Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 3 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security++: Hide Your Secrets via a Distributed Hardware Security Mod... Iris Ding & Malini Bhandaru

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Security++: Hide Your Secrets via a Distributed Hardware Security Module - Iris Ding & Malini Bhandaru, Intel

Cloud hardware security module (HSM) provides cloud-based services to host encryption keys and perform cryptographic operations inside HSM. It can improve the security level of your services. However, it also brings performance challenges for users since cryptographic operations are handled remotely in HSM. Distributed HSM is a solution that satisfies both security and performance requirements. It provides both remote and local HSMs for users and can be hosted on Cloud, on-premise and on edge. Cryptographic operations can even be performed in the same node with the service. In this talk we walk you through how distributed HSM works and showcase some typical user cases.

A

Okay, let's get started. um Thank you for attending this session. This is the last session for this meeting, so my name is Iris Dean I'm coming from Intel, so my co-speaker Malini cannot be here today due to the travel issues, so I will cover the whole topic today and thanks to my college here, we also did a lot of contribution to this topic.

A

So today, I will share something about Cloud, HSM and what's the challenge, you might be fitting if you're using Cloud HSM and how we can overcome these challenges using digital HSM and finally, I will show you some user cases that you can leverage it in your environment, so um HSM or Hardware executive module. This is not a very new technology. Actually, it has exists for a long time.

A

So, basically, you need a specific plugable Hardware that you can store your credential information like private keys in this device, and also you can perform your crypto operations in this device. So you can see. It also means you need some additional cost because you need a specific Hardware to, and you also need to maintain it. So.

A

um Beside this um you know the security is coming more and more important. Today, you can see from today's current is cloud native security card so also in the cloud environment. This also bring a lot of security requirements, so this is some report for the HSN market, so it says due to 2028, the HSN Market will be reached to 2 billion dollars, so it's a huge market.

A

So, as we said, a lot of workload has been onboarded to the cloud environment so for the currently most of the major cloud service providers has already had their Cloud HSM offering. So it means the cloud provider will host the HSM Hardware in their Cloud infrastructure, so for the customers for all for the end users. This brings a lot tell benefits. For example, if you want to consume the HSM service, you can just consume it as it provides you a lot of flexibility.

A

So, basically, if you want to consume the cloud HSM, you need to follow some basic steps. So most the cloud HSM will follow in the PKS 11 standards. So, firstly, you might want to onboard your security keys in the cloud HSM. So the cloud HSM after you onboarding your private Keys. It will give you a private key Handler, a key reference here. Then you can use in this key handle in your application. Then, when your application is running, he can use the key Handler and send the crypto operation request to the cloud HSM.

A

So Cloud HSM actually will perform the Crypt operation in his environment and give the computer operation without tools application. So you can see. Actually, in this scenario, the crypto operation is happened remotely against your application, so obviously it will bring your high latency for the crypto operations. At the same time, it also means you will have lower transaction range.

A

At the same time, sometimes you want to migrate between different Cloud providers. So, although the most of them are following the same pcss 11 standards, but the apis might have a very might have a slight difference, so it will bring you moderation. Difficulty. The last part is on the edge side. Actually there is no suitable replacement for the cloud HSI so how to overcome all these challenges.

A

This is what the distribution HSM we have brought up. So you can see from this picture that the big difference here is this trip to HSM is actually sitting sitting alongside your application. So in this picture you can see actually each application has their own distributed. Hsm here also the crypto operations will happen locally in the distributed HSM.

A

So so it brings a lot of benefit for you. It's firstly, is high secured and even on the edge you can, you know, have your own distributed HSM and do the Crypt operations in inside it, so it is lower latency and will bring your grid throughput. Also because this distributed SM doesn't rely on additional Hardware comparing to the traditional traditional HSM, so it also means lower cost.

