Skip to content

Commit 4d55e4f

Browse files
thisiskarthikjthisiskarthikj
authored
Added Granular claim changes (#100)
- Added the ability to pass `service_key` to the Attestation SDK, Local Verifier, and PPCIE Verifier. - Introduced granular claims, including individual OCSP status, expiration dates, and revocation reasons for driver and vBIOS certificates. - Refactored the SDK, Local Verifier, and PPCIE Verifier to support these granular claims. - Enhanced code structure across the SDK and verifier components to improve maintainability and scalability. - Various improvements and fixes across the source code to enhance stability and performance. - Created new unit and end-to-end test files to validate the functionality of claims version 3.0.
1 parent c04e5ac commit 4d55e4f

File tree

84 files changed

+2925
-1072
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+2925
-1072
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
*.log
99
venv
1010
*.bak
11+
.coverage

‎README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,6 @@ For more information, including documentation, white papers, and videos regardin
2424

2525
This repository is licensed under Apache License v2.0 except where otherwise noted.
2626

27-
Users who use NVIDIA Attestation Cloud Services or the NVIDIA Trust software components, without an Enterprise Product license may exercise the software and services solely for the purposes of development of a confidential computing service, not a commercial offering/ redistribution. A commercial Enterprise Product license must be obtained before offering the software within a paid commercial service.
28-
2927
## Support
3028

3129
For issues or questions, please [file a bug](https://github.com/NVIDIA/nvtrust/issues). For additional support, contact us at [attestation-support@nvidia.com](mailto:attestation-support@nvidia.com)

‎guest_tools/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,8 +119,6 @@ NVIDIA also offers Trust Outpost, a comprehensive GPU attestation solution for e
119119
## License
120120
This repository is licensed under Apache License v2.0 except where otherwise noted.
121121

122-
Users who use NVIDIA Attestation Cloud Services or the NVIDIA Trust software components, without an Enterprise Product license may exercise the software and services solely for the purposes of development of a confidential computing service, not a commercial offering/ redistribution. A commercial Enterprise Product license must be obtained before offering the software within a paid commercial service.
123-
124122
# Support
125123
For issues or questions, please [file a bug](https://github.com/NVIDIA/nvtrust/issues). For additional support, contact us at [attestation-support@nvidia.com](mailto:attestation-support@nvidia.com)
126124

‎guest_tools/attestation_sdk/README.md‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ Before installation, please review the [Compatibility Matrix](#compatibility-mat
3737

3838
### From Source
3939

40+
Install nv-local-gpu-verifier as a pre-requisite.
4041
If you choose to install the Attestation SDK from the source code, use the following commands:
4142

