Remote attestation for SGX enclaves #621

csegarragonz · 2022-03-14T14:02:55Z

In this PR I introduce support to remotely attest SGX enclaves using the Azure Attestation Service.

Attesting an SGX enclave consists of two steps: (1) generating a quote for the attested enclave, (2) having the remote attestation service validate said quote.

Quote Generation:

An enclave quote is an enclave's report signed by the platform's Quoting Enclave (QE). An enclave report is a measure of the enclave's memory content signed to the enclave's identity. The QE is a special-purpose Intel-provisioned singleton enclave running in all SGX-enabled and SGX-capable platforms. This means we can only generate a quote in hardware mode.

Additionally, quote generation can happen in two modes in-proc and out-of-proc. The latter is the preferred one for performance and memory consumption, and it is also the required mode for integration with AKS. To generate a quote in out-of-proc mode, we need to run a service that wraps the QE and signs reports on demand. This service is called AESM, and it listens for incoming requests in a UNIX socket. In a development cluster, we deploy this service as part of our container mesh. In an AKS cluster this service is provided by the AKS runtime.

As an artifact of the quote generation process we have a byte array with the enclave's quote. We persist useful information, together with the quote, in a helper class: sgx::EnclaveInfo.

Quote Validation:

To validate an enclave's quote, we need to send a request to attest an SGX enclave to an Azure Attestation Provider, link to the API. If the request goes through (i.e. the enclave's quote passes the policy loaded in the attestation provider) we receive a JWT. Before deeming the attestation as valid, we check the integrity of the actual JWT.

We run our own Attestation Provider, where we could potentially modify the attestation policy, but so far run the default policy. This service is free.

As part of the PR I include correct and rogue versions of both an enclave's quote and JWT, so that we can also test it in simulation mode.

There are two unrelated issues that make the tests fail. I have reported them in #634 and #635.

csegarragonz · 2022-04-01T08:57:21Z

docker/sgx-aesmd.dockerfile

@@ -0,0 +1,38 @@
+FROM ubuntu:18.04


Unfortunately, I have not been able to build this image from ubuntu:20.04.

csegarragonz · 2022-04-06T10:17:26Z

cmake/ExternalProjects.cmake

@@ -78,6 +82,10 @@ ExternalProject_Add(aws_ext
                     -DAUTORUN_UNIT_TESTS=OFF
                     -DENABLE_TESTING=OFF
                     -DCMAKE_BUILD_TYPE=Release
+    LOG_CONFIGURE ON


This supresses some verbosity from the AWS-SDK build. I included it while supressing the SGX related warnigns for cleaner builds.

csegarragonz · 2022-04-06T10:18:37Z

cmake/ExternalProjects.cmake

@@ -31,6 +31,8 @@ endif()
 conan_cmake_configure(
    REQUIRES
        "catch2/2.13.7@#31c8cd08e3c957a9eac8cb1377cf5863"
+        "jwt-cpp/0.6.0@#cd6b5c1318b29f4becaf807b23f7bb44"


The jwt-cpp dependency is needed to validate the JWT returned by the Azure Attestation Service. The picojson dependency should be installed as a dependency of jwt-cpp, but there seems to be a problem in their conan recipe. I have opened a PR in the jwt-cpp repo.

Could you add a comment above here saying that these dependencies are only needed for the Azure attestation service?

csegarragonz · 2022-04-06T11:17:14Z

include/enclave/outside/ecalls.h

 #include <sgx_urts.h>

 // What follows are the definitions of the enclave-entry calls. This is, the
 // way we have to interact with a running enclave. These calls are shared among
 // all function invocations (i.e. module instantiation).
 extern "C"
 {
-    extern faasm_sgx_status_t faasm_sgx_get_sgx_support(void);


This was not used anymore, and escaped removal in a previous PR.

csegarragonz · 2022-04-06T11:17:44Z

src/enclave/CMakeLists.txt

@@ -60,36 +60,6 @@ set(WAMR_BUILD_LIB_PTHREAD 0)
 # Let WAMR do the including and importing of the sources
 include(${WAMR_ROOT_DIR}/build-scripts/runtime_lib.cmake)

-# WAMR Trusted lib


These have been moved to inside and outside respectively.

