Loader Shim WASM (JIT) WASI Application Enarx

Silicon architecture-dependent

Enarx Keep

Silicon architecture-dependent

slide-45
SLIDE 45

Layers (now) - process-based Keep

CPU (Intel) Kernel Loader Shim Application Enarx

slide-46
SLIDE 46

Layers - VM-based Keep

Trusted via Measurement Root of Trust Distrusted CPU (AMD) Kernel Loader (VMM) Shim WASM (JIT) WASI Application Enarx

Silicon architecture-dependent

Enarx Keep

Silicon architecture-dependent

slide-47
SLIDE 47

Layers (now) - process-based Keep

CPU (AMD) Kernel Loader (VMM) Shim Application Enarx

slide-48
SLIDE 48

Where we’d like to be Where we are

Same binary CPU (AMD) Kernel Loader (VMM) Shim ELF static-PIE binary Enarx Kernel Loader Shim CPU (Intel) ELF static-PIE binary Enarx

slide-49
SLIDE 49

Where we’d like to be next

One binary CPU (AMD) Kernel Loader (VMM) Shim Enarx Kernel Loader Shim CPU (Intel) Wasm binary WASM (JIT) WASI Enarx

slide-50
SLIDE 50

We are an open project

50

  • Code
  • Wiki
  • Design
  • Issues & PRs
  • Chat
  • CI/CD resources
  • Stand-ups
  • Diversity

✓ GitHub ✓ GitHub ✓ GitHub ✓ GitHub ✓ Rocket.Chat (Thank you!) ✓ Packet.io (Thank you!) ✓ Open to all ✓ Contributor Covenant CofC

slide-51
SLIDE 51

We Need Your Help!

51

Website: https://enarx.io Code: https://github.com/enarx License: Apache 2.0 Language: Rust

Daily stand-ups open to all! Check the website wiki for details.

slide-52
SLIDE 52

We Need Your Help!

52

Website: https://enarx.io Code: https://github.com/enarx License: Apache 2.0 Language: Rust

Daily stand-ups open to all! Check the website wiki for details.

slide-53
SLIDE 53

Questions?

https://enarx.io