点击蓝字关注我们
英特尔SGX和区块链
iExec端到端解决方案
iExec很荣幸地宣布即将推出首个集成英特尔SGX的端到端解决方案，用于分布式计算的安全技术应用。在2018年10月30日布拉格Devcon4会议上，iExec和英特尔将宣布重大合作新闻。
张磊，iExec安全总监介绍了英特尔SGXEnclave技术，以及如何保证参与区块链网络的用户和应用的安全问题，特别是基于区块链的分布式云技术方面。
敬请关注！
正文相关链接
IntelSGX:https://software.intel.com/en-us/sgx
Thechallenge:Howcanweguaranteesecurityondecentralizedanddistributednetworks?
Blockchain-basedapplicationsandcomputingarenotownedorcontrolledbyonespecificentitybutratherpoweredbyadistributednetworkofmultiplemachinesor‘nodes’.Thedistributednatureofdecentralizedcloudcomputingnetworkspresentachallengetoguaranteesecurityasanyrootprivilegeusermayeasilyinspectthesensitivedataandtamperwiththeapplicationrunningonthedecentralizedhost.Fortraditionalcentralizedcloudcomputingproviders,itiseasiertoemployexistingsecuritymechanismsprotecttheinvolvedapplication.
Fordecentralizedblockchain-basedclouds,asilicon-basedsecuritysolution,called‘IntelSGX’,istheonlyefficientsolutiontoprotectusersandapplicationsinvolvedinBlockchain-baseddecentralizedcomputing.
IntelSGX(IntelSoftwareGuardExtensions),isasetofCPUinstructioncodesthatenabletheexecutionofselectpiecescodeanddatainprotectedareascalledenclaves.Basically,whileyouhaveanapplicationrunningonahostmachine,SGXenclavesessentiallyactasabubble,isolatingandprotectingtheapplicationfromthehostmachine,inthisway,eventherootprivilegeadministratorofthehostmachineisnotabletopenetratethisbubbletoaccessandtamperwiththeapplication.
Secret Network：已解决英特尔硬件漏洞带来的风险:金色财经报道，Layer 1区块链Secret Network的开发人员表示，他们解决了研究人员标记的安全问题，这些研究人员强调了英特尔硬件构成的漏洞，该网络用于启用隐私保护智能合约。?由于某些英特尔 SGX 芯片中称为xAPIC或?PIC Leak的漏洞，Secret 承诺的隐私应用程序可能已受到损害。[2022/11/30 21:13:04]
AnintroductiontoIntelSGXEnclaves-iExecSecurityR&D,LeiZhang
“WhatmakesIntelSGXcompellingisthatitprovidesahardwaretrustedexecutionenvironment(TEE),allowingbetterprotectionsfordatain-use,at-restandin-transit,built-inCPUinstructionsandplatformenhancementsprovidecryptographicassertionsforthecodethatispermittedtoaccessthedata.Ifthecodeisalteredortampered,thenaccessisdeniedandtheenvironmentdisabled.”
—RickEchevarria,VicepresidentofIntel’sSoftwareandServicesGroup.
1.TheiExecE2ESGXsolution
iExecispioneeringthebuildingofablockchain-enableddecentralizedanddistributedcloudnetwork.Theyhavenowprovidedthefirsteverfullandend-to-endsolutionintegratingSGXfortheblockchain-basedcloud.SomeofourinitialworkwithintelSGXcanbereadinthisblogpostandiscoveredinthisvideopresentation.iExecpresentedthefirstphaseofworkonSGXinMarch2018attheIBMThinkConferenceinLasVegasandco-presentedalongsideIntelinMay2018atConsensusinNewYork..Thisfirstphasefocusedontheprotectionofthesecretsbuiltindecentralizedapplications:althoughtheapplicationsrunsondecentralizednodes,theinvolvedsensitivedatacannotbeinspectedoralteredwithbymaliciousattackersonthenetwork.Howeverthefirststageofworkwasbasedonsomesophisticated(raw)frameworksandthefunctionalityofthesolutionwaslimitedtoonlyprotectnativesecretsoftheapplication,furthermorethesolutioncouldbecomplicatedforappdevelopersandusers,especiallyforthosewhoarenotinthefieldofITandcomputing.
