Skip to content
This repository was archived by the owner on Jan 27, 2022. It is now read-only.

Commit 4da1c5b

Browse files
karthikamurthykarthikamurthy
committed
Implemented Key Sharing and Seperation Config id Feature for Singleton.
Signed-off-by: Karthika Murthy <[email protected]>
1 parent 235402f commit 4da1c5b

File tree

18 files changed

+194
-34
lines changed

18 files changed

+194
-34
lines changed

‎enclave_manager/avalon_enclave_manager/singleton/singleton_enclave_info.py‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ def __init__(self, config, worker_id, enclave_type):
4242
self._worker_id = worker_id
4343
super().__init__(config, enclave_type)
4444

45-
self._initialize_enclave()
45+
self._initialize_enclave(config)
4646
enclave_info = self._create_enclave_signup_data()
4747
try:
4848
self.sealed_data = enclave_info['sealed_data']
@@ -96,8 +96,11 @@ def _create_signup_info(self):
9696
"""
9797

9898
signup_cpp_obj = enclave.SignupInfoSingleton()
99+
if self._config.get("kss_config") is not None:
100+
signup_data = signup_cpp_obj.CreateEnclaveData(self._config.get("kss_config"))
101+
else:
102+
signup_data = signup_cpp_obj.CreateEnclaveData()
99103

100-
signup_data = signup_cpp_obj.CreateEnclaveData()
101104
if signup_data is None:
102105
return None
103106

@@ -164,10 +167,16 @@ def _init_enclave_with(self, signed_enclave):
164167
"""
165168
# Get sealed data if persisted from previous startup
166169
persisted_sealed_data = file_utils.read_file(
167-
self._get_sealed_data_file_name(self._config["sealed_data_path"],
168-
self._worker_id))
169-
return self._attestation.init_enclave_info(
170-
signed_enclave, persisted_sealed_data,
171-
int(self._config['num_of_enclaves']))
170+
self._get_sealed_data_file_name(config["sealed_data_path"],
171+
self._worker_id))
172+
173+
if config.get("kss_config") is not None:
174+
return enclave.tcf_enclave_info(
175+
signed_enclave, config['spid'], persisted_sealed_data,
176+
int(config['num_of_enclaves']), config.get("kss_config"))
177+
else :
178+
return enclave.tcf_enclave_info(
179+
signed_enclave, config['spid'], persisted_sealed_data,
180+
int(config['num_of_enclaves']))
172181

173182
# -----------------------------------------------------------------

‎enclave_manager/avalon_enclave_manager/singleton/singleton_enclave_manager.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ def main(args=None):
119119
parser.add_argument("--config-dir", help="configuration folder", nargs="+")
120120
parser.add_argument("--worker_id",
121121
help="Id of worker in plain text", type=str)
122+
parser.add_argument("--kss_config", help="Key sharing and separation configuration id", type=str)
122123

123124
(options, remainder) = parser.parse_known_args(args)
124125

@@ -138,6 +139,9 @@ def main(args=None):
138139
if options.worker_id:
139140
config["WorkerConfig"]["worker_id"] = options.worker_id
140141

142+
if options.kss_config:
143+
config["EnclaveModule"]["kss_config"] = options.kss_config
144+
141145
plogger.setup_loggers(config.get("Logging", {}))
142146
sys.stdout = plogger.stream_to_logger(
143147
logging.getLogger("STDOUT"), logging.DEBUG)

‎tc/sgx/trusted_worker_manager/enclave/kme/signup_enclave_kme.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include <sgx_tseal.h>
2323
#include <sgx_utils.h>
2424
#include <sgx_quote.h>
25+
#include <sgx_key.h>
2526

2627
#include "crypto.h"
2728
#include "error.h"

‎tc/sgx/trusted_worker_manager/enclave/wpe/signup_enclave_wpe.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222

2323
#include <sgx_utils.h>
2424
#include <sgx_quote.h>
25+
#include <sgx_key.h>
2526

2627
#include "crypto.h"
2728
#include "error.h"

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/base.cpp‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -48,19 +48,6 @@ int tcf::enclave_api::base::IsSgxSimulator() {
4848
#endif // defined(SGX_SIMULATOR)
4949
} // tcf::enclave_api::base::IsSgxSimulator
5050

51-
52-
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
53-
tcf::enclave_queue::ReadyEnclave tcf::enclave_api::base::GetReadyEnclave() {
54-
return tcf::enclave_queue::ReadyEnclave(g_EnclaveReadyQueue);
55-
} // tcf::enclave_api::base::GetReadyEnclaveIndex
56-
57-
58-
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
59-
void tcf::enclave_api::base::SetLastError(
60-
const std::string& message) {
61-
g_LastError = message;
62-
} // tcf::enclave_api::base::SetLastError
63-
6451
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
6552
std::string tcf::enclave_api::base::GetLastError(void) {
6653
return g_LastError;
@@ -71,7 +58,8 @@ tcf_err_t tcf::enclave_api::base::Initialize(
7158
const std::string& inPathToEnclave,
7259
const Attestation *attestation,
7360
const std::string& persisted_sealed_data,
74-
const int numOfEnclaves) {
61+
const int numOfEnclaves,
62+
const uint8_t (&kss_config_id)[SGX_CONFIGID_SIZE]) {
7563
tcf_err_t ret = TCF_SUCCESS;
7664

7765
try {
@@ -86,7 +74,7 @@ tcf_err_t tcf::enclave_api::base::Initialize(
8674
}
8775

8876
for (tcf::enclave_api::Enclave& enc : g_Enclave) {
89-
enc.Load(inPathToEnclave, persisted_sealed_data);
77+
enc.Load(inPathToEnclave, persisted_sealed_data, kss_config_id);
9078
}
9179

9280
g_IsInitialized = true;

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/base.h‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
#include <stdlib.h>
1919
#include <string>
20-
20+
#include "sgx_key.h"
2121
#include "error.h"
2222
#include "tcf_error.h"
2323
#include "types.h"
@@ -60,10 +60,12 @@ namespace tcf {
6060
persisted_sealed_data - Sealed data persisted from last bootup
6161
numOfEnclaves -- Number of worker enclaves to create
6262
*/
63+
6364
tcf_err_t Initialize(const std::string& inPathToEnclave,
6465
const Attestation *attestation,
6566
const std::string& persisted_sealed_data,
66-
const int numOfEnclaves);
67+
const int numOfEnclaves,
68+
const uint8_t (&kss_config_id)[SGX_CONFIGID_SIZE]);
6769

6870
/*
6971
Stop Avalon services

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/enclave.cpp‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,15 +70,21 @@ namespace tcf {
7070
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
7171
void Enclave::Load(
7272
const std::string& inEnclaveFilePath,
73-
const Base64EncodedString& inSealedEnclaveData) {
73+
const Base64EncodedString& inSealedEnclaveData,
74+
const uint8_t (&kss_config_id)[SGX_CONFIGID_SIZE]) {
7475
tcf::error::ThrowIf<tcf::error::ValueError>(
7576
inEnclaveFilePath.empty() ||
7677
inEnclaveFilePath.length() > PATH_MAX,
7778
"Invalid enclave path.");
7879

7980
this->Unload();
8081
this->enclaveFilePath = inEnclaveFilePath;
82+
for(int i=0; i <SGX_CONFIGID_SIZE;i++ ){
83+
this->_kss_config[i] = kss_config_id[i];
84+
}
85+
8186
this->LoadEnclave(inSealedEnclaveData);
87+
8288
} // Enclave::Load
8389

8490
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
@@ -114,6 +120,11 @@ namespace tcf {
114120
"Attestation object is not initialized"
115121
);
116122
this->attestation->CreateQuoteFromReport(inEnclaveReport, outEnclaveQuote);
123+
124+
sgx_quote_t* enclaveQuote =
125+
reinterpret_cast<sgx_quote_t *>(&outEnclaveQuote[0]);
126+
tcf::Log(TCF_LOG_INFO,"KSS Config Id added to the EnclaveQuote : %s\n", enclaveQuote->report_body.config_id );
127+
117128
} // Enclave::GenerateSignupData
118129

119130

@@ -137,7 +148,6 @@ namespace tcf {
137148
if (!this->enclaveId) {
138149
/* Enclave id, used in communicating with enclave */
139150
Enclave::QuerySgxStatus();
140-
141151
sgx_launch_token_t token = { 0 };
142152
int flags = SGX_DEBUG_FLAG;
143153
tcf::error::ThrowSgxError((SGX_DEBUG_FLAG == 0 ?
@@ -147,7 +157,9 @@ namespace tcf {
147157

148158
// First attempt to load the enclave executable
149159
sgx_status_t ret = SGX_SUCCESS;
150-
ret = tcf::sgx_util::CallSgx([this, flags, &token] () {
160+
if(this->_kss_config[0] == NULL){
161+
162+
ret = tcf::sgx_util::CallSgx([this, flags, &token] () {
151163
int updated = 0;
152164
return sgx_create_enclave(
153165
this->enclaveFilePath.c_str(),
@@ -160,7 +172,30 @@ namespace tcf {
160172
10, // retries
161173
250 // retryWaitMs
162174
);
163-
tcf::error::ThrowSgxError(ret, "Unable to create enclave.");
175+
tcf::error::ThrowSgxError(ret, "Unable to create enclave.");
176+
177+
} else {
178+
tcf::Log(TCF_LOG_INFO, "Enclave::sgx_create_enclave_ex called" );
179+
void *enclave_ex_p[32] = { 0 };
180+
enclave_ex_p[SGX_CREATE_ENCLAVE_EX_KSS_BIT_IDX] = &this->_kss_config;
181+
182+
ret = tcf::sgx_util::CallSgx([this, flags, &token, enclave_ex_p] () {
183+
int updated = 0;
184+
return sgx_create_enclave_ex(
185+
this->enclaveFilePath.c_str(),
186+
flags,
187+
&token,
188+
&updated,
189+
&this->enclaveId,
190+
NULL,
191+
SGX_CREATE_ENCLAVE_EX_KSS,
192+
(const void** )enclave_ex_p);
193+
},
194+
10, // retries
195+
250 // retryWaitMs
196+
);
197+
tcf::error::ThrowSgxError(ret, "Unable to create enclave with Config id");
198+
}
164199
// Initialize the enclave
165200
tcf_err_t tcfError = TCF_SUCCESS;
166201

