You
Know better, okay
Yeah, perfect and then let's say the newer generations they move to this VM based
A scheme where you have an entire VM isolated from the from you use we cut at the hypervisor you create
And I completely isolated VM and everything that's inside like the firmware the bios the kernel and so forth is everything is part of that
confidential context
That means of course more code that needs to be trusted that's running in the same kind of privilege layer
But you don't have the problem of this restricted system interface. So you can directly access do any kind of syscalls
pretty much behave like any other application inside any other operating system and
those are these these two worlds and both could be an option for protecting variety be at runtime
As I said we will interface
In in case of the confidential VMs and
There's nothing really we have to change and in case of
The the into sgx the process-based world
We have this weird thing
where we need to forward those syscalls to to the host and I
Guess it's it's fair to say that the the right side is probably a lot faster
But you have this bit more of a stack that you need to trust that has that's running inside the same same context
Yeah, so so sgx and process-based limitations
It's currently I think it's fair to say it's an interl only solution. You're pretty much locked in with Intel at that point
Any kind of context which is expensive that means I always is expensive
any other interrupt is expensive and
InnoDB I have to say I'm not a marioDB expert whatsoever, but
For some reason I know that innoDB is a problem people use different kinds of
Storage backends like rocks DB for example
so
You can't just move the I guess the the off-the-shelf marioDB into an sgx archive
There's some some things you have need to fiddle with and then you can make it work
The upside is you have a very small
Trusted computing base a very small amount of code that you need to trust that runs inside this this context
On the other hand SCV confidential VM larger TCB, but that
that means you are more
it's more lift and shift and
Yeah, Intel is currently not an it doesn't really have an a solution out there that you can use
But there's into TDX coming. That's more or less the same as as AMD SCV
There's other stuff coming from arm and and risk V and so forth
Huge attack surface just means yeah, you have the kernel you have the firmware the boot load everything inside that and that inside that
Context so if you have any kind of vulnerabilities there, you could be potentially attacked even though you're isolated right?
Apart from memory encryption
I think an important aspect of confidential computing is is attestation that means remote attestation just means you get an
Statement from the chip from the CPU about what's running what code was loaded inside your enclave
your
for your confidential VM and that you that's that's signed with a key
From the CPU and this key has a certificate chain back to the hardware vendor so that
You can send such an statement about for example
This is a Mara Mara to be enclave a mara to be container that was loaded inside this enclave you can send it to a
To remote party and establish a secure channel for example exchanging a key
Bootstrapping a t-last connection, and then you have a secure channel through that through the database you can exchange data
to your select statements and so forth and
With SGX this needs for example you can do that by by having like a small
Small step that runs before your before your actual code or next your actual code
That does that interaction with the CPU and provides you with a attestation statement, and then you can use that
Felix gave a talk last year Felix used that the Mara DB deff room about
etch list to be that's essentially a
That builds up on Mara to be and tries to
Bring that confidential computing concept even even even closer or even more into the the the use case
After slides from Felix, let me quickly
Because what we've seen so far is essentially just
lift and shift of Mara DB
On top of SGX or top of AMD SCV what actuals DB does
Essentially it uses rocks DB for the reasons mentioned and also for it has some neat features about the encryption
so
The way it writes blocks
Makes it very good for the for the confidential computer attack a model. You can switch things around you can't do any any modifications and
The interesting part is why I'm showing this if they
added a confidential computing front end that means
You not only have attestation that your Mara DB runs inside confidential computing environment. They also give you an attestation
About what the database is and who has access to it essentially
When you when you set it up you define a small manifest
It just gives the initial database layout like the users the initial tables who can modify what who has access to what tables
and they add that to the
To the attestation statements, so then you can give to a remote attestation and you know
This is this is not only Mara DB running there, but this is Mara DB with those user credentials those tables
I think that's
Integrating this concept of confidentiality more with the
The concept of a confidential database if you will so interesting
SSTV is also open source as you can check it out. But if that's that's interesting for you, but it's SGX specific
You go back to our which lights
Yeah, it's his lights his emojis take responsibility, but yeah, the problem with SCV and and confidential VMs currently is that you can
You can just lift and shift Mara DB inside it will work the problem with the current way
hypervisors and another club providers
Offer confidential VMs is that they don't give you full access to the entire stack that runs inside the confidential VM
That means they have a firmware shim
You don't know you can't really verify that loads your bootloader US and then Mara DB that breaks the chain of verification from
the hardware essentially that's what the slide tries to tell you and
What we like to have is having the full chain inside this in this VM
