ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2024-12-29 01:08:57 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
2a0eefd351
corda/sgx-jvm/remote-attestation
History
Tommy Lillehagen fbcdc23434
ENT-1012 - Make SGX builds IntelliJ-friendly (#208) 
* ENT-1012 - Use non-privileged user

* ENT-1012 - Build and run containerised tests from IntelliJ

* ENT-1012 - Remove trusty source in container

* ENT-1012 - Make debug target toggleable

* ENT-1012 - Inform when ready to attach debugger

* ENT-1012 - Update reference to user home folder
2017-12-19 10:19:35 +00:00
..
attestation-server ENT-1074 - Proof-of-concept ISV for SGX remote attestation (#161) 2017-12-12 13:34:26 +00:00
enclave ENT-970 - SGX remote attestation host (#173) 2017-12-13 17:45:33 +00:00
gradle/wrapper ENT-1074 - Proof-of-concept ISV for SGX remote attestation (#161) 2017-12-12 13:34:26 +00:00
host ENT-1012 - Make SGX builds IntelliJ-friendly (#208) 2017-12-19 10:19:35 +00:00
build.gradle ENT-1074 - Proof-of-concept ISV for SGX remote attestation (#161) 2017-12-12 13:34:26 +00:00
gradlew ENT-1074 - Proof-of-concept ISV for SGX remote attestation (#161) 2017-12-12 13:34:26 +00:00
gradlew.bat ENT-1074 - Proof-of-concept ISV for SGX remote attestation (#161) 2017-12-12 13:34:26 +00:00
README.md ENT-970 - SGX remote attestation host (#173) 2017-12-13 17:45:33 +00:00
settings.gradle ENT-970 - SGX remote attestation host (#173) 2017-12-13 17:45:33 +00:00

README.md

Remote Attestation

Project Organisation

  • Enclave

    The enclave (enclave/) is responsible for initialising and coordinating the remote attestation process from the client side, and will eventually operate on a secret provisioned from the challenger (once successfully attested by Intel's Attestation Service).

  • Host

    The host JVM (host/) is running in an untrusted environment and facilitates the communication between the challenger and its enclave. To coordinate with the enclave, the host uses a native JNI library (in host/native/)

  • Challenger

    The challenger JVM does not require SGX-enabled hardware and is essentially the party asking the host to prove that it has spun up a program in an enclave on trusted hardware (that cannot be tampered with), so that consequently, it can provision an encrypted secret to said enclave.

  • IAS Proxy

    The proxy is responsible for talking to the Intel Attestation Service over mutual TLS to verify attestation evidence received from the host. The proxy needs a client certificate and a service provider identifier (SPID) issued by Intel. In turn, it will forward any received proof from Intel to the host and challenger, making it possible for the challenger to trust the host and thus provision the secret. The proof is signed with Intel's root certificate.

Getting Started

To get started, run the following commands in sgx-jvm:

> source environment
> sx help

Further documentation is available in sgx-jvm/tools/sx/README.md.