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/enclave.h‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#include <string>
2020
#include <vector>
2121

22+
#include "sgx_key.h"
2223
#include "error.h"
2324
#include "tcf_error.h"
2425
#include "types.h"
@@ -36,7 +37,8 @@ namespace tcf {
3637

3738
void Load(
3839
const std::string& inEnclaveFilePath,
39-
const Base64EncodedString& inSealedEnclaveData);
40+
const Base64EncodedString& inSealedEnclaveData,
41+
const uint8_t (&kss_config_id)[SGX_CONFIGID_SIZE]);
4042

4143
void Unload();
4244

@@ -73,6 +75,7 @@ namespace tcf {
7375
void LoadEnclave(
7476
const Base64EncodedString& persistedSealedEnclaveData = "");
7577

78+
7679
#ifdef BUILD_SINGLETON
7780
tcf_err_t VerifyEnclaveInfoSingleton(
7881
const std::string& enclave_info,
@@ -102,7 +105,11 @@ namespace tcf {
102105
size_t sealedSignupDataSize;
103106

104107
std::string enclaveError;
105-
Attestation *attestation;
108+
109+
110+
private:
111+
uint8_t _kss_config[SGX_CONFIGID_SIZE] = {NULL};
112+
Attestation *attestation;
106113

107114
}; // class Enclave
108115

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/kme/signup_kme.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
#pragma once
1818

1919
#include <stdlib.h>
20+
#include <sgx_key.h>
2021

2122
#include "types.h"
2223
#include "signup.h"

‎tc/sgx/trusted_worker_manager/enclave_untrusted/enclave_bridge/singleton/signup_singleton.cpp‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,10 @@
2727
#include "signup_singleton.h"
2828
#include "sgx_utility.h"
2929

30+
3031
// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
3132
tcf_err_t SignupDataSingleton::CreateEnclaveData(
33+
const uint8_t (&kss_config_id)[SGX_CONFIGID_SIZE],
3234
StringArray& outPublicEnclaveData,
3335
Base64EncodedString& outSealedEnclaveData,
3436
Base64EncodedString& outEnclaveQuote) {
@@ -50,6 +52,9 @@ tcf_err_t SignupDataSingleton::CreateEnclaveData(
5052
// We need target info in order to create signup data report
5153
sgx_target_info_t target_info = { 0 };
5254
sgx_epid_group_id_t epidGroupId = { 0 };
55+
sgx_config_id_t config_id = { 0 };
56+
57+
5358
sresult = tcf::sgx_util::CallSgx(
5459
[&target_info,
5560
&epidGroupId] () {
@@ -62,6 +67,8 @@ tcf_err_t SignupDataSingleton::CreateEnclaveData(
6267
// Properly size the sealed signup data buffer for the caller
6368
// and call into the enclave to create the signup data
6469
sgx_report_t enclave_report = { 0 };
70+
for(int i=0; i <SGX_CONFIGID_SIZE;i++ ){
71+
config_id[i] = kss_config_id[i];}
6572

6673
sresult = tcf::sgx_util::CallSgx(
6774
[enclaveid,
@@ -88,11 +95,17 @@ tcf_err_t SignupDataSingleton::CreateEnclaveData(
8895
outSealedEnclaveData = \
8996
ByteArrayToBase64EncodedString(sealed_enclave_data_buffer);
9097

98+
memcpy(
99+
enclave_report.body.config_id,
100+
config_id,
101+
sizeof(sgx_config_id_t));
102+
91103
// Take the report generated and create a quote for it, encode it
92104
size_t quote_size = tcf::enclave_api::base::GetEnclaveQuoteSize();
93105
ByteArray enclave_quote_buffer(quote_size);
94106
g_Enclave[0].CreateQuoteFromReport(&enclave_report, enclave_quote_buffer);
95107
outEnclaveQuote = ByteArrayToBase64EncodedString(enclave_quote_buffer);
108+
96109
} catch (tcf::error::Error& e) {
97110
tcf::enclave_api::base::SetLastError(e.what());
98111
result = e.error_code();

0 commit comments

Comments
 (0)