All right, let's get going here. My name is Matthew. I'll be talking about confidential
computing on arm and how we're going to support this with open source software.
Why do I thank you? No, that's good. So the idea here is to support an end-to-end scenario
without any black magic, without any special binaries. It's all open. The projects are there.
And we have links at the end of the slide. So there will be a lot of things that are being
presented here. There's a lot of moving parts. I do realize that. And this is why, I guess I said,
all of the links and all of the details that are going to the solution are at the end. You can all
build this. You can all run this to the same way that I have this morning. All the instructions
are there. So let's go through this.
So before going any further, what I would be presenting today is a collaboration between
Lanaro and Arm. We've been at this for over a year now. And so if we're going to the rats
architecture, what the pieces that we're going to explore today are the boxes in orange. So
we're going to talk about what's running on the target or a server. So the end-dorser,
we're also going to use the key broker and the verifier in order to run our solution.
So this is our stack, all of them are open source software. If we're going at the bottom,
we do not have hardware that is available right now. So we have two virtual machines that are
available to us. Either the FVP model from Arm or the Q&U machine. And if you choose to use Q&U,
there's two machines that are supported. The virtual and the SPSA that we just finish integrating
with the RME extension. On top of that, trusted firmware. So all of the patches are upstream.
EDK2, the same thing. All of the patches were upstream just before Christmas. So you can use
the master branches there. That's not a problem.
That one next couldle. There's a few more patches to upstream, but this is being worked on by Arm.
And on top of that, you have your choices of the MM. So either KVM tools, Q&U, or cloud-high
provider. So if we're looking at the secure side, so the RMM, which is the realm world,
the upper-visor equivalents in the realm world. And on top of that, we have our Linux stack.
On the next stack, we have at the station agents that we have added to a refile system.
So when we're talking about at the station's agents here, we have the tools in order to manipulate
and extract the CCA token. And we also have an application that is interacting with our key broker
in order to fetch our secret payload. There's a colleague of mine as well that is working on
all of the container side of the solution. So that's being worked on, but we're not going
to talk about that today. Okay. The verifier. This is project Verizon.
There's been extensive talk about that. So Verizon is an open source project,
allowing you to build a verifier. So we're using that. We have two versions.
There's one that is running in the cloud that people can use. It's all really there.
So it only lessens the amount of steps and the amount of things that you have to do
in order to put the solution together. And if you're behind a firewall where you
really, really want to run it on your own, you can do that as well. That's not a problem.
So that's the verifier side. And lastly, we have our key broker.
Key broker split into two parts. One part is the application side that is running on the refile system
that we have. Again, you can download that and build that. There's no surprises there.
And the key broker server. So that is running on your platform. You instantiate it.
You give it a key. And it will basically wait for requests. So all of that.
So before the firmware info, let's talk about the tools. We also have tools as I mentioned.
So integrate it with the solution. That way you do not have anything. You have examples to work with.
And you do not have anything extra to do. So a couple of key of tools that we're going to use.
So CCA work with authorization. So many plates. The CCA token. So extract it from the platform.
You can basically print it out and explore the content of it. And we also have a round measurement tool.
That job leap is going to talk about in more details to more. But that is basically part of project
the reason. And it allows you to compute the initial rim and the round, which are the measurement
for your virtual machine. So I've talked about all that. So what we're going to do here is take
all of these tools together in order to explore an inch one scenario. And that scenario going
back to our RATSAR architecture is the background check model where you have a device that is looking
for a secret payload in order to execute. So there will be a key broker app that will
make a request to our broker. The broker will go to the verifier, verify the platform token.
If that is in line with the policies that were pre-populated, that will come back to the
key broker. The payload will be encrypted and going back to the endorser. So we're going to go through
these steps here. So the first step here is basically to download our stack, build it and run it.
So whether you're using the FEP model or Q&U, it is the same. We'll just boot and boot to a host.
And that host gives you your RME enabled platform and from there you can launch a round.
Once you're in the realm, you're basically into the environment where you will be executing your
private payload. Second step is to start the cable cursor and we're going to see how to do that.
And you can use the verifier that runs in a cloud or you can run your own. It's exactly the same thing.
Okay, so if we are, again, into our realm environment, we have a CCO, work like at the station tool,
in order to fetch the report or the CCA token from the platform, you simply launch the command report.
It will give you a slew of thing and one of which is the initial measurement. So that is your RIM.
It basically gives you the state of your virtual machine when it's started.
The idea here is to take that key and record it. You record it in order to start your
key broker with that key. So it's a pre-populated policy. So when you have a request, the keys will be
compared and if they match, then you are basically allowed to get your secret payload.
This is just the policy that we have enacted for this demonstration here. There's
a tons of different fields that you can basically add to your policy,
based on what you want to achieve and results that are expected.
So again, so we have cellular realm. We have started our key broker service. We have a WIM
that matches in both instances. And now for that, it's time to request our secret payload.
So going back to the realm, we are simply starting our key broker server application.
I'm using my personal machine here and we're asking for a skywalker key. So basically the sky
locker payload. So what will happen is that the key broker application will go down to the platform.
It will fetch the token and it will simply send that to the key broker. The key broker will
ask our fire. The very fire will accept the payload. If everything matches, we have
basically a payload that comes back to the application and the secret payload that we have
received contains a simple string that is made the force be with you. There's a lot of things
that have happened in all this and we're going to go through that. So when we have
we have our realm, we have our key broker and we have a very fire. Again, the very fire runs
in the cloud so we do not have to instantiate it. So what happened when we launch our application?
So this is, I'm starting at three because two slides ago or three slides ago, I started at three.
So three basically means when do we launch our request? So when the request got launched,
we fetched our CCA token from the platform that was wrapped with a wrapping key and sent to the
key broker. The key broker extracted the platform token from our evidence send that to the
verifier. We have a pre-populated key, what a static key in there. Again, you can change all of that,
but this is for the benefit of the demonstration. We had in step number seven, we have our
attestation results. If the attestation results are in our being compared by the key broker,
that matched and the the result was sent back encrypted with the wrapping key,
decrypted and we have basically our content which was made the force be with you, but that can be
anything meaning a secure payload that you have now acquired the right to run on your platform.
So as I said, all of the links that I talked about, all of the technology that I talked about
is there, these are the links, they are instructions to put them together. You can everything is
available to download, compile, and run the exact same way that I have run it, and I know that they
run and they work because I have done exactly that to put this together. There's no surprises.
So that was a lot of information in the real-time questions.
So how much of this, what you've showed here, all the boxes, how much it matters? How much of this,
all of the material that I've asked is specific to CCIon arm. It is right now, it is tailored
for an arm platform, but it's not arm-specific at all. So the policies and the platform
token is obviously arm-specific, but there are different formats that can be that are open source,
that can basically be used for other architecture that will just work.
So there's nothing very arm-specific about that. The gentleman in the back raises question first.
Yeah. So we're talking about the room and the room, the initial measurement,
and the question was about freshness. I did not talk about freshness, but there's a
non-secluded rule that as well. So that's your freshness.
I didn't get that. What?
So basically the question is about the room. It's still a use case where we would like to extend
the room or use the room. So one thing that we're currently working on is device assignment.
So if you basically have a device that was acquired by or that was given to your confidential
and you still have to a test at device, but that was not part of the initial measurement that
your room was. So everything that will be part of that process will also have to be authenticated,
that driver, and that device will have to be authenticated. So that might be a case where we would
like to go to a third party for authentication. And those devices basically when you insert a module,
they come up to life. So it depends on when you do that. Yes.
Okay. To entangle question, the first thing that I think, so the room is the content of the evidence,
initially. The question is, is the room the content of the initial content of the evidence?
The room is the state of your virtual machine when it got started.
Of your room when it got started. That is when bed is measurement.
And because of RAM, initially measurement, that's content of the evidence.
Right. It's part of your CCA token. And there's two parts of the CCA token.
There is evidence. Yes. Okay. Then that's clear. Now who's creating that?
There was boxes. There was a error coming out with evidence. Which of the boxes are creating the evidence?
So the question is, which or what entity in there is creating the room and the RAM,
or the attestation token? Yeah. The whole attestation token. So basically,
that attestation token is comprised of two main chunk, the platform chunk, and the realm chunk.
So the platform chunk comes from the secure processor in the hardware. So you basically hear
because we are a virtual platform. We do not have real hardware. So that is embedded directly into the TFA.
And there's ways to modify that. But basically, so that comes from, when you're doing a request,
it goes all the way down to the TFA. The TFA will interact with the secure processor.
You'll get the platform chunk that way. And the RMM is basically doing the realm part of it,
packaged together, signed and sent back to the application. So we're still calling it an endorsement,
but someone's like a detester. We're calling it an endorsement in the diagram, but that sounds like
an attestance from me. I thought I used the language from RFC 9334. Then I'd made a mistake.
Okay. I have a warm invitation for this question.
Speak louder, please.
Yeah.
I'm going to get the invitation for questions. So, you know, like Kubernetes, you should consider this in a whole red.
For what about, like, actually, you know, security Kubernetes when you control things,
especially when you look at Tallah, for example, it's an array system for us. I just
want to say, how did they benefit from this work?
That's the question. How do you take this burden out and you build it into, like, E.S. or
E.S. or E.S. on the top of the other one? I just had a risk to do it.
Okay. So the next step is, how do you take this into a real destroyer, a real cloud environment,
using Kubernetes? Yeah. So that's the next step. So this is just providing the base
platform. How would you build a CCA enabled infrastructure on ARM? Then after that,
my colleague Kevin is basically integrated, integrating,
content and Kubernetes together. So that these can basically be used to say more that they
would be for a non-secure VM environment. That is not part of this scheme here. We're still at
a layer where we haven't included the, the glue that would take this from the base support to
a real cloud environment or a cloud provider environment, I should say. Did you have a question?
A question in that moment. I'm not sure if it will last a, you know, raise your hand?
It will last a previous question. Are you a thousand-month data? Are you a thousand-month data?
No, okay. So I work on data containers. So people are really, really looking forward to
have this fully integrated on data containers. So talk to me. Talk to, talk to Thomas, talk to
Joffrey. We're all working together and fantastic. So yeah. So at the moment, let's have a talk
about how we can see how we can speed up these developers. Absolutely. We did hands.
Sir, come again. So the detail of the secure processor. I do not have that details because I have
not implemented this on a real hardware. But typically, you would, I would be a co-processor.
That would be a mix of co-processor, secure co-processor, and TPM.
What's next on our roadmap? Very, very good question. There's a few, we are working on
memory encryption. We want to finalize the container integration and the big, big chunk
is device assignment. So again, so you have a device that is given to you via via file. That was
not part of the initial measurement of the realm. So how do you integrate that? How do you do
DMA to it? How does a DMA to you? Very complex problem. And we're working with different people from
that are taking care of other architectures because we do not want to have a norms specific solution.
It's a very complex problem. How are we doing on time? One minute. One minute.