Verifiable from the from the firmware like from the hyperstatement to the firmware and up to Mara DB itself
So yeah, this is a practical problem right now, but hopefully going to be solved soon
You
Currently you you can for example on Azure you can start on a
MDSCV machine on hyper V. They they set the firmer
But there's a preview where you can define your own firmer
You can either use direct Linux boot or you define your own ua ua fi base firmer
Yeah, and then you beat you boot the image the image that starts Mara to be and then you go from there
Yeah, if you want to try that
Yeah, of course, there's the AMD documentation and stuff
of its company cloud cloud offers confidential VMs based on a CV
Apparently there's some some solution to try it out, and yeah, actually TV is open source. You can also try that. I
Think that's the last light. So I'm not sure if I hit those 20 minutes, but yeah
Any any questions
The yeah
Mostly people that currently want to process sensitive regulated data in the cloud like healthcare
Telecommunication this kind of stuff they store
They do that on-prem with with with the database they want to move that to the cloud, but then they can't because
It's not enough the data is protected at at rest and in transit. They also need to protect data at runtime or as the HSDB case makes it
Give guarantees on who has access to the data
Yeah
To be honest, I am not the best person to answer the question, but I think
it's part of the sis calls that
That that happened when when you use in ODB
I'm not sure what what sis calls aren't the problem and then you have this context switches
And you have a lot more context switches than when you use rocks to be that makes it super slow. That's at least one problem
Yeah, yeah, I think that's there was something on Felix lights along those lines
Yeah, by the way if you I
Think this is from last year. I think there's a recording and Felix speaks about
Why rocks to be as more as a better performance than then dd in ODB, yeah
I don't I don't know this will be a great question for for avid here something right
Yeah
Yeah, I'm not sure if avid is in the chat or if there's a chat, but maybe he can answer that question
Yeah, okay, so this is specific for how AMD implements that essentially they add a
A chip the secure processor
Yeah, yeah, and this this basically holds the keys holds the information and then you communicate as the guest you communicate encrypt
You can establish a secure connection to that go through the hypervisor to DSP and obtain an attestation statement for example
So this is implicitly explicitly trusted, right?
So the SP as a firmware if the firmware has a buck you could potentially exploit it and so forth
Okay, okay
So so yeah in in the case of a confidential VM
Depending on the hardware you essentially can verify
You you create measurements of the entire boot chain
So it's similar to a TPM case
Like a measured boot where you have a statement of the initial memory layout the firmware and then a statement of all the other
Components in the boot chain and the statement just says this was was this is an isolated
VM this was the boot chain and this is signed by AMD and this is what you get
So the VM is okay, but what about process runtime?
Yeah
Yeah, so from process space exactly so the
Your your untrusted host
Creates the creates the process loads the memory pages and then says okay. I'm done
and then
secure processor that's part of the CPU will create a hash over those pages and
Compare that to the to the expected measurement that's signed by you as the author of the of the enclave
so you sign your crew you when you build an enclave you
essentially build the the expected memory layout you sign that and part of the attestation statement is always this measurement of the
of the initial memory layout plus your signature
Yeah, I mean yeah, that's part of why you why you why you can say this is a more
This is a bit more fuzzy in terms of what the attestation attestation statement says right
Potentially you can anything that happens after this boot and modifying the memory layout
Modifying what's what's running there? You can only derive from the initial statement
So what people do is they'd use a read-only file system a
Mutable image this kind of stuff to make it more locked down
For example, if you just want Mariah to be you could bring this to a microkernel that just is able to run a
Mariah to be container for example
Still there's a lot of things that can happen at runtime, but trying to to minimize the TCP or the truss duty base. Yeah, yeah, I mean
If you can derive all the states you will end up in from the from the initial state you would have perfect
Verification, but this is not feasible of course
The main memory if you if you're referring to caches, I'm not sure which cache
Yes
So in the confidential VM case anything of that VM right from the from the firmware layer upwards anything
That's above the hypervisor for for the process space anything. That's part of the process
Yeah for process based
With the latest generation, I think it's like around like 10%
Something like that the bigger problem in other contexts, which is by far for the right-hand side
AMD
That the measurements and I think they are but around worst case like four to eight percent
What
Well, what kind of instructions do you use to switch the context to use the ring zero what exactly
What are the
instructions that you actually need
Yeah, so on a process base what will just happen if let's say you do a right syscall the
You will the process of a little trap you will have an interrupt and it will automatically
Save your your your registers your state encrypted and then clear those registers
There were some problems in the past but clear the rules registers and go to to to to a kernel space
And yeah for the for the VM
There are some they both have additional instructions for doing those confidential computing specifics like getting a remote attestation statement or
For the confidential VM connecting through the secure processor, there's an instruction set addition
You