A

Besides this, you can see. Actually there are four steps here. There are additional step one. So this means, before you give your credential information into the distributed, HSM HSM. Actually you can ask every evidence beforehand to let the distributed SM to prove to you that I'm actually attracted about attracted party. So all these give you a lot of benefits here, so you might be curious how we can achieve this, so um the answer is using trusted execution environment.

A

So, let's see what's the trusted execution environment, so um basically, this is coming from the confidential Computing area, so um trusted execution environment, provides you an isolated or protected environment to run your authorized code. So from Securities perspective, the data can be divided into three categories: data analyzed data in emotion and data in use so for data at the rest, the most popular technology is, you know before you see your data, you can encrypt it and then see it in the disk awesome. You know, storage data in motion means typically you want.

A

You can use interos or even Mutual tis to encrypt your traffic when the traffic is in transition. The last part is data universe. So this is the major Focus for Te. So it means when the data is currently executing, it is protected as well. So um basically T will require some Hardware or firmware support it. Can you can see from the right part? It actually isolates applications and some privileged software, like the operating system or even the high provider, cannot access this. This this memory region and only the CPU, is trusted.

A

So, um as I said, it also can do the demonstration to you like the code or adaptation. So you can see this is actually a Transit party, for example. This is really adjusted. Executive, environment and I can for sure, deliver my secret to you and let you run my crypto operations within within your your te environment.

A

Okay, sorry, my computer account here.

A

A

So um sorry for the interruption, so Intel HDX or software guide extension is a kind of this te. So it's a process based te, so basically, Intel CPU has some specific instructions that you can leverage it to create a protected environment, and let you to the protect the environment in in the top. It is called sgx Enclave. So you can see from the right side picture. It looks like a protected keys that other parties, even like the operating system or the firmware they cannot go into there and execute other access to this memory region.

A

So, basically, if you want to leverage sdx, you can write your application and divide it into two parts, attracted part and untreated pad. Only the traffic department can go into The fgx Enclave, so this memory region is encrypted and it has strict access control. So the remote authentication means it will prove to you. It's a really trusted body and the thinning means. Even if the computer has been restarted, you can still get your secret back, so sdx has been in the market actually for a long time as well.

A

So basically, the current most current Intel server, like ice leak, has already supported this function. So if you are interested, you can using this link to find the detailed production information data support fgx, so maybe actually in your head in your. If you have an Intel server, it's actually already supported in this. So you just need to you know enable it in buyers, and you can leverage this capability in your environment as well.

A

So, um let's see some user case how we land this in our real world. So in today's session I will using htl service mesh as an example. So you know um is still. The security is a important part for the that it provides. So it has two cases, the mutual Tis. So this is majorly using the communication within the mesh.

A

The other is the Gateway, so it will handle the traffic coming through the through the outside world, like the user requires coming through the Gateway and then go into the mesh inside so in in these two cases see how private key here and the app and currently the Easter stream, the private key- will be in clear text. So it will bring security Explorer um for you, a lot of security risk, so you can imagine if the product key has been compromised. It will bring a lot of trouble here.

A

So this is the new architecture that we Leverage The distributed HSM. That can enhance all these our risks. So you can see here uh well for the n-word side car we will inject uh SDS server here there is SDS over here. This is the new component divided by ourselves, and you can see there is a lock in the envelope and SDS server. This log means there is a HSM alongside with them, which is implemented, implemented using sgx Enclave so and take a closer look at the normal side. So you can see here.

A

um There is uh so for the animal side d by default, using borderline SL for their and their SSL Library. So borrowing SSL has uh probably the key provider mechanism, so we just leverage it and provide us FTX private, key provider, and we will have. We will utilize the crypto API toolkit to generate or establish a sdx environment for us. So this is the detail in the annual side.

A

uh This is the SDI server side, so this is actually running a sdx Enclave. The distributor is exam is running alongside it.

