linux-sgx: Improve the remote attestation (#1695)

The current implementation of remote attestation does not take into
account the integrity of the wasm module. The SHA256 of the wasm
module has been put into user_data to generate the quote, and more
parameters are exposed for further verification.
This commit is contained in:
Zeuson
2022-11-22 14:45:03 +08:00
committed by GitHub
parent 87c3195d47
commit 656a8427e6
11 changed files with 298 additions and 65 deletions

View File

@ -37,6 +37,21 @@ $ echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bioni
$ wget -O - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
$ sudo apt-get update
$ sudo apt-get install -y libsgx-uae-service libsgx-dcap-default-qpl-dev libsgx-dcap-ql-dev libsgx-dcap-quote-verify-dev
$ # install SGX SSL Library
$ git clone https://github.com/intel/linux-sgx.git
$ cd linux-sgx && make preparation
$ sudo cp external/toolset/{current_distr}/* /usr/local/bin
$ # Verify that the paths are correctly set
$ which ar as ld objcopy objdump ranlib
$ cd ../
$ git clone https://github.com/intel/intel-sgx-ssl.git
$ wget https://www.openssl.org/source/openssl-1.1.1q.tar.gz
$ cp openssl-1.1.1q.tar.gz intel-sgx-ssl/openssl_source
$ rm -f openssl-1.1.1q.tar.gz
$ cd intel-sgx-ssl/Linux
$ source /opt/intel/sgxsdk/environment
$ make all
$ sudo make install
```
You can optionally grant users to communicate with the SDK platform using the following command.