Confidential Computing in the Control Plane (case study using Barbican)
summary
Built a containerized Barbican that runs inside an SGX enclave using Graphene and Scontain SCONE with a CAS + LAS attestation chain, and moves the key encryption key into an enclave so the protected KEK never leaves CPU memory. Life cycle integrates image hashes in CAS policies so attestation blocks outdated images — demo shows a backup image failing measurement. Work succeeds for Barbican and Keystone but enclave memory and fork limits cause pain for larger services like Nova.
AI-written summary · about
chapters (6)
- 0:00Introduction to talk
- 0:41What is confidential computing
- 8:51Why protect OpenStack control plane
- 12:23Case study with Barbican
- 23:43Demo of key protection and attestation
- 28:00Q&A session
related talks
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...- 40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
28mSealed for All: Multi-Party Confidential Computing, No Trust
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
46mAutomatically Securing Linux Application Containers in Untrusted Clouds
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure