| Table of Contents |
|---|
...
| Reference_description_with_linked_URLs_______________________ | Notes______________________________________________________________ |
|---|---|
| https://github.com/intel/linux-sgx | Linux SGX |
| https://docs.kernel.org/virt/ne_overview.html | Linux support for AWS Nitro Enclaves in EC2 |
Key Concepts
Security Guides
Security Guides
Secure Enclaves for Containers
...
https://github.com/gramineproject/graphene
Graphene is a lightweight library OS, designed to run a single application with minimal host requirements. Graphene can run applications in an isolated environment with benefits comparable to running a complete OS in a virtual machine -- including guest customization, ease of porting to different OSes, and process migration.
Graphene supports native, unmodified Linux binaries on any platform. Currently, Graphene runs on Linux and Intel SGX enclaves on Linux platforms.
In untrusted cloud and edge deployments, there is a strong desire to shield the whole application from rest of the infrastructure. Graphene supports this “lift and shift” paradigm for bringing unmodified applications into Confidential Computing with Intel SGX. Graphene can protect applications from a malicious system stack with minimal porting effort.
Status of SGX Cloud support - 2023
https://tozny.com/blog/secure-computation-cloud-sgx/
The following provides links to several vendors providing open-source frameworks and SDKs for developing code to run in enclaves (trusted execution environments).
- Google Asylo
- Microsoft Open Enclave SDK
- Intel evaluation SDK1
- Fortanix Rust SDK
- SCONE2
- Graphene3
KVM Container Security Concepts
Confidential computing is a set of technologies, such as Intel's TDX or AMD's SEV, designed to protect data in use, notably with the use of encrypted memory. Confidential containers (CC) are the application of technology to run containers in a way that does not expose any data to the host. Alice Frosi, Sergio Lopez and Christophe de Dinechin presented this technology last year, in a talk titled "Don't peek into my container". This year, CC became a CNCF sandbox project. This technology is full of promises, but it also presents a number of hard technical challenges, for which we have solutions of unequal quality. In this talk, we will focus on five major technical or commercial difficulties: 1/ attestation of the workloads, 2/ performance (including memory, disk and networking bloat), 3/ image download (including possible optimizations), 4/ access control (and the need to rethink credentials) and 5/ debuggability. For some of these problems, we have solutions in the works or on the horizon. For some others, we just know that it will be bad, and we are exploring ideas on how to limit the damage. The majority of these problems involve the hypervisor or KVM to some extent.
Five Big Problems with Confidential Containers – KVM Forum 2022.pdf file
Linux KVM Forum 2022
https://events.linuxfoundation.org/kvm-forum/program/schedule/
...