Cloud Native Computing Foundation Cloud Native Wasm Day EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Build trusted cloud apps with Wasm: WebAssembly Micro Runtime is ready - Xin Wang

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: Build trusted cloud apps with Wasm: WebAssembly Micro Runtime is ready - Xin Wang, Intel

It is critical to guarantee the confidentiality and integrity of user code and data on the cloud and the solutions often rely on the CPU Trusted Execution Environment (TEE) feature such as Intel Software Guard Extension (SGX). Wasm introduced a new approach for abstracting workloads from the underlying TEE HW differences. WebAssembly Micro Runtime (WAMR), a Bytecode Alliance open source project has provided comprehensive support for Intel SGX, such as compiled Wasm modules, WASI, TensorFlow, and it has made an excellent adoption trend on SGX by open-source projects and commercial products. This talk will introduce the WAMR architecture and key features, as well as its usages on cloud TEE such as Smart Contract, Multi-parties computing. It will also share how the projects like Inclavare, Faasm use WAMR to orchestrate Wasm workloads for smoothly extending to cloud TEE.

A

Hi, my name is xinhuan and I work at intel today. I'm going to talk about how to build trusted cloud applications with the web assembly on intel, sjx.

A

This presentation contains a few use cases provided by michael bowman from intel and the jia zhang from alibaba.

A

Building a trusted cloud application is not an easy job. If you are the application owner, you're, probably concerned how to protect your cloud code and the data from being accessed by either the csp hackers or other malicious cloud applications for the csp, they need to ensure their infrastructure can resist the attacks from any malicious cloud applications.

A

They also need to prove to their customers. Their concerns can be solved technically and also in some cloud applications.

A

It will consume the data from third party. We also need to address the data owner's concerns for data leaking or misusing.

A

It is hard to address all the challenges by pure software solution. Typically, we need to leverage some hardware capability, such as trusted execution environment, or we call it tee.

A

The te provides hardware-based isolation for the code execution and the data te usually provides remote authentication capability. That is also very needed for building trusted cloud applications.

A

Intel sgx is the most most researched, updated and battle test. Hardware-Based te for the data center, it's available across the entire line of iceland, scalable processors.

A

It delivers the smallest potential attack surface of any te available for the data center on the iceland xeon processor. The sdgx supports up up to one terabyte protected enclaves of the data in the code.

A

Webassembly provides a lightweight sandbox that supports scalable, concurrent execution of different washer modules.

A

By using wasn't sgx, we can leverage subjects to protect the applications from external attacks and also leverage the western sandbox to protect the host environment from internal attacks by malicious.

A

Applications, whether somebody met for a long time or walmart, is an open source project on the back corner lines with supporting suggests, as the first class citizen warmer provides a full feature set for sgx support.

A

Firstly, the warmer is designed for small pcb, as it is a it's, a total binary size can be, and 100 kilobytes and one may support interpreter and a hydro time compilation for the what was an execution on sgx enclave.

A

The liberty is also supported for the watson application based on intel, sgx sdk.

A

There simply is also supported by warmer on the sgx. We have built some ia framework, such as tensorflow to wasan and successfully executed from suggest enclave.

A

So far, walmart has a good adoption progress by either open source or commercial usage with sdx. Now I will give introduction for a few solutions that is warmer on sgx.

A

Private data objects is an open source project and hyperledger labs that enables sharing our data and correlating action among mutual distributing parties.

A

Pdo provides a secure framework for loading, wasn't based some other contracts into suggest enclave and excluded with web assembly. Microruntime.

A

Enclave container is another open source project that uses russon on sjx.

A

The enclaver project is an infrastructure that built confidential containers for pe and extend kubernetes across different teas, as a diagram illustrated, the enclaver container can build the washer modules and the development runtime into a confidential container, with some new plugin and the components that they introduced into this project.

A

The confidential containers can be orchestrated by the kubernetes across the pe. This is a great project that solves the challenge. Without application modifications.

A

The last use case here is the usage of using wazon ice jacks for multi-party computation. In this use case, each party develops a wasm application that can be either data, consumer or data supplier, or in both rows.

A

All the parties review the source code of webassembly applications and assign the binary modules a base infrastructure will load the russian modules into sgx enclave and the support establishing secure and the trustworthy channel between the russo modules.

A

In such way, the multi-parties can share the data for competition.

A

Safely have finished the presentation and thank you for listening. If you are interested, please go to the github and the download warmer and try it out with sjx thanks.