4243
cd attestation_sdk
@@ -75,7 +76,7 @@ Please execute the following commands to clean up packages that were not install
7576
4. Run the following command and ensure that you have the 'nv-local-gpu-verifier' Python module installed.
7677
```
7778
pip list | grep nv-local-gpu-verifier
78-
nv-local-gpu-verifier 1.5.0
79+
nv-local-gpu-verifier <version>
7980
```
8081
8182
### How to do Attestation
@@ -125,40 +126,45 @@ Please note that the Schema/EAT claim information is subject to change in future
125126
126127
## Compatibility Matrix
127128
128-
SDK version | NRAS API Version | Claims Version
129-
--------------- |-----------------|----------------
130-
v1.1.0 | v1 | N/A
131-
v1.2.0 | v1 | N/A
132-
v1.3.0 | v1 | N/A
133-
v1.4.0 | v1 | N/A
134-
v1.5.0 | v2 | N/A
135-
v2.0.0 | v3 | 2.0
136-
v2.1.0 | v3 | 2.0
137-
v2.1.1 | v3 | 2.0
138-
v2.1.2 | v3 | 2.0
139-
v2.1.3 | v3 | 2.0
140-
v2.1.4 | v3 | 2.0
141-
v2.3.0 | v3 | 2.0
129+
SDK version | Claims Version
130+
--------------- |----------------
131+
v1.1.0 | N/A
132+
v1.2.0 | N/A
133+
v1.3.0 | N/A
134+
v1.4.0 | N/A
135+
v1.5.0 | N/A
136+
v2.0.0 | 2.0
137+
v2.1.0 | 2.0
138+
v2.1.1 | 2.0
139+
v2.1.2 | 2.0
140+
v2.1.3 | 2.0
141+
v2.1.4 | 2.0
142+
v2.3.0 | 2.0
143+
v2.4.0 | 2.0, 3.0
142144
143145
More information on claims can be found [here](https://github.com/NVIDIA/nvtrust/blob/main/guest_tools/attestation_troubleshooting_guide.md)
144146
145147
## Attestation SDK APIs
146148
147149
**nv_attestation_sdk import attestation**
148-
| API | Description |
149-
|---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
150-
| Attestation(<-name->) | Create a new Attestation Object used to call other Attestation methods. |
151-
| set_name(<-name->) | Set a name for the Attestation SDK client |
152-
| set_nonce(<-nonce->) | Set a nonce for Attestation |
153-
| set_ocsp_nonce_disabled(<-bool->) | Flag which indicates whether to include a nonce when calling OCSP. Only applicable for local GPU attestation. False by default |
154-
| add_verifier(<-attestation-device-type->, <-local/remote->, <-remote-attestation-service-url->, <-attestation-results-policy->) | Add a specific type of verifier for the client object. The verifier will be invoked during the attest operation |
155-
| get_verifiers() | Retrieves the list of verifiers added to the client object. |
156-
| get_evidence() | Retrieves the list of evidence based on the attestation device (e.g., GPU, switch) and the type of attestation (e.g., local, remote). |
157-
| attest() | Trigger the Attestation for the client object, This uses the Attestation type configured in the add_verifier method |
158-
| get_token() | Retrieves the Attestation token that contains claims corresponding to the Attestation result. |
159-
| get_ocsp_nonce_disabled() | Retrieves the flag which indicates whether a nonce is included when calling OCSP. |
160-
| validate_token(<-attestation-results-policy->) | Validate the Attestation Claims against a policy |
161-
| decode_token(<-jwt-token->) | Decodes the JWT token to claims received by the verifier |
150+
151+
| API | Description |
152+
|---------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
153+
| Attestation(<-name->) | Create a new Attestation Object used to call other Attestation methods. |
154+
| set_name(<-name->) | Set a name for the Attestation SDK client |
155+
| set_nonce(<-nonce->) | Set a nonce for Attestation |
156+
| set_ocsp_nonce_disabled(<-bool->) | Flag which indicates whether to include a nonce when calling OCSP. Only applicable for local GPU attestation. False by default |
157+
| set_service_key(<-key->) | Service key which is used to auth remote service calls to attestation services. None by default. Note: No valid service keys have been created by admins yet - using any key will result in attestation failure. | |
158+
| set_claims_version(<-version->) | Set a claims version for Attestation. Please refer to the [Attestation Troubleshooting documentation](../attestation_troubleshooting_guide.md) for the claims. If claims version is not set, it defaults to 2.0. |
159+
| add_verifier(<-attestation-device-type->, <-local/remote->, <-remote-attestation-service-url->, <-attestation-results-policy->) | Add a specific type of verifier for the client object. The verifier will be invoked during the attest operation |
160+
| get_verifiers() | Retrieves the list of verifiers added to the client object. |
161+
| get_evidence() | Retrieves the list of evidence based on the attestation device (e.g., GPU, switch) and the type of attestation (e.g., local, remote). |
162+
| attest() | Trigger the Attestation for the client object, This uses the Attestation type configured in the add_verifier method |
163+
| get_token() | Retrieves the Attestation token that contains claims corresponding to the Attestation result. |
164+
| get_ocsp_nonce_disabled() | Retrieves the flag which indicates whether a nonce is included when calling OCSP. |
165+
| get_claims_version() | Retrieves the claims version added to the client object. |
166+
| validate_token(<-attestation-results-policy->) | Validate the Attestation Claims against a policy |
167+
| decode_token(<-jwt-token->) | Decodes the JWT token to claims received by the verifier |
162168
## Attestation SDK configuration
163169
The below configuration can be set using environment variables in the console
164170
Configuration | Values | Explanation |
@@ -171,7 +177,5 @@ Please note that starting from nvTrust v1.5.0, the NRAS v1 API and Relying Party
171177
## License
172178
This repository is licensed under Apache License v2.0 except where otherwise noted.
173179
174-
Users who use NVIDIA Attestation Cloud Services or the NVIDIA Trust software components, without an Enterprise Product license may exercise the software and services solely for the purposes of development of a confidential computing service, not a commercial offering/ redistribution. A commercial Enterprise Product license must be obtained before offering the software within a paid commercial service.
175-
176180
## Support
177181
For issues or questions, please [file a bug](https://github.com/NVIDIA/nvtrust/issues). For additional support, contact us at [attestation-support@nvidia.com](mailto:attestation-support@nvidia.com)

‎guest_tools/attestation_sdk/pyproject.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[tool.poetry]
22
name = "nv-attestation-sdk"
3-
version = "2.3.0"
3+
version = "2.4.0"
44
description = "The Attestation SDK provides developers with a easy to use APIs for implementing attestation capabilities into their applications."
55
authors = ["Karthik Jayaraman <kjayaraman@nvidia.com>"]
66
readme = "README.md"
@@ -22,7 +22,7 @@ xmlschema = "==2.2.3"
2222
pyOpenSSL = "==24.2.1"
2323
PyJWT = "==2.7.0"
2424
nvidia-ml-py = ">=12.535.77"
25-
nv-local-gpu-verifier = "2.3.0"
25+
nv-local-gpu-verifier = "2.4.0"
2626
build = ">=0.7.0"
2727
twine = ">=3.7.1"
2828
pylint = ">=2.9.6"

