SGX Enabled OpenStack Barbican Key Management System

This software is a research proof of concept and not intended for production use

Create Barbican Enclave Installer

Go to intel-sgx/source/SGX-Barbican/

Run

   sudo ./makeself_installer.sh

It will create BarbiE.bz2.run binary

Barbican Enclave Installation

Execute "BarbiE.bz2.run" as root user on the machine where you want to setup Barbican with IP address as argument

    sudo ./BarbiE.bz2.run <ip_v4_address>

During installation it will prompt for details for self signed SSL certificate generation.

Pre-requisite

• All properties are mandatory

  Required Properties are BARBICAN_ENCLAVE_PATH, IAS_URL, IAS_CRT_PATH, IAS_SPID, IAS_ENABLED for Barbican on different lines

  Example:
         BARBICAN_ENCLAVE_PATH=/opt/BarbiE/lib
         IAS_URL=https://test-as.sgx.trustedservices.intel.com:443/attestation/sgx/v1/report
         IAS_CRT_PATH=/root/client.pem
         IAS_SPID=76508EJNCLBLB8DS19AC35I5U7XDV828
         IAS_ENABLED=True/False

IAS_ENABLED : Enables/disabled communication of server with IAS for quote verification.

**IAS_URL, IAS_CRT_PATH, IAS_SPID ** : Required for quote verification with IAS.

Barbican service start/stop/restart

/opt/BarbiE/startup.sh start/stop/restart

Testing Barbican SGX Integration

Go under /opt/BarbiE/test_scripts/

sudo python sgx.py <SPID> <CRT_PATH>

SPID : SPID provided by IAS in hexstring format CRT_PATH : Absolute path of certificate for IAS server

Sample Commands

Provision Master key encryption key on Barbican

sudo python sgx_client_wo_hw.py -ip [<IP>] -p <proj_id> [--admin] -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server. Default :- localhost
proj_id : Project ID
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format. Required only when we are providing 'client_verify_ias'
IAS_CRT : Absolute path of certificate for IAS server. Required only when we are providing 'client_verify_ias'

SGX Aware client(without SGX Hardware) talking with Barbican Enclave E

ias_enable	server_verify_ias	client_verify_ias	Expected output
True	True	True	Client verified quote
True	True	False	Server(E) verified quote
True	False	True	Client verified quote
True	False	False	Server(E) verified quote
False	True	True	Client verified quote
False	True	False	Server(E) not configured to do ias verification
False	False	True	Client verified quote
False	False	False	No IAS verification required. Fake report generated by server(E)

ias_enabled flag represents if server configured to talk with IAS.

server_verify_ias flag is provided by client to let server do the quote verification with IAS.

client_verify_ias flag is provided by client to let server know that client will verify quote with IAS.

• Provision Master key in Barbican

sudo python sgx_client_wo_hw.py -ip [<IP>] -p <proj_id> [--admin] -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server.(Default - localhost)
proj_id : Project ID
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format. Required only when we are providing 'client_verify_ias'
IAS_CRT : Absolute path of certificate for IAS server. Required only when we are providing 'client_verify_ias'

• Attestation and Secret management

sudo python sgx_client_wo_hw.py -ip [<IP>] -p <proj_id> -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server.(Default - localhost)
proj_id : Project ID
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format. Required only when we are providing 'client_verify_ias'
IAS_CRT : Absolute path of certificate for IAS server. Required only when we are providing 'client_verify_ias'

• Policy Management

sudo python sgx_client_wo_hw.py -ip [<IP>] -p <proj_id> -po [<policy>] -mre [<mr_enclave_list_file_path>] -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server.(Default - localhost)
proj_id : Project ID
policy  : Project Policy to be set. Along with policy, MR Signer or path of file with list of MR Enclaves that are base64 encoded needs to be provided.
          Accepted values :-
          1 :- Mr Signer of the Client is validated.
          3 :- Mr Enclave of the Client is validated with a list of third party enclaves.
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format. Required only when we are providing 'client_verify_ias'
IAS_CRT : Absolute path of certificate for IAS server. Required only when we are providing 'client_verify_ias'

SGX Aware client with SGX Hardware

E1 :- Enclave 1

E2 :- Enclave 2(Barbican Enclave)

E1 is initiator of the Mutual Attestation with E2

ias_enable	server_verify_ias	client_verify_ias	Expected output
True	True	True	E1 & E2 verify quote when acting as client enclave
True	True	False	E1 & E2 verify quote when acting as server enclave
True	False	True	E1 & E2 verify quote when acting as client enclave
True	False	False	E1 & E2 verify quote when acting as server enclave
False	True	True	Server not configured to do ias verification
False	True	False	Server not configured to do ias verification
False	False	True	Server not configured to do ias verification
False	False	False	E1 verify quote when acting as server enclave & E2 generate fake report when acting as server

ias_enabled flag represents if server configured to talk with IAS.

server_verify_ias flag is provided by client to let server do the quote verification with IAS.

client_verify_ias flag is provided by client to let server know that client will verify quote with IAS.

• Policy Management

  sudo python sgx_client_with_hw.py -ip [<IP>] -p <proj_id> -po [<policy>] -mre [<mr_enclave_list_file_path>] -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server. Default :- localhost
proj_id : Project ID   
policy  : Project Policy to be set. Mandatory during first mutual attestation. If provided in
          the subsequent call, client will be validated with existing policy and the project 
          policy will be updated. When policy '3' is provided, path of file with list of MR enclaves
          that are base64 encoded needs to be provided.
          Accepted values :-
          1 :- Mr Signer of the Client is validated.
          2 :- Mr Enclave of the Client is validated.
          3 :- Mr Enclave of the Client is validated with a list of third party enclaves.
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format
IAS_CRT : Absolute path of certificate for IAS server

• Secret Management

sudo python sgx_client_with_hw.py -ip [<IP>] -p <proj_id> -s [<SPID>] -crt [<IAS_CRT>] [--server_verify_ias] [--client_verify_ias]

IP      : IPv4 address of the server. Default :- localhost
proj_id : Project ID
client_verify_ias : Client will call IAS for quote verification.
server_verify_ias : Server will call IAS for quote verification.
SPID    : SPID provided by IAS in hexstring format
IAS_CRT : Absolute path of certificate for IAS server

- The above test scripts are for standalone use of barbican. If barbican is configured with Keystone, the client scripts wont work.