csegarragonz · 2022-04-06T15:04:09Z

src/enclave/outside/attestation/AzureAttestationServiceClient.cpp

@@ -0,0 +1,250 @@
+#include <enclave/outside/attestation/AzureAttestationServiceClient.h>


To read this file it may be helpful to keep in mind that validateQuote in src/enclave/outside/attestation/validateQuote.cpp calls the methods in this file in this order:

AzureAttestationServiceClient client(attestationProviderUrl); // Send enclave quote to remote attestation service for validation std::string jwtResponse = client.attestEnclave(enclaveInfo); // Validate JWT response token client.validateJwtToken(jwtResponse);

csegarragonz · 2022-04-06T16:22:57Z

src/enclave/outside/attestation/generateQuote.cpp

@@ -0,0 +1,91 @@
+#include <enclave/outside/attestation/attestation.h>


Unfortunately, this method can only run in Hardware mode, which means it lies outside our test coverage.

I just noticed these file names and the header structure. We only use Pascal case in file names when they hold a class. We also usually have .h and .cpp files with the same names where possible, as it makes the code easier to navigate. For functions like this we'd put them in a file together with a snake case name. In this case I think you could combine generateQuote.cpp and validateQuote.cpp into attestation.cpp as they're defined in attestation.h. Is there a reason they're spread out?

csegarragonz · 2022-04-07T12:17:59Z

faasmcli/requirements.txt

@@ -1,4 +1,4 @@
-black==21.9b0
+black==22.3.0


Unrelated to this PR, but fixes the python formatting checks that had broken as a result of psf/black#2964.

Shillaker

This LGTM, but I'd like to get the main build working properly again before merging, just to reduce moving parts. That means the cpp, python and faabric updates in this PR shouldn't be necessary, and we'll need to bump it to 0.8.9.

Shillaker · 2022-04-12T07:14:01Z

@csegarragonz I've now made the following conflicting changes upstream, but it seems that they've fixed the build.

Updated to latest Faabric
Incremented version to 0.8.8 to pick up latest Faabric stuff in quick-start
Updated black in requirements.txt

cpp and python should also be up to date in main as well, so you can probably just take the upstream versions of them too.

Shillaker

Changes to file structure.

Shillaker · 2022-04-12T07:17:12Z

src/enclave/outside/attestation/generateQuote.cpp

@@ -0,0 +1,91 @@
+#include <enclave/outside/attestation/attestation.h>


I just noticed these file names and the header structure. We only use Pascal case in file names when they hold a class. We also usually have .h and .cpp files with the same names where possible, as it makes the code easier to navigate. For functions like this we'd put them in a file together with a snake case name. In this case I think you could combine generateQuote.cpp and validateQuote.cpp into attestation.cpp as they're defined in attestation.h. Is there a reason they're spread out?

… validation

…h the exception of enclave held data

…ers still

csegarragonz added the wasm/wamr-sgx SGX related stuff. label Mar 14, 2022

csegarragonz self-assigned this Mar 14, 2022

csegarragonz force-pushed the attestation branch 3 times, most recently from 239c204 to b5259c5 Compare March 21, 2022 19:10

csegarragonz force-pushed the attestation branch from b5259c5 to ab6b7b6 Compare March 23, 2022 09:28

csegarragonz commented Apr 1, 2022

View reviewed changes

csegarragonz force-pushed the attestation branch 2 times, most recently from 46a8479 to 4a21512 Compare April 6, 2022 10:13

csegarragonz commented Apr 6, 2022

View reviewed changes

csegarragonz force-pushed the attestation branch from 6093952 to 05f7ac7 Compare April 6, 2022 11:30

csegarragonz commented Apr 6, 2022

View reviewed changes

csegarragonz force-pushed the attestation branch from 05f7ac7 to a1cca8a Compare April 6, 2022 15:12

csegarragonz commented Apr 6, 2022

View reviewed changes

csegarragonz marked this pull request as ready for review April 6, 2022 16:35

csegarragonz force-pushed the attestation branch from 84c96b8 to 7be2575 Compare April 6, 2022 16:51

