Processing device, processing method, and program

Abstract

A processing device 10 provides an isolated environment for processing data by processing logic in accordance with a policy. The processing device 10 includes an attestation report generation unit 122 that, following generating the isolated environment, verifies the isolated environment at a verification timing after initialization of the isolated environment and after the execution of processing of the data in the isolated environment, and generates report data including results of the verification. An attestation report includes a hash value of an attestation report from a preceding time.

Description

Processing device, processing method, and program

[0001] The present disclosure relates to a processing device, a processing method, and a program.

[0002] A data sandbox is an isolated environment created using a technology called Trusted Execution Environment (TEE), where data and processing logic are placed and processed within the isolated environment. In the isolated environment, memory areas are encrypted, allowing programs to be executed in a secure state isolated from other programs running on the same system.

[0003] By using an attestation report signed by a hardware module, which is the root of trust, a user can verify whether or not the configuration information of the isolated environment has been tampered with (Non-Patent Document 1).

[0004] Jeremy Powell, “AMD SEV-SNP Attestation: Establishing Trust in Guests,” Advanced Micro Devices, Inc., Sep. 2022, Internet〈https: / / www.amd.com / content / dam / amd / en / documents / developer / lss-snp-attestation.pdf〉

[0005] By including in the attestation report the hash value (verification information) of the information required for data sandbox execution, which is not included in the attestation report provided by the CPU manufacturer, it is possible to verify that the permitted data and processing logic are combined within the isolated environment.

[0006] The current attestation function obtains an attestation report that can verify whether or not there has been tampering at each timing based on an attestation report request from the user. Therefore, there is a problem in that even if a process that differs from the agreed conditions is performed in the data sandbox between the timing of generating an arbitrary attestation report, it cannot be detected. For example, even if a platform provider has malicious intent and performs some process between the timing of generating an arbitrary attestation report, the user cannot detect the event just by looking at the attestation report.

[0007] The present disclosure has been made in view of the above, and aims to make it possible to verify that no state change has occurred between the times when an attestation report is generated.

[0008] A control device according to one aspect of the present disclosure includes an isolated environment execution unit that provides an isolated environment in which data is processed using processing logic in accordance with a policy, and a report generation unit that verifies the isolated environment at a verification timing and generates report data including the results of the verification, wherein the report data includes a unique value related to the previous report data.

[0009] A control method of one aspect of the present disclosure provides an isolated environment in which a computer processes data using processing logic in accordance with a policy, verifies the isolated environment at a verification timing, and generates report data including the results of the verification, wherein the report data includes a unique value related to the previous report data.

[0010] According to the present disclosure, it is possible to verify that no state change has occurred between the times when the attestation report is generated.

[0011] FIG. 1 is a diagram showing an example of the configuration of a processing system. FIG. 2 is a flowchart showing an example of the processing flow of a processing device. FIG. 3 is a diagram for explaining an outline of an attestation report chain. FIG. 4 is a diagram showing an example of the contents of an attestation report. FIG. 5 is a sequence diagram showing an example of processing for arranging data and processing logic. FIG. 6 is a diagram showing an example of the hardware configuration of a processing device.

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0013] FIG. 1 is a diagram showing an example of the configuration of a processing system 1 including a processing device 10 according to this embodiment. The processing system 1 places data provided by a data provider and processing logic (also called a processing program, processing algorithm, or processing function) provided by a processing logic provider in an isolated environment (also called an isolated execution environment, TEE, or data sandbox) generated by an isolated environment generation unit 121. Within the isolated environment, the data is processed by the processing logic in accordance with execution rules (also called policies). The processing system 1 provides the data user with the resulting data obtained by processing the data by the processing logic. After the data is processed by the processing logic and the resulting data is extracted, the isolated environment generation unit 121 discards the isolated environment along with the data and processing logic. Hereinafter, the data provider, processing logic provider, and data user will also be referred to as users.

[0014] The data provider, processing logic provider, and data user agree on what data will be processed by what processing logic. The data provider, processing logic provider, and data user may each be different users, or some users may play multiple roles.

[0015] The details of the agreement are included in the execution rules, which include, for example, what data will be analyzed, what processing logic will be used, the number of times the analysis will be performed, the period, the type of execution environment, and the period until the data will be deleted.

[0016] The processing system 1 shown in FIG. 1 includes a processing device 10 and a client application 30 .

[0017] The client application 30 provides a user with access to the processing device 10. For example, the client application 30 receives execution rules, data, and processing logic from the user and forwards them to the processing device 10, and obtains public keys, result data, and attestation reports from the processing device 10 and forwards them to the user.

[0018] The processing device 10 includes an isolated environment management unit 11 and an isolated environment execution unit 12 .

[0019] The remote environment management unit 11 instructