Hyperledger Foundation Hyperledger Global Forum 2022, 6 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Fabric Private Chaincode - Enhancing Privacy in Hyperledger Fabric with... - Marcus Brandenburger

Description

Fabric Private Chaincode - Enhancing Privacy in Hyperledger Fabric with Confidential Computing - Marcus Brandenburger, IBM Research - Zurich

Fabric Private Chaincode (FPC) is a security feature for Hyperledger Fabric that leverages modern Confidential Computing technology to protect the integrity and confidentiality of Smart Contracts and their data. In this presentation we will cover what Fabric Private Chaincode is and how it can be used to implement privacy-sensitive use cases for Hyperledger Fabric. The goal of this session is to educate developers with all necessary background to adopt FPC for their projects. In addition to existing C++ Chaincode support, we will highlight recent project updates, in particular, the new support for Go-Chaincode and the integration with the Fabric Smart Client. We begin with an introduction of FPC, explaining the basic FPC architecture, security properties, and hardware requirements. Moreover, we will cover the FPC Chaincode API, and the application integration using the FPC Client SDK. Additionally, we will demonstrate how the Fabric Smart Client framework can be used with FPC to develop and test complex privacy-sensitive applications. We conclude this session with a Q/A discussion.

Sessions Details & Slides (if available): https://sched.co/14H4x
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)

A

All right, so my name is Marcus I'm with IBM research, and today my colleague Bruno from interlapse, will join us through this computer and present as well, and today we will talk about fabric private train code. So someone in the room who has heard about that project before raise your hands.

A

Oh wow, okay, have you also used it.

B

A

Yeah, okay, cool all right: let's, let's start easy: okay, so why do we want something like fabric private train code? So there are many use cases where the blockchain actually makes sense in order to trace data on the blockchain. Everyone can see the data and verify that certain things are going on correctly. However, some use cases come with um very privacy, sensitive requirements- and there are I mean a bunch of examples like like sealed auctions, voting Healthcare supply chain and all these use cases they have some portion of privacy requirement in it.

A

So for a sealed auction we understand that if we submit a bit, it should be should be private until we evaluate the auction and release the winner so voting mechanism, we should actually never reveal the individual bits for healthcare data. Well, I, don't want my my patient stator stored on the blockchain, not good and for supply chain use cases, so we can think that I mean people are making contracts, making good deals for buying certain gifts.

A

Storing that on the blockchain might be nice for traceability, but sometimes you don't want to reveal the good price we got to our competitors.

A

Luckily, hyper electrophobic already comes with a few of built-in mechanisms to to solve those use cases or to solve those issues.

A

For instance, we have channels where we can basically yeah establish multiple blockchains on our Network in order to split the participants that only the participants can see the data what they should see on their transactions, then we have private data collections where we only exchange the data among the people who need to know the data and submit essentially a hash or commitment of that data on the blockchain, and then we have private or transient fields which allows us to put data in the transaction which do not show up in the end of the day, on The Ledger.

A

However, all these mechanisms are making a good contribution towards price privacy, sensitive use cases. um We still have a problem, and the problem is that all the data is still visible to the endorsing peers. What do I mean with that? So I mean endorsing peer, which executes our functionality. Our smart contract needs certain data, most probably the sensitive data, in order to process this chain code.

A

So for, let's think about that in a voting uh example where the government then runs an endorsing peer. Well, maybe that's not a good idea that the government then, when they execute the smart contract, can basically encrypt or do or basically um CR data and clear and process it. That's not nice in order to understand that a little bit better I have a single slide, which represents hyperledger fabric. Where we can see, we have the clients, we have the peers in the middle and the ordering service and the peers.

A

As I already said, they are responsible to execute the chain code, maintain the word State and the letter.

A

So if you're saying okay from for my use case, I'm, actually fine um that a certain organization can process the data. That's fine for me, however, think about deployment use cases where your fabric Pier is deployed somewhere in the cloud where you don't have control over your data. So you you do not know if the admin maybe is malicious.

A

What should you do then?

A

So, in order in order to overcome this those issues, um we have introduced fabric private chain code, which is the framework to to build, deploy and run private chain code on top of hyperledger fabric, which is exactly built in order to tackle those use cases where privacy is an issue and we we solved or we tackle that problem by leveraging trusted execution technology or confidential Computing code nowadays like into sgx who of you, have heard about Intel, sgx, very good, all right, and so by leveraging this technology for our smart contract, we get.

A

We get essentially three nice properties, so the first one is confidential compute, where all the transactions and The Ledger only contain encrypted data, and only the smart contract or chain code running inside the trusted execution environment will get access to our data in clear. That means that the endorsing peer does not see the data in clear only encrypted data.

A

The second property is um verifiable operations, so with fabric private chain code and the use of trusted execution all the transactions there are actually um verified through a mechanism called attestation that allows us, as a user, to verify that our smart contract is protected in such a trusted execution environment, and this you can basically then transitively show for each transaction and say: okay. This transaction has been executed by a trusted execution environment.

A

Here's the other station that it's using Intel sgx things like that, and this also brings us to the to the last property, which is a data misuse prevention, because we now um bind our data through encryption to our actual chain code we can base. We can get a measure in order to control who's allowed to access our data.

A

And now I will give the word to Bruno.

A

C

Hi everyone FPC announced its confidentiality for fabric chain codes by using the hardware-based security mechanisms to isolate the chain code from the rest of the platform. Our current implementation uses Intel sgx to create an enclave which is a protected environment where the sensitive chamber runs.

C

The hardware enforces the isolation of The Enclave, which means that outside components such as other Hardware, the hypervisor, the operating system and any other application cannot tamper with it. Nor read any sensitive data.

C

This allows to preserve integrity and confidentiality at fabric tiers. Finally, a hardware-based station allows to distinguish an FPC chain code from a regular fabric chain code. This allows to establish trust in an FPC chain code running remotely before communicating any sensitive data to it.

C

Here is an overview of FPC and how it integrates with fabric without modifying fabric itself. So you can use FPC in your existing deployments, has in fabric, so in FPC, Orcs have to install and approve the chain code that they want to execute in FPC Additionally. The checkout definition includes the emery clave, roughly corresponding to the hash of the chain code, attested to by the hardware for integrity purposes.

C

At initialization time, the chain code Enclave generates and attests some cryptographic keys, which are crucial for authenticated encryption of cloud Communications and data storage on The Ledger.

C

The Orcs can then look up and Enclave skis using The Enclave registry, and this is a regular fabric chain coat which collects, verifies and shares such information on The Ledger.

C

At this point, the FPC chain code is ready to execute transactions by receiving encrypted invocations from clients and delivering encrypted responses to clients. All of the lookup cryptographic and storage operations are handled transparently by the FBC client SDK at the client side and by the FPC shim at the chain cut side. Both components exposed interfaces similar to the fabric, client SDK, into the fabric, shape now back to Marcus.

C

A

You Bruno isn't that weird.

A

A

So say that again.

A

So right now, fabric private jenko does not um integrate private data collections, but we would like to work on that.

D

Problem exists.

A

A

Well, that depends I guess on the configuration of the private data collections, but but if a chain code needs that data in order to make a decision to run your logic, then that endorsing peer assuming it has the rights to basically consume the data from the private data collection basically needs that data, the hash from the private data it's written to the chain. Yes,.

A

Yeah, that's correct, um I mean the so. The the contrast with using confidential Computing is here that we're basically isolating the execution of the chain code from the endorsing peer. So the endorsing peer does not see the content. So when the when the admin of that machine does a memory dump, he will not see the data in clear text.

D

See the rough data, because the detection.

A

My understanding as messages that with this approach, not even the endorsed increase of the organic organization, yes, exactly.

A

Well, if you, if, if in your private data collection, you don't even trust the organizations extracting.

A

Data Communicator.

A

Which is running across would not be seeing that you appeared would also require the private data.

A

So can I suggest that we do that discussion. Maybe after the talk I mean it's super interesting that let's definitely have that discussion.

A

Any other question quickly related to your understanding of FPC, who did the very fast 101 here Okay. So, let's see I mean how can how can we use this stuff now um I mean um the easiest thing you can do. I mean get out your laptop and type this command in the console, and then you get everything you need to getting started with fabric private train code.

A

So in our repository we have an SDK to build a fabric, private chain code in two languages, right now, C plus plus, and go which will I talk more about in a second. We also have an FPC client SDK, which is very similar, as Bruno already mentioned, to the traditional fabric, client SDK, for go, but it basically helps you to, with all the let's say, nasty parts of the security, in particular the encryption or data protection.

A

When you're communicating to your chain code, we also integrated uh recently the fabric, smart client, so you from your fabric, smart client application. You can also call fabric private Jenkins and you find will find many more examples how to take your FPC chain code deployed on a fabric test Network, for instance. We also provide a Docker rise development environment which comes with all the tools you need in order to get started without installing a lot of stuff on your machine foreign.

A

Let's quickly talk about, I mean how to write FPC chain code. So, as I said, there is C plus plus chain code. The reason why we introduce C plus plus Jane code is when Intel released their Intel sgx technology. They only provided an SDK which allowed you to program your code in C plus, so we had to go that direction at uh when we started that as a usual chain code. You basically start writing your invoke method, and then you can do all the things like I mean getting the parameters from the transaction inputs.

A

You can get the state and put State operations.

A

um The nice thing from the user perspective is that our FPC shim basically provides you all the features to protect your data. So this is very similar to traditional chain code. Where you just write your data in clear, however, our FPC shim takes care of encrypting and decrypting those Data before it's going on the letter, but, moreover, we, the shim, provides mechanisms in order to produce a signature on our transaction. Saying hey. This transaction was really executed inside the trusted execution environment using the remote attestation capability of Intel sgx.

A

So now you may think, hey markers. Are you serious? Do you really want me to implement my chain code now in C plus plus nah, and this is why we have FPC plus ego, which is a go compiler to compile your go application to run it inside into sjx, which leads us um or which gives us now the possibility to take your gold chain code and run it inside run it with FPC foreign.

A

So this is maybe now more familiar to you.

A

So we can now write a normal gold chain code also use the functions which are provided by the shim um or by the step we can run put State get state things like that and very similar to the C plus version, or the complexity is hidden behind our framework implementation and the what I really um find pretty cool in that project, that this was a collaboration with the University of Bern with the crypto group and there, a student Ricardo um spent quite a lot of time to to hack this together and build uh our and help to build our our preview.

A

In order to integrate no FPC, there are actually very minimal changes. You need to do on your application, so you just import the FPC FPC um um library and wrap your chain code as a new private chain code and compile it with the tools we are providing in in our Repository.

A

So now the scary part I will try to do a live table in order to to show you that this is really real.

A

So and the idea is hey: let's pick one of the samples which we have on in the fabric. Examples repository and I would suggest that we go with the asset transfer basic um sample there. We go to the gold chain code.

A

If we go there to turn code again, you will see here the smart contract implementation of a chain code, and let's look at this, for instance, so here we have a method or a function which is implemented to create an asset. The asset has an ID, a color, a size owner and a value, and that looks pretty straightforward. So the chain code checked. If the asset exists, it will create an asset module to Json and then performs a put state.

A

So as a traditional chain code, you understand now that in the right side of that transaction, the this object is a serialized. Json string will appear unclear. Our goal with FBC is that this is not unclear anymore. So how? How do we do that.

A

So I created a little a sample which is available in our FPC repository under samples, the most hyperledger Global form, and here I, basically only have a single main function which we need to modify now, let's see if this works.

A

So what we need to do is so with fabric project. We use the chain code as a service model to to run our chain code. So what we're going to do? Is we go here to the main file of the asset transfer?

A

Take this shn code I think we can ignore this error for a moment. Then we also need to import the logic.

A

So now, in order to make it an FPC chain code, we need to wrap it.

A

So luckily, Garland will help me figure on the right column. Ports here, that's good. So next thing is: we need to build this. uh We will use our our tools building on top of the ego compiler, um since um that might involve multiple commands and the command line tool. I provide here a little make file with a with a reference make file which you can use for um for your application. The only thing what we need to configure is you to give the Shanker the name.

A

Fpc basic asset transfer so, and that should be, should be it let's see if we can build it. Let's cross fingers.

B

um Fpc pass sample demo.

A

Okay, here right, there's our make file Let's cross fingers doesn't work.

B

A

So the thing is that it complains that there is no ego compiler on my machine installed, which is also reasonable. It's a Mac. It does not support into sgx, but as I promised before, we have a development environment for a docker, um so I'm switching now into a Docker container, which also runs on on this machine. Having all this stuff installed.

B

A

Right, here's our stuff, so, let's hit make so now you can see it uses the ego compiler to build our um our chain code and then it also packages for us, a Docker image containing the binary plus the runtime uh things you need in order to run an sgx application. Essentially.

A

So if we look here what we've got now, we got now a binary. We got a public and private keeper which is used to sign actually the binary so that we can make sure that me as a developer, the the correct um chain code is actually executed and more interestingly, we also got this little um file here, which contains the Mr Enclave of our chain code and the mower Enclave is basically, as Bruno said, a hash of our of our chain code logic, which clearly identifies our logic.

A

We will need that later. So, let's so now we have a Docker image. Let's see in Docker images.

A

Yes, so this is apparently the docker image we just built cool, so Next Step would be, let's run our chain code.

A

um However, when running the checkout, now we're actually entering the let's say the The Madness of deploying or running uh chain code or running um hyperledger fabric. In order to make this easier as a developer, um we we would like to use um the fabric. Smart client integration, test suit, which allows us to spawn up easily a fabric, Network install our FPC, jankode or any other chain code with a few lines and just run and test it. So you don't need to deploy your actual, um an actual Network.

A

So for that we have in our samples and employment fabric, smart client, there we have um yeah a project, and this project here has a topology.go and in the topology.

A

We can specify now our Network. What you can see here is that we specify a fabric network with two organizations we enable FPC and we install an FPC chain code with a given a chain code name and a chain called image foreign, because I don't want to actually I would like to reuse this project. Now, um I, don't I, don't change the code, but um in the other terminal we saw that we basically have these export statements, which we can load for that example.

A

So, in order to do that, we Source this little file.

A

And then we can just make a run.

A

Which, hopefully does something now? Yes, so it's starting now Network now you can see, hey orders are spawning fabric. Pierce us burning.

A

We can also see that we install chain codes here I. Maybe you cannot see that I mean I saw that quite often, which is very nice for debugging, but maybe for a presentation not really ideal.

A

Sorry for that.

A

But so what we will also start is um in hyperledger Explorer instance. In order to see, then what which chain code is running on um in our Network.

A

So it's still installing it takes a little bit.

A

Any questions so far.

A

Yes, so the MRN clave is part of the attestation you get from an enclave and the attestation essentially will say: hey I'm in Enclave I'm running this particular code, which is corresponds to the Mr enclave. And then this entire attestation thing in case of inter um the epit based attestation, is signed by into so, and then you basically get that you can verify that this statement is signed by into you can check that this attestation contains the Mr Enclave.

A

You are happy with which.

A

Yes, so, um as Bruno said in his part, we put the Mr Enclave as part of the Chango definition, so in the normal fabric life cycle, um we need to install the chain code. We need to create a Django definition, let this approve and by adding the Mr Enclave all the participants on that channel or using that jenko. They agree on a certain Mr Enclave and under the assumption we have a republic that actually works pretty well.

A

All right so now our network is up and running. Let's quickly, see if Explorer is there, it's loading.

A

All right, so we can see. There are two nodes, two chain codes when I go to the chain code panel. Here I can see now that our FPC basic asset transfer chain code is installed and another one which is our Enclave registry chain code and The Enclave registry chain code, is basically your um our our entry point in in the system in order to store the attestations in order to track or maintain a list of what are the enclaves installed on our Channel and uh what are their public Keys? What are their encryption? Keys?

A

I need to use in order to send a message in a way that the endorsing peer does not learn the contents of it, foreign.

D

A

um Not at the moment so right now when, when we install or when, when we register our Enclave, we essentially also store the IP address of the endorsing peer, which runs that particular Enclave.

A

So therefore, your cc is right now used for us as a discovery.

A

um Okay, so we see now the FPC chain code is installed, foreign and so, in order to I mean produce a transaction. Now we will need to use the fabric private chain code SDK in order to let the invocation to be encrypted protected. Things like that in order to demonstrate that I would like to use also in our samples under application. The simple CLI, which is essentially I, mean a little CR2 which allows me to invoke transactions under inside it uses the fabric paper chain called client SDK to encrypt the data.

A

So, let's quickly build this I think I also need to Source again.

A

um In order to in order to configure now the client very similar to all the configurations you do normally for the the Pew command you need to provide I mean the endpoint um of the peer. You would like to connect to things like that. um Let's do that quickly.

A

And our test Network also provides us now a little script.

A

To get all these.

A

Writing and talking is sometimes incompatible.

B

A

So we would like to now configure our client as orc one. So this is the stuff we need to specify.

A

And now we can use this client to invoke a chain code, the function we would like to invoke. Let's quickly double check again.

A

What was the actual command in the code.

A

So we need to provide an ID color size owner, okay, so a d which makes this thing blue. We make it size 10 who wants to own it here, hard, perfect and yeah. Let's give it a good value all right. So now you can see that something is not working. Aha, so I forgot something I forgot the function name and I think this was create asset create asset. Let's try again cool worked so here in the terminal. You can, since I've enabled debugging that you can actually see that something is going on.

A

um You can see quite a lot that um the enclaves are now doing something I mean running the chain code, endorsing the transactions things like that.

A

If we now look at the Explorer, we should see in our latest transaction, which is this one. Can you eat this.

A

How does this work.

A

A

So, let's quickly open the the right set.

A

And I try to make it as big as I can.

B

A

If this works, no that's worse, okay, so what we can see in the right side is that we see the key 101. This is the ID we specified in our Command and at the value we don't see so much I mean we see something.

A

um However, if we would run this as a traditional chain code, we would see here the um the Json string of um our asset has produced here. So maybe for you and exercise at home is install the normal. This chain code as a traditional chain code, run this open and Hyper in the Explorer, and then you will see that the traditional one will appear um in clear text, but with FPC, not okay. So this is the data we see now on The Ledger, let's see if we can get the back the data and clear.

A

So now we do a query. I think it's called read asset.

A

Yay we got it back.

A

All right so this concludes my Hands-On demo on FPC.

A

And it worked yay.

A

All right so and I mean, if, if you, if you think, that's a nice thing, and you would like to see more of it- there's another demo today by Koshi um he's also here in the room, he will also show FPC in action with a different with a real use case. Let's say not with my little toy application here um and uh yeah. Please go enjoy his talk um and also um check out our GitHub repository uh join. Our community meetings talk to me here.

A

They have a lot of global forum and uh get in touch with with us and use it if you, if you find it useful. Thank you.

A

B

According to my understanding, um so you can only for your.

A

Biking and get back well so.

A

I, the rich, as you said, Rich queries actually require you to I mean have some meaningful information inside of your keys in order to make uh a good query. um So this is the Reason. By uh that we write now by default, do not encrypt the keys only the values. In order to allow Rich queries.

A

However, we all have. We have all the code in place that you as a user. If you also would like to encrypt your the keys as well, you can do that, but then your sacrifice in the usage of range queries. That's true.

A

Performance is like, and the pattern have been known, security vulnerabilities. We have to be used as given I think.

C

I think of anyhow, especially considering the fact that it's a proprietary technology, can you consider that made any considerations of thoughts. How such vulnerabilities would impact security guarantees that you're trying to provide.

A

Yeah so I mean as a as a researcher, I would say yeah. So if your trust model says okay, trust, The, Trusted, execution, environment, then you're fine and don't care about side channels, but this is reality, looks different right. So what you were saying this is a real thing.

A

um I personally believe that Intel does a very good job in going to Academia and um I mean to the open source Community, throwing the hardware and letting people I mean really fire on it in order to basically reveal such limitations of the technology, but on the other hand, they also provide fixes and improve that. So that's a good thing and um I mean as any other technology we built in the security space.

A

Most probably never perfect. It always have something, but we definitely would need to integrate additional measurements in order to deal with it so, for instance, in fabric privacy, you could say: okay, my my Enclave code is only or an attestation. My Enclave is only valid I, don't know for a week after that, you do a key rotation things like that, um but those are really additional means you have to put on top on that. So yeah. You should not always rely on on one thing: a security measurement right yeah.

A

No, no, that's! No! So the other thing. What we would like to look is to extend also FPC to different trusted execution Technologies other than into sgx, um which is not a trivial task. I mean the Linux Foundation. They created This Confidential Computing Consortium in order to bring all the manufacturers on the same table and see okay. How compatible are our different Technologies here and if we could also use this for fabric private jenko. That would be ideal.

A

So we could imagine that we built then a policy that a certain chain code runs in sjx and on AMD, SUV or whatever, and if both agree come to the same result when they execute, then this is considered to be even more trusted than just executed by into sgx you're. Welcome any other questions.

A

So um foreign I think um right now we require at least fabric 2.3 right now. Our client SDK does not work with the Gateway um work. We just have a scene here um because there think about that with the Gateway we as a client, we sent our request to the Gateway. The gateway then do does all the magic with it and then needs to end up in the Enclave.

A

However, that would be something we could actually solve by just engineering work so that still the client does the protection of the data sent it to the Gateway things like that, then, as a dependency here we have the ego compiler, which we need, or for the C plus chain code, the into sgx SDK um that you need to use, but other than that.

A

But okay, so I mean as a requirement. You definitely need a machine which is capable which has Internet sdx available in koshy stock. You will learn about how FPC can run on the Azure Cloud, for instance um yeah. Otherwise you, basically you just need the hardware, but but for just playing with it, um I mean there I try to demonstrate this on my Mac using all over and docker-based development environment.

A

A

This is right now not implemented. That's true! So right now we have basic functionality for gencode, um but for every other feature we need to think about. Okay, if one chain code Codes another one that chain code might need to also verify that the other Enclave is an enclave running the expected code. Things like that, so this is not yet implemented.

A

All right, I think, then that's it and we go for lunch.