Skip to content

Commit 5ae0992

Browse files
v-regandownerv-regandowner
authored
Merge pull request #235266 from pkhandavilli/patch-1
Attestation concepts for confidential ACI
2 parents 0c5f03c + 107a4ae commit 5ae0992

File tree

2 files changed

+106
-0
lines changed

2 files changed

+106
-0
lines changed

‎articles/container-instances/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@
7777
href: container-instances-virtual-network-concepts.md
7878
- name: Confidential container groups
7979
href: container-instances-confidential-overview.md
80+
- name: Attestation in Confidential container
81+
href: confidential-containers-attestation-concepts.md
8082
- name: How-to guides
8183
items:
8284
- name: Deploy

‎articles/container-instances/confidential-containers-attestation-concepts.md

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
title: Attestation in Confidential containers on Azure Containers Instances
3+
description: full attestation of container groups in confidential containers on Azure Container Instances
4+
ms.topic: conceptual
5+
ms.author: tomcassidy
6+
author: pkhandavilli
7+
ms.service: container-instances
8+
services: container-instances
9+
ms.date: 04/20/2023
10+
---
11+
12+
# What is attestation?
13+
14+
Attestation is an essential part of confidential computing and appears in the definition by the Confidential Computing Consortium “Confidential Computing is the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment."
15+
16+
According to the [Remote ATtestation procedureS (RATS) Architecture](https://www.ietf.org/rfc/rfc9334.html) In remote attestation, “one peer (the "Attester") produces believable information about itself ("Evidence") to enable a remote peer (the "Relying Party") to decide whether to consider that Attester a trustworthy peer. Remote attestation procedures are facilitated by an additional vital party (the "Verifier").” In simpler terms, attestation is a way of proving that a computer system is trustworthy.
17+
18+
In Confidential Containers on ACI you can use an attestation token to verify that the container group
19+
20+
- Is running on confidential computing hardware. In this case AMD SEV-SNP.
21+
- Is running on an Azure compliant utility VM.
22+
- Is enforcing the expected confidential computing enforcement policy (cce) that was generated using [tooling](https://github.com/Azure/azure-cli-extensions/blob/main/src/confcom/azext_confcom/README.md).
23+
24+
## Full attestation in confidential containers on Azure Container Instances
25+
26+
Expanding upon this concept of attestation. Full attestation captures all the components that are part of the Trusted Execution Environment that is remotely verifiable. To achieve full attestation, in Confidential Containers, we have introduced the notion of a cce policy, which defines a set of rules, which is enforced in the utility VM. The security policy is encoded in the attestation report as an SHA-256 digest stored in the HostData attribute, as provided to the PSP by the host operating system during the VM boot-up. This means that the security policy enforced by the utility VM is immutable throughout the lifetime of the utility VM.
27+
28+
The exhaustive list of attributes that are part of the SEV-SNP attestation can be found [here](https://www.amd.com/system/files/TechDocs/SEV-SNP%20PSP%20API%20Specification.pdf).
29+
30+
Some important fields to consider in an attestation token returned by [Microsoft Azure Attestation ( MAA )](../attestation/overview.md)
31+
32+
| Claim | Sample value | Description |
33+
|---------------------------|-------------------------------------------------------------|-------------|
34+
| x-ms-attestation-type | sevsnpvm | String value that describes the attestation type. For example, in this scenario sevsnp hardware |
35+
| x-ms-compliance-status | azure-compliant-uvm | Compliance status of the utility VM that runs the container group. |
36+
| x-ms-sevsnpvm-hostdata | 670fff86714a650a49b58fadc1e90fedae0eb32dd51e34931c1e7a1839c08f6f | Hash of the cce policy that was generated during deployment. |
37+
| x-ms-sevsnpvm-is-debuggable | false | Flag to indicate whether the underlying hardware is running in debug mode |
38+
39+
## Sample attestation token generated by MAA
40+
41+
```json
42+
{
43+
"header": {
44+
"alg": "RS256",
45+
"jku": "https://sharedeus2.eus2.test.attest.azure.net/certs",
46+
"kid": "3bdCYJabzfhISFtb3J8yuEESZwufV7hhh08N3ZflAuE=",
47+
"typ": "JWT"
48+
},
49+
"payload": {
50+
"exp": 1680259997,
51+
"iat": 1680231197,
52+
"iss": "https://sharedeus2.eus2.test.attest.azure.net",
53+
"jti": "d288fef5880b1501ea70be1b9366840fd56f74e666a23224d6de113133cbd8d5",
54+
"nbf": 1680231197,
55+
"nonce": "3413764049005270139",
56+
"x-ms-attestation-type": "sevsnpvm",
57+
"x-ms-compliance-status": "azure-compliant-uvm",
58+
"x-ms-policy-hash": "9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco",
59+
"x-ms-runtime": {
60+
"keys": [
61+
{
62+
"e": "AQAB",
63+
"key_ops": [
64+
"encrypt"
65+
],
66+
"kid": "Nvhfuq2cCIOAB8XR4Xi9Pr0NP_9CeMzWQGtW_HALz_w",
67+
"kty": "RSA",
68+
"n": "v965SRmyp8zbG5eNFuDCmmiSeaHpujG2bC_keLSuzvDMLO1WyrUJveaa5bzMoO0pA46pXkmbqHisozVzpiNDLCo6d3z4TrGMeFPf2APIMu-RSrzN56qvHVyIr5caWfHWk-FMRDwAefyNYRHkdYYkgmFK44hhUdtlCAKEv5UQpFZjvh4iI9jVBdGYMyBaKQLhjI5WIh-QG6Za5sSuOCFMnmuyuvN5DflpLFz595Ss-EoBIY-Nil6lCtvcGgR-IbjUYHAOs5ajamTzgeO8kx3VCE9HcyKmyUZsiyiF6IDRp2Bpy3NHTjIz7tmkpTHx7tHnRtlfE2FUv0B6i_QYl_ZA5Q"
69+
}
70+
]
71+
},
72+
"x-ms-sevsnpvm-authorkeydigest": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
73+
"x-ms-sevsnpvm-bootloader-svn": 3,
74+
"x-ms-sevsnpvm-familyId": "01000000000000000000000000000000",
75+
"x-ms-sevsnpvm-guestsvn": 2,
76+
"x-ms-sevsnpvm-hostdata": "670fff86714a650a49b58fadc1e90fedae0eb32dd51e34931c1e7a1839c08f6f",
77+
"x-ms-sevsnpvm-idkeydigest": "cf7e12541981e6cafd150b5236785f4364850e2c4963825f9ab1d8091040aea0964bb9a8835f966bdc174d9ad53b4582",
78+
"x-ms-sevsnpvm-imageId": "02000000000000000000000000000000",
79+
"x-ms-sevsnpvm-is-debuggable": false,
80+
"x-ms-sevsnpvm-launchmeasurement": "a1e1a4b64e8de5c664ceee069010441f74cf039065b5b847e82b9d1a7629aaf33d5591c6b18cee48a4dde481aa88d0fb",
81+
"x-ms-sevsnpvm-microcode-svn": 115,
82+
"x-ms-sevsnpvm-migration-allowed": false,
83+
"x-ms-sevsnpvm-reportdata": "7ab000a323b3c873f5b81bbe584e7c1a26bcf40dc27e00f8e0d144b1ed2d14f10000000000000000000000000000000000000000000000000000000000000000",
84+
"x-ms-sevsnpvm-reportid": "a489c8578fb2f54d895fc8d000a85b2ff4855c015e4fb7216495c4dba4598345",
85+
"x-ms-sevsnpvm-smt-allowed": true,
86+
"x-ms-sevsnpvm-snpfw-svn": 8,
87+
"x-ms-sevsnpvm-tee-svn": 0,
88+
"x-ms-sevsnpvm-uvm-endorsement": {
89+
"x-ms-sevsnpvm-guestsvn": "100",
90+
"x-ms-sevsnpvm-launchmeasurement": "a1e1a4b64e8de5c664ceee069010441f74cf039065b5b847e82b9d1a7629aaf33d5591c6b18cee48a4dde481aa88d0fb"
91+
},
92+
"x-ms-sevsnpvm-vmpl": 0,
93+
"x-ms-ver": "1.0"
94+
}
95+
}
96+
```
97+
## Generating an attestation token
98+
99+
We have open-sourced sidecar container implementations that provide an easy rest interface to get a raw SNP (Secure Nested Paging) report produced by the hardware or a MAA token. The sidecar is available at this [repository](https://github.com/microsoft/confidential-sidecar-containers) and can be deployed with your container group.
100+
101+
## Next steps
102+
103+
- [Learn how to use attestation to release a secret to your container group](../confidential-computing/skr-flow-confidential-containers-azure-container-instance.md)
104+
- [Deploy a confidential container group with Azure Resource Manager](./container-instances-tutorial-deploy-confidential-containers-cce-arm.md)

0 commit comments

Comments
 (0)