Attestation and identity provisioning to Intel SGX workloads
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 16:20· Virtual, Virtual·
summary
Integration proves identities can reflect running code and filesystem state by using an SGX Attestor plus SPIRE to mint x509 SVID certificates bound to a session hash. Implementation uses lift‑and‑shift with the SCONE runtime, a helper that pushes SVIDs into an SGX secret store, and transparent TLS for outbound connections. Demo shows a workload retrieving its cert from the local store after attestation. Code goes public after an RFC and a 2–3 week proof‑of‑concept polish.
AI-written summary · about
chapters (5)
related talks
20mSupporting Confidential Workloads with SPIRE
32mA Platform-Agnostic Approach to Securing Workloads
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
37mZero Trust Workload Identity in Kubernetes
32mProduction Workload Identity with SPIRE
37mLeveraging Cryptographic Lineage for Context and ConnectedTrust
25mDemystifying remote attestation
27mSecurity++: Hide Your Secrets via a Distributed Hardware Security Mod...