general/occlum
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f65bbdd924
occlum/demos/remote_attestation/dcap
History
Zheng, Qi 8e9f1fb933 Fix the compile error when including dcap_quote.h in pure C program
2021-12-17 08:14:00 +08:00
..
c_app Fix the compile error when including dcap_quote.h in pure C program 2021-12-17 08:14:00 +08:00
dcap_lib Fix the C++ Link issue and Add the static lib 2021-12-15 16:55:32 +08:00
dcap.yaml Update dcap demo with copy_bom tool 2021-09-26 17:28:13 +08:00
README.md Add dcap rust based library and C test program 2021-07-20 11:17:09 +08:00
run_dcap_quote_on_occlum.sh Update dcap demo with copy_bom tool 2021-09-26 17:28:13 +08:00

README.md

SGX DCAP Remote Attestation Demo in Rust

This project demonstrates how to do Intel SGX DCAP (Datacenter Attestation Primitives) remote attestation on Occlum. Occlum provides SGX capabilities to applications through ioctls on device /dev/sgx.

Prerequisites

  • Platform: Intel SGX enabled platform with DCAP installed. Follow DCAP Quick Install Guide for the detailed installation procedure.

  • Occlum: Compile Occlum on a DCAP-installed platform by invoking make. The compilation will look for the needed DCAP libraries. The needed libraries include libsgx_quote_ex, libsgx_quote_ex_sim, libsgx_dcap_tvl, libsgx_dcap_ql and libsgx_dcap_quoteverify.

Run this demo on Occlum

You can run the DCAP quote generation and verification demo, including dcap library build, rust test demo and C test demo on Occlum via

./run_dcap_quote_on_occlum.sh

Preinstalled DCAP package in Ubuntu 18.04 and CentOS 8.1

The DCAP package has been preinstalled in the Occlum official docker images including Ubuntu 18.04 and CentOS 8.1 since Occlum 0.19.0. The versions of DCAP package and PCCS should keep the same to avoid incompatibility. The demo is verified in Occlum 0.23.1 in which the DCAP version is 1.10, so PCCS should also be version 1.10 to work with the preinstalled DCAP package. Remember to configure /etc/sgx_default_qcnl.conf in the container according to your PCCS setting after running the docker image.

As DCAP 1.10 is not the latest, the demo application running in the container of the official image will output a warning: WARN: App: Verification completed with Non-terminal result: a002. The a002 of type sgx_ql_qv_result_t in the warning indicates the quote is good but TCB level of the platform is out of date.