linux-sgx: Improve the remote attestation (#1695)
The current implementation of remote attestation does not take into account the integrity of the wasm module. The SHA256 of the wasm module has been put into user_data to generate the quote, and more parameters are exposed for further verification.
This commit is contained in:
@ -37,6 +37,21 @@ $ echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bioni
|
||||
$ wget -O - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
|
||||
$ sudo apt-get update
|
||||
$ sudo apt-get install -y libsgx-uae-service libsgx-dcap-default-qpl-dev libsgx-dcap-ql-dev libsgx-dcap-quote-verify-dev
|
||||
$ # install SGX SSL Library
|
||||
$ git clone https://github.com/intel/linux-sgx.git
|
||||
$ cd linux-sgx && make preparation
|
||||
$ sudo cp external/toolset/{current_distr}/* /usr/local/bin
|
||||
$ # Verify that the paths are correctly set
|
||||
$ which ar as ld objcopy objdump ranlib
|
||||
$ cd ../
|
||||
$ git clone https://github.com/intel/intel-sgx-ssl.git
|
||||
$ wget https://www.openssl.org/source/openssl-1.1.1q.tar.gz
|
||||
$ cp openssl-1.1.1q.tar.gz intel-sgx-ssl/openssl_source
|
||||
$ rm -f openssl-1.1.1q.tar.gz
|
||||
$ cd intel-sgx-ssl/Linux
|
||||
$ source /opt/intel/sgxsdk/environment
|
||||
$ make all
|
||||
$ sudo make install
|
||||
```
|
||||
|
||||
You can optionally grant users to communicate with the SDK platform using the following command.
|
||||
|
||||
Reference in New Issue
Block a user