英特尔中国董事长王锐：告别浮夸的元宇宙，才能走向真正的元宇宙:3月5日消息，英特尔中国董事长王锐，在接受采访时谈到：元宇宙的最终需求是基础算力。这就是典型的美国的硬核科技巨头在对待元宇宙这件事情上的态度，不高谈阔论，不盲目的谈论商业，而是非常务实的从底层产业技术层面去思考自身企业在其中的位置，以及能够解决与突破的技术方向。
英特尔中国董事长王锐谈到元宇宙时，说：每个人心中的元宇宙蓝图都是不同的，核心需求还是基础算力。所以我说这个世界对我们有需求，就是最大的好消息。最惨就是这个世界不需要你了，而今天我看不到这个世界不需要英特尔的任何一个原因。我们下一步需要考虑的是怎么加大投入，以更好地适应未来元宇宙对算力和连接的指数型增长的需求。对我们来说，机会无处不在，关键在于怎样抓住机会。可以说，目前为止，英特尔是助力元宇宙最典型的例子，包括我们奥运会上孪生场馆的管理。这项硕果也被列在在奥运会的科技遗产中。（封面）[2022/3/5 13:39:04]
iExechastocontinuedtomakesignificantcontributions,workingdiligentlywithourpartners,topushforwardapowerfulanduser-friendlyend-to-endSGXsolution.Thissolutionisintendedtobeusedasanindustryreferencetoenhancetheoverallsecurityofdecentralizedcloudcomputing.ThisnewSGXsolution,combinedwithBlockchain,allowsforunmatchedleveloftrustforDecentralizedApplications(Dapps)andexecution/dataprocessingondecentralizednodes.TheiExecapproachspecificallyallowsBlockchaintoworkwithSGXinorderto:
ProtecttheDAppandprovidefulldataprotectionthatcannotbeaccessedbytheexecutionhost,especiallyforuser’sinputandoutputdata.
GuaranteetheintegrationoftheDapp/Data,makingsurethecorrectandexpectedDApporDataisrunningonthedecentralizednode.
Provideblockchain-basedvalidationforoff-chaincomputing,verifyingthattheDappiscorrectlyexecutedinanenclaveandisneithertamperednorinterruptedbythedecentralizednode.Asmart-contractsignatureissignedinsidethissecureenclavebeforetheverificationisdonebytheblockchainnetwork.
英特尔的新GPU产品未限制加密货币挖矿功能:10月12日消息，芯片制造商英特尔（Intel）的客户端图形产品和解决方案集团总经理Roger Chandler在接受Gadgets360采访时表示，英特尔正在设计的Arc和炼金术士（Alchemist）系列GPU产品没有任何专门针对矿工的功能，不会限制加密货币挖矿。
此前报道，今年6月份另一家芯片制造商英伟达宣布在其RTX30系列的所有显卡上添加了Lite Hash Rate算法，该算法可在显卡运行时检测是否为挖矿算法，如果被检测到显卡用于挖矿，则会将显卡的计算能力降低一半。[2021/10/12 20:23:56]
MakesuretheexecutionandDAppresultisvalid,neithercopied,norfabricatedbymaliciousdecentralizednode.
Protecttheend-to-endprivacyofDAppresult,whichcanneverbeinspectedbyanyoneelsebuttheuser.
Afriendly-userinterface:significantsimplificationforuserstoencrypt/decrypttheinput/outputdataandtriggertheSGXapplicationexecution.
EasyusabilityisakeyelementofUserExperience;withthenewiExecE2ESGXsolution,useronlyneeds3simplestepstorunanE2ESGXapplicationandtoprovideafullprotectionofuser’sinputandoutputdata.
Let’sthinkaboutatypicalSGXapplication,sayforexampleaFinTechapplication.Theapplicationisfedbysomeuserinputdatawhichcontainssomeuser’spersonalandsensitivesecrets(e.g.bankaccountinformation,personalprivacy,etc…),theoutputresultsoftheapplicationalsocontainsomesensitivedataandareonlyintendedtouserwhotriggerstheapplication.Theinputdataandtheoutputresultsneedtobestrictlyprotectedduringthewholeprocedure.Thenon-encryptedsensitivedataneverleavesuserlocalscopeorhigh-securedtrustedexecutionenvironment:SXGenclave.Hereisagenericdescriptionofthe3simplestepsofiExec’sSGXsolution.
英特尔和微软携手打击加密劫持:金色财经报道，英特尔和微软正携手打击恶意加密货币挖矿。用于帮助抵御高级安全威胁的企业级解决方案Microsoft Defender for Endpoint已扩大了英特尔威胁检测技术（TDT）的使用范围，以打击非法加密货币挖矿（即“加密劫持”）。该解决方案依靠遥测数据来检测CPU性能中的任何异常情况。与其他类型的防御不同，TDT能够在恶意软件设法感染受害者的计算机以挖掘加密货币之前对其进行检测。[2021/4/27 21:01:36]
Step1:Useronlyneedstorunonesimplecommandwhichallowstoautomatically:
Encryptuser’sinputdata
Pushtheencrypteddatatoaremotefilesystem(i.e.theremotefilesystemcanbeanypublicfilesharingserviceandenduserisfreetochoosehis/herpreferredone,pleasenotethatthisserviceisnotprovidedbyiExec)
Updaterelatedsessiondata(i.e.eachuser’striggeringoftheapplicationisasession)toaSGXbasedsecretmanagementservice.Secretmanagementservicecanbedeployedinaflexibleway:itcanbeatuser’sside,orscheduler’sside(i.e.SGXworkpool).
Step2:UsertriggersthetargetapplicationviasimpleclicksfromtheiExecDappstoreandmarketplaceviaauser-friendlyUIinterface.