csegarragonz commented Apr 7, 2022

View reviewed changes

csegarragonz requested a review from Shillaker April 7, 2022 18:04

Shillaker reviewed Apr 11, 2022

View reviewed changes

Shillaker requested changes Apr 12, 2022

View reviewed changes

csegarragonz added 6 commits April 19, 2022 07:11

enclave: skeleton to support attestation

0e57769

enclave: more changes to make dcap work

b274db2

enclave: more work for quote generation to work

378cd73

wip

bf215b0

docker: adding images for aesm and pccs

b5dacfe

docker: add services to docker-compose file

08cfa2b

csegarragonz added 22 commits April 19, 2022 07:11

attestation: steps 1-3 in attestation working

8e2b040

milestone: finally quote generation is working. halfway through quote…

57cfffe

… validation

enclave: quote verification with remote attestation service works wit…

1639e1b

…h the exception of enclave held data

cleanup

9d6d76d

docker: preliminary docker work

4d6eb80

attestation: more cleanup

889c949

bump version

ba589b3

fix build issues and supress warnings

662c953

supress more build warnings

20da380

tests: add test to validate quote with remote attestation service

0508ab1

tests: add test for azure attestation service client

f3dacc4

tests: add test for enclave info

0d8b62b

cleanup

2399fa6

attestation: leave enclave held data for future work

347be24

enclaveInfo: factor out utility methods to faabric

10bd622

more cleanup

b112c72

tests: disable attestation tests in simulation mode, we need sgx head…

9333fb0

…ers still

docker-compose: provide default values for variables

a108a15

docker-compose: fix issues with aesmd socket

af534cb

docs: add docs on remote attestation

4dd062f

attestation: re-factor directory structure

1b037da

gh: bump code version

446e1ef

csegarragonz force-pushed the attestation branch from dd6a4a8 to 446e1ef Compare April 19, 2022 07:21

csegarragonz added 3 commits April 19, 2022 08:32

cmake: add comment to external projects

d525162

attestation: fix issues from directory re-factor

69c305f

faasmcli: bump myst-parser version

4ee5e1c

csegarragonz requested a review from Shillaker April 19, 2022 14:58

Shillaker approved these changes Apr 25, 2022

View reviewed changes

csegarragonz merged commit 92bb24a into main Apr 25, 2022

csegarragonz deleted the attestation branch April 25, 2022 07:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remote attestation for SGX enclaves #621

Remote attestation for SGX enclaves #621

csegarragonz commented Mar 14, 2022 •

edited

Loading

csegarragonz Apr 1, 2022

csegarragonz Apr 6, 2022

csegarragonz Apr 6, 2022 •

edited

Loading

Shillaker Apr 11, 2022

csegarragonz Apr 6, 2022

csegarragonz Apr 6, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading

Shillaker Apr 12, 2022

csegarragonz Apr 7, 2022

Shillaker left a comment

Shillaker commented Apr 12, 2022

Shillaker left a comment

Shillaker Apr 12, 2022

		@@ -0,0 +1,250 @@
		#include <enclave/outside/attestation/AzureAttestationServiceClient.h>

		@@ -0,0 +1,91 @@
		#include <enclave/outside/attestation/attestation.h>

		@@ -1,4 +1,4 @@
		black==21.9b0
		black==22.3.0

Remote attestation for SGX enclaves #621

Remote attestation for SGX enclaves #621

Conversation

csegarragonz commented Mar 14, 2022 • edited Loading

csegarragonz Apr 1, 2022

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022 • edited Loading

Choose a reason for hiding this comment

Shillaker Apr 11, 2022

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022 • edited Loading

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022 • edited Loading

Choose a reason for hiding this comment

csegarragonz Apr 6, 2022 • edited Loading

Choose a reason for hiding this comment

Shillaker Apr 12, 2022

Choose a reason for hiding this comment

csegarragonz Apr 7, 2022

Choose a reason for hiding this comment

Shillaker left a comment

Choose a reason for hiding this comment

Shillaker commented Apr 12, 2022

Shillaker left a comment

Choose a reason for hiding this comment

Shillaker Apr 12, 2022

Choose a reason for hiding this comment

csegarragonz commented Mar 14, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading

csegarragonz Apr 6, 2022 •

edited

Loading