A

So basically um you we have local HSM, while sdx enclave and the crypto operations are happening locally and the credentials can be synced from remote, HSM or locally generated. So for Mutual tis case, the private key is generated locally for the gateways. It can be uploaded from remote, Keystone case dot. Like your word or you have your own key key server, you can sync the keys secretly in The Enclave, so for the military, tis and Gateway. We also can well. They also have the data plan part and the control plan part.

A

So I will split them and let's take a look at them one by one. So the first user case is the mutual TS control plan part. This is the picture for the current istio floor. So basically istio will let you delegate your C functions to the external side so to the external CE. So the whole flow is like.

A

First, the there is ICL server running inside the install agent.

A

Together with each agent, this is a whole. Is your proxy part. So when the the Eastern proxy part is started, it will generate the private key pair. So you can see this marked in red. The private key is in clear text in memory on the this is the first step. Then it will generate the CSR I mean the Eco agent will generate the CSR, the certificate signing request and it will send to HCL D and HCL D will send out the CSR to the kubernetes API server and the CSR will finally go into a sea.

A

So in our case we have a CE component is called trusted certificate service, so this service will get the CSR and assign the search back. So you can see now in Step, 7, step 8 and finally, the private key and the third will be delivered to N1. So now it will have the private key and the third, but now it's in clear text. So this is the original flow.

A

Let's see after our enhancement on what's the current flow now so here we can see the I think we have the SDS server here, but it's not running inside the install agent. It is the new component that we just we newly added. So this as a server is running here, so it has an envelope here so when the awl sitting alongside the envoy, so this will run you in the simple. So when this is started, it will first initialize the sdx enclave and will generate the pride Key pair in this Enclave.

A

So you can see now the key has been guided using this charted execution environment and then it will generate CSR and the code. The code is some some evidence to prove that I'm really adjusting the environment, then, comparing with the original CSR the difference here is the code has been embedded into the CSR as an extension.

A

So now the CSI has to be generated and following the original flow coming to The Trusted certificate service, the charges of physical service will recognize this extension and extract the code and it will generate a code technician customer results. So we have the code authentication controller here, so it will. It will get the code and call our Intel alternative service to do the temptation to make sure this is really a trusted. Hardware, it's a very healthy and secure environment. Then, after this adaptation has been done, the TCS I mean The Trusted scientific service.

A

It will assign the setback. So if the testation failed you will you cannot get the setback. So so you can see all these all this change is is very secured and finally, the the the third will come back um and then you can see here the the priority.

A

Actually in this step, it has been sealed using the ctk token file, because this these two enclaves are sitting in the simple, so it can get the sealed key to into his enclave and because the in this channel in this green channel uh the certificate and priority key config, we will generate the related information. So now the envelope will get the sgx private key provider, information and the sender setback. So this is the whole flow, after our enhancement.

A

So you can see now it also leverages the external certificate Authority, and the private case in the whole in the whole past is not it's never exposed in clear text and the third is only issued if the authentication passed and the crypto operations can be done locally.

A

So this is another user case, the Gateway case, so you can see um from the East Upstream. The Gateway case to upload I mean to make the key available to the envelope is a long journey, so you can see due to time limitation. I do not want do not. I cannot go through the details, but if you are interested you can, you know, take a look at this picture, but basically you can see in all these steps. This product key is in clear text, for example in these steps.

A

In the first step, the admin uploaded the private key and the third in the secret. So anyone can, if has the authority, he can get the secret and he can get the pride Key. So it's really dangerous and it's the long journey. You know in the history in the Easter agent and finally involved all this in clear text.

A

So this is the the floor after our enhancement. So um you can see here. This first step is get a great Gateway customer results uh and then the after the the SDS server is also running here. So you can see that yes, server is actually the same SDI server, because the we we using the same as their server, so so the both the Gateway and the mtis case, so that your server will has to be moved out from ucld and it's coming here and from this land Journey. It will come into the Enclave.

A

So maybe I can explain further, because um this uh this little complex so first um the the mean, creates the Gateway custom resource and then the SDS server will watch this customer house and after that it will initialize the sdx and clue it will create the key pair. But this key pair is not you know the final key pair for Android, just using two ranking user's private key here. So the TMI here actually is a key storage server.

A

So, basically, you can replace it using your with your own key storage server, so um you can see in the this is the first step, the second step, and then we will generate a code like previous keys and the public key here, and then the attention controller will help us do the attestation. Meanwhile, because in the Gateway custom results you will give the key Handler information in the kmia here or your key storage. So you can so the attendance controller will help you wrap the private key using the public key generated here.

A

So it means only this guy. This XCX Enclave guide because the private key is sitting here, so only him can unwrap the key. So this makes sure that the whole chain is secured. So now after the left key coming here and it will be arrived and then finally it will come into this animal guide. So this is a whole flow. Let me know if you have any questions.

A

um So yeah previously they are in clear text and the private keys are uploaded externally.

A

um So after it's also, uh the priority case is also coming off site, but the whole upload is secured and the private key is never exposed offside in clear text and the keys only get updated if the attestation passed and finally the crypto option, it happened locally.

A

So, let's take a look at the data plan part the development part means when the traffic coming, how it happens. So this is the original how animal works. So when there is a new https request, comes the TRS hash. It will happen here. So the borrowing access Library. We are using the private key memory to do the send or decrypt operation and then return the result back now, because M1 has The sdx Enclave here and we have the sdx private key provider here.

A

So now, after after we get the TRS hashing request, this request will be dedicated to sdx gravity provider and the provider will send the required to the local sdx enclave and other science and decrypt operation will happen in this trusted environment and then, finally, it will get the results back. So um this is very secure and because the operation has happened locally, so thought the performance penalty is very little.

A

The other case is the certificate Authority case, so um so in in the sake. In the same case, the C also needs a private key here, so our solution is called trusted certificate service, so it can handle incoming a certificate signing request. So in this just the scientific service, it also has a sdx Enclave, so it is about two cases: self send search of other external uploaded CD case. So for the first case the say the private key will generated locally and we are serving and using this product key to handle the incoming csrs.

A

In the later case, the price key will be uploaded the other side from outside world. So a little similar to the Gateway case. We will also do the authentication and directly and unwrap the key. So uh this is the detail of the flow for for the for this, so the the upper part is how we upload the case, and the latter part is how you know if you leverage data in HCL D, how a easier how you can leverage it.

A

So this is the thumb sample yaml file that you can leverage this this solution. um So um actually um this solution, you know the HSM server. We have already open source in the install ecosystem under that GitHub repo and all the armor changes, also in public reports. So you can just grab that this that Ripple and using dcmo file to have a try if you have interest so uh some future steps we want to take you know.

A

um Actually there are a lot of cloud HSM here we want to do some adapter here that can you know if the if your keys are stored in this area and your application? You know it is remote to this one. Then we can have adapter here to help you sync the private keys of any credential information in your local distribution. Hsm. Then you can do the operation locally, so we we hope we can provide a unified API for the users.

A

So whether your application is Young, AWS or Microsoft, you can use the unified API and get the benefit for the digital HSM. And then you know all the crypto operations can happen locally.

A

uh These are some GitHub repo we used so the first one is the Easter rainbow. um The second one is M1 part, and then the is is silver. Part of this is on the Easter report. This is the same one. This is our Intel case storage reference architecture, but actually you can use in your own key storage server, and this is the C. uh This is the C, but this is the attention controller part and we also have a ehsm solution, so it's open source if it's Auto leveraging is exactly so.

A

You can have a try and this you know, for the Easter part, we actually rely on the external C function. So this is the reference document.

A

Okay, um yeah, so uh I hope you can explore and join us, and you know all this digital Hub report is public and if you have any questions or issues um you can just submit it, um an apis are just are very welcome.

A

Yeah. That's all. Thank you. Thank you. Thank you very much.