机密计算

借助Confidential Computing技术，可以使用基于硬件的可信执行环境 (TEE) 来保护使用中的数据，这种环境提供更高的安全级别来确保数据完整性、数据机密性和代码完整性。

1. SUSE Multi-Linux Manager 的Confidential Computing

TEE 的可信度已通过认证流程进行检查。SUSE Multi-Linux Manager 可用作其中已注册系统的认证服务器。它会针对此模式下运行的系统生成报告页面。需要定期对这些系统进行认证和检查。还可以存储并按请求提供以往的检查历史记录。

Confidential Computing认证取决于所用的硬件以及要认证的系统运行所在的环境。

Confidential Computing Attestation is only available when SUSE Multi-Linux Manager is running on x86-64 architecture.

2. 要求

可以在具有以下特征的环境中设置Confidential Computing：

  • Attested system (virtual machine) is bootstrapped to SUSE Multi-Linux Manager and runs on one of the following systems:

    • SUSE Linux Enterprise 15 SP6

    • SUSE Linux Enterprise 15 SP7

    • SUSE Linux Enterprise 16

    • openSUSE Leap 15 SP6

    • openSUSE Leap 15 SP7

    • openSUSE Leap 16

  • Hardware must have one of the following CPUs:

    • AMD EPYC Milan

    • AMD EPYC Genoa

    • AMD EPYC Bergamo

    • AMD EPYC Siena

    • AMD EPYC Turin

    • IBM z16

    • IBM z17

  • 必须将 BIOS 配置为允许Confidential Computing认证

  • Host OS and the virtualization software (KVM and libvirt) must support Confidential Computing

  • For information about required URLs when performing confidential computing attestation for IBM, see see Required URLs.

3. 限制

Secure boot is attested. However, currently KVM secure boot and AMD attestation tool snpguest are not working together.

4. 使用 SUSE Multi-Linux Manager 中的Confidential Computing

有关在主机上设置和配置Confidential Computing的具体步骤，请参见操作系统供应商文档。
过程：在安装 SUSE Multi-Linux Manager 期间启用认证容器

  1. The attestation container is enabled during the installation of SUSE Multi-Linux Manager with mgradm install podman.

  2. Add the following to file mgradm.yaml.

    coco:
    replicas: 1
过程：在安装 SUSE Multi-Linux Manager 之后启用认证容器

  1. To enable the attestation container after the installation, use the command line parameter mgradm.

  2. 运行命令

    mgradm scale uyuni-server-attestation --replicas 1
过程：在安装 SUSE Multi-Linux Manager 后禁用认证容器

  1. 要禁用已启用的认证容器，请运行以下命令：

    mgradm scale uyuni-server-attestation --replicas 0
过程：启用认证

  1. 对于选定的系统，转到选项卡审计  机密计算  设置。

  2. 通过选择切换按钮来启用认证。

  3. In the field Environment Type select the correct option from the drop-down list.

  4. If the field Environment Type is set to one of the IBM z-series CPU values, two more settings are required, Host Key Document and Secure Execution Header.

    Host Key Document is a public key certificate of the IBM hypervisor server instance where the attested system is going to run.

    Secure Execution Header is a binary file needed to build the IBM secure VM image of the attested system.

    Both files should be requested by the administrator creating the attested system VM running on the IBM hypervisor.

    Host Key Document and Secure Execution Header are not security sensitive, therefore it is safe to store them on the SUSE Multi-Linux Manager server.

  5. 单击 保存 按钮保存更改。

过程：安排新认证

  1. 对于选定的系统，转到选项卡审计  机密计算  列出认证。

  2. 单击 安排认证。此时会打开新窗体。

  3. In the field Earliest select the time of running the attestation.

  4. If needed, add the newly created attestation to the action chain by selecting Add to option.

  5. 单击 日程安排 保存新认证并安排其执行。

过程：从“系统细节”界面查看认证报告

  1. 对于选定的系统，转到选项卡审计  机密计算  列出认证。

  2. 查找并选择要查看的报告。

  3. After clicking the selected attestation report tab Overview will open.

    1. If the selected CPU is AMD you will be shown additional tabs SEV-SNP and Secure boot.

    2. If the selected CPU is IBM you will be shown additional tab IBM SELPVATTEST.

过程：从“审计”界面查看认证报告

  1. 从导航栏中选择审计  机密计算。

  2. 所有认证的列表将显示在主面板中。

  3. 查找并选择要查看的报告。

4.1. 报告状态

认证报告处于下列状态之一：

待处理

这是已安排的认证的默认状态。报告仍不可用，原因是认证过程尚未开始或完成。

成功

When the scheduled attestation creates a report which can be viewed, the status of the process is Successful.

失败

When the scheduled fails and does not create a report as a result, the status of the process is Failed.

5. 相关主题

有关 Confidential Computing 的详细信息，请参见此处。