OncethetargetapplicationistriggeredatremoteSGXdecentralizednode,theapplicationwillfirstlyautomaticallypulltheencrypteduserinputdatafromremotefilesystem(i.e.pushedinstep1);retrievethesecretkeyviasecuredSGXprovisionchannel,whichisthenusedtodecrypttheuserinputdata,thedecryptionisdoneonlyinsidethehigh-securedtrustedenvironment—SGXenclave;thedecrypteddatacanthenbeusedtofeedtheapplicationexecution,assoonastheapplicationresultisavailable,asignatureisprecededbasedontheprivatekeyprotectedinsidetheSGXenclave,whichcannotbeinspectedbytheoutsideworld.TheapplicationresultisfinallyencryptedandthentheiExec’sverificationprocedure(i.e.ProofofContribution)istriggered.EverythingissecurelyhappenedinsidetheIntelSGXenclaveensuredbyIntelhardwareCPUandnosecretisabletorevealedtotheoutsideworld.
动态 | 英特尔和SAP联手合作解决区块链瓶颈问题:据Cryptovest报道，芯片制造商英特尔和德国软件巨头SAP共同合作，研究区块链问题。SAP和英特尔分析了德国公司的工作负载，评估如何使用现有的软件和硬件解决方案优化区块链。该合作旨在通过创建“卓越的区块链技术”，使DLT在当前的商业模式中的应用更加广泛。[2018/9/5]
Thesignatureisfinallytransferredtoon-chainnetworkandverifiedbyon-chainsmartcontractviatheregisteredcorrespondingpublickey.Ifthesignatureverificationpassesandapplicationresult’strustlevelachievesagiventhreshold.Theuserwillbeinformedtodownloadtheencryptedresult.
Thewholeprocedureisdoneautomaticallyinahighsecureway,andthisprocedureistriggeredbyonlysomesimpleclicksfromuserviathefriendlyUIinterface.
Fig.1iExec’sE2ESGXworkflow
Step3:Usercandownloadtheencryptedresultpackage,andusercanjustrunonesimplecommandtodecrypttheresult.Pleasenotethatonlytheuserwhotriggersthetask(i.e.SGXapplication)isabletodownloadtheencryptedresult,andonlytheuserownsthekeytodecrypttheapplicationresult.
Pleasenotethattheprocedureisplatformindependent,andthereforeiscompatiblewithdifferentoperatingsystems:Windows,Linux,MacOS.
Inthenearfuture,wewillfurthersimplifyuser’sprocedure—allthethreestepswillbeintegratedintoonesimplestep,andcanbedonebyseveralsimpleclicksfromuserviauserfriendlyuserinterface—https://market.iex.ec/.
2.TheiExecSolutionisSGXVendorAgnostic
TheiExecplatformisopentodifferentSGXsolutionvendors.Specifically,iExechasbeencollaboratingwithSCONEandFortanixtointegratetheirSGXframeworksintoiExec’sE2ESGXsolution.WearealsointhephaseofevaluatingIntel’sPDOframework.Inthefuture,wewillalsoconsidertheSGXframeworkofGraphene/Graphene-ng.AllthemainstreamSGXsolutionswillbe100%compatiblewithiExec’splatform,andwewillleaveiExecDappdevelopersanduserstofreelychoosetheirpreferredSGXframeworks.OurobjectistopromotetheemergenceofanecosystemwhichprovidestrustedexecutionforBlockchainbasedcomputing,andthesetrustedservicecanbemonetizedviaiExec’smarketplace.
3.iExecContributionstowardsIndustryStandardization
iExecarepioneersinthefieldofblockchain-basedTrustComputing,andisveryactiveinleadingandpushingforwardtheindustrialstandardizationforinthiscontextforBlockchaintechnology.
Especially:
iExecisveryactiveinEEA(EnterpriseEthereumAlliance):iExecischairingtheTrustedComputeWorkGroup,andkeepscontributingandpushingforwardtheEEAspecifications,especiallytheOff-chainTrustedComputeSpecificationwhichistobepubliclyreleasedsoon.
iExecisactiveinIEEEaswell.iExecismemberofIEEEP2418,andisinvolvedinIEEEstandardprojectonDLT-basedFederatedIdentity,CredentialandTrustManagement.iExecleadsthestandardizationworkinseveralBlockchainbaseddomains,especiallythesecurityandTEE(TrustedExecutionEnvironment)
iExeciscollaboratingwithhardwaretrustedexecutionvendorstomoveforwardthishardwarebasedsecuritysolution(SGX)tobefullystandard-compliant,staytunedforthecomingupdatesduringDevcon4.
iExecisalsocollaboratingwithourpartnerstomoveforwardthestandardizationforBlockchainbasedFogComputinginthecontextofOpenFogconsortium.SomeresultofthefirststagecollaborationwithourpartnersonFogComputingwillbereleasedsoon,pleasestaytunedinthefollowingdays.
长按扫码关注公众号
点“阅读原文”了解更多
郑重声明： 本文版权归原作者所有， 转载文章仅为传播更多信息之目的， 如作者信息标记有误， 请第一时间联系我们修改或删除， 多谢。