Leveraging Cryptographic Lineage for Context and ConnectedTrust
summary
Builds a cryptographic chain of custody for AI requests that binds short‑lived SPIFFE identities to signed, nested claims so each hop proves provenance and tamper‑resistance. Implements an Envoy proxy that talks to SPIFFE/Spire and an Attested Claims plugin, emits an LSWI document (lightweight SPIFFE verifiable identity) with nested signatures using concatenation/macaroons modes, rotates certs (demo shows 60s cert rotation), records TPM fingerprints and training‑data hashes to detect poisoning and enable intent‑based access.
AI-written summary · about
chapters (9)
- 0:00Cryptographic lineage for AI security
- 1:28Security challenges in generative AI
- 6:06Zero trust for AI and data
- 9:58Spiffy and SPIRE for identities
- 11:45Delegated authentication and runtime
- 14:16Building cryptographic lineage for AI
- 17:29Demo of cryptographic lineage
- 29:42Community efforts and future
- 30:51Q&A
related talks
36mFederated Identity for Distributed Systems: Understanding SPIFFE
32mA Platform-Agnostic Approach to Securing Workloads
28mCan I Trust You? Service-to-Service Identity with SPIFFE
49mReal World SPIFFE Scenarios and Outcomes
30mIntro: SPIFFE
36mSPIFFE: In Theory and in Practice
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects