Qiyuan Gong b75f399038 [PPML] Add UEFI warning (#6646 )

* Add UEFI warning for attestation

2022-11-17 08:51:51 +08:00

3.2 KiB

Raw Blame History

PPML Installation

OS requirement

.. note::
    **Hardware requirements**:

     Intel SGX: PPML's features (except Homomorphic Encryption) are mainly built upon Intel SGX. Intel SGX requires Intel CPU with SGX feature, e.g., IceLake (3rd Xeon Platform). `Check if your CPU has SGX feature <https://www.intel.com/content/www/us/en/support/articles/000028173/processors.html>`_

.. note::
    **Supported OS**:

     PPML is thoroughly tested on Ubuntu (18.04/20.04), and should works fine on CentOS/Redhat 8. Note that UEFI (Unified Extensible Firmware Interface) is required for remote attestation registration stage.

Enable SGX for your Cluster

.. mermaid::
   
   graph TD
      usesgx{Use SGX?} -- Yes --> installsgx(Install SGX Driver for Node)
      usesgx{Use SGX?} -- No --> he(Homomorphic Encryption)
      installsgx --> installaesm(Install AESM for Node)
      installaesm --> needatt{Need Attestation?}
      needatt -- Yes --> installPCCS(Install PCCS for Cluster)

Install SGX Driver

Please refer to Install SGX (Software Guard Extensions) Driver for Xeon Server.

Install AESM (Architectural Enclave Service Manager)

echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list > /dev/null
wget -O - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
sudo apt update
sudo apt-get install libsgx-urts libsgx-dcap-ql libsgx-dcap-default-qpl

Install PCCS (Provisioning Certificate Caching Service) (for attestation)

Please refer to Intel® Software Guard Extensions Data Center Attestation Primitives (Intel® SGX DCAP): A Quick Install Guide

Note that PCCS requires Internet connection for downloading certificates from Intel PCS. PCCS is fully open sourced on Github, you can build your own PCCS based on these codes.

.. mermaid::
   
   graph BT
      pcs(Intel PCS) --> PCCS
      PCCS --> pcs
      subgraph Internet
         pcs
      end
      subgraph Data Center
         PCCS --> sgx(SGX Server)
         sgx --> PCCS
      end

Install Kubernetes SGX Plugin (K8S only)

Please refer to Deploy the Intel SGX Device Plugin for Kubernetes.

FAQs

Is SGX supported on CentOS 6/7? No. Please upgrade your OS if possible.
Do we need Internet connection for SGX node? No. We can use PCCS for registration and certificate download. Only PCCS need Internet connection.
Does PCCS require SGX or other hardware? No. PCCS can be installed on any server with Internet connection.
Can we turn off the attestation? Of course. But, turning off attestation will break the integrity provided by SGX. Attestation is turned off to simplify installation for quick start.

3.2 KiB Raw Blame History