‎guest_tools/attestation_sdk/src/nv_attestation_sdk/attestation.py‎

Lines changed: 54 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from .gpu import attest_gpu_local, attest_gpu_remote
1919
from .nvswitch import attest_nvswitch_local, attest_nvswitch_remote
2020
from .utils import claim_utils, local_utils, nras_utils
21+
from .utils.config import REMOTE_GPU_VERIFIER_SERVICE_URL, REMOTE_NVSWITCH_VERIFIER_SERVICE_URL
2122
from typing import Tuple, List
2223

2324
decorative_logger = setup_logging()
@@ -91,22 +92,43 @@ class Attestation:
9192

9293
_staticNonce = None
9394
_name = None
95+
_serviceKey = None
9496
_nonceServer = None
9597
_tokens = None
9698
_verifiers = []
9799
_instance = None
98100
_ocsp_nonce_disabled = False
99101
_no_gpu_mode = False
102+
_claims_version = "2.0"
100103

101104
def __new__(cls, name=None):
102105
if cls._instance is None:
103106
cls._instance = super(Attestation, cls).__new__(cls)
104107
cls._name = name if isinstance(name, str) else ""
108+
cls._serviceKey = None
105109
cls._nonceServer = ""
106110
cls._staticNonce = ""
107111
cls._verifiers = []
108112
cls._tokens = {}
109113
return cls._instance
114+
115+
@classmethod
116+
def set_service_key(cls, service_key: str) -> None:
117+
"""Service key which is used to auth remote service calls to attestation services.
118+
119+
Args:
120+
service_key (str): Service key which is used to auth remote service calls to attestation services
121+
"""
122+
cls._serviceKey = service_key
123+
124+
@classmethod
125+
def get_service_key(cls) -> str:
126+
"""Service key which is used to auth remote service calls to attestation services.
127+
128+
Returns:
129+
Str: Service key which is used to auth remote service calls to attestation services
130+
"""
131+
return cls._serviceKey
110132

111133
@classmethod
112134
def set_name(cls, name: str) -> None:
@@ -164,6 +186,23 @@ def get_ocsp_nonce_disabled(cls) -> bool:
164186
"""
165187
return cls._ocsp_nonce_disabled
166188

189+
@classmethod
190+
def set_claims_version(cls, claims_version: str) -> None:
191+
"""To set the version of claims to be returned. v2.0 by default
192+
193+
Args:
194+
claims_version (str): claims version
195+
"""
196+
cls._claims_version = claims_version
197+
198+
@classmethod
199+
def get_claims_version(cls) -> str:
200+
"""Get the claims version
201+
202+
Returns:
203+
str: claims version
204+
"""
205+
return cls._claims_version
167206

168207
@classmethod
169208
def add_verifier(
@@ -186,7 +225,12 @@ def add_verifier(
186225
(Devices.SWITCH, Environment.REMOTE): "REMOTE_SWITCH_CLAIMS",
187226
(Devices.CPU, Environment.TEST): "TEST_CPU_CLAIMS",
188227
}
189-
228+
if env == Environment.REMOTE and not url:
229+
if dev == Devices.GPU:
230+
url = REMOTE_GPU_VERIFIER_SERVICE_URL
231+
elif dev == Devices.SWITCH:
232+
url = REMOTE_NVSWITCH_VERIFIER_SERVICE_URL
233+
logger.info("Using default Remote verifier URL: %s", url)
190234
name = verifier_name_mapping.get((dev, env), "UNKNOWN_CLAIMS")
191235
lst = [name, dev, env, url, evidence, "", ocsp_url, rim_url]
192236
cls._verifiers.append(lst)
@@ -273,17 +317,19 @@ def attest(cls, evidence_list) -> bool:
273317
attestation_func = attestation_mapping.get(
274318
(device, environment), cls._unknown_verifier
275319
)
320+
attestation_options = {
321+
"ocsp_nonce_disabled": cls._ocsp_nonce_disabled,
322+
"rim_service_url": verifier[VerifierFields.RIM_URL],
323+
"ocsp_url": verifier[VerifierFields.OCSP_URL],
324+
"claims_version": cls._claims_version,
325+
"verifier_url": verifier_url,
326+
"service_key": cls._serviceKey
327+
}
276328
if environment == Environment.REMOTE:
277329
this_result, jwt_token = attestation_func(
278-
nonce, evidence_list, verifier_url
330+
nonce, evidence_list, attestation_options
279331
)
280332
else:
281-
attestation_options = {
282-
"ocsp_nonce_disabled": cls._ocsp_nonce_disabled,
283-
"rim_service_url": verifier[VerifierFields.RIM_URL],
284-
"ocsp_url": verifier[VerifierFields.OCSP_URL]
285-
}
286-
287333
this_result, jwt_token = attestation_func(
288334
nonce, evidence_list, attestation_options
289335
)

0 commit comments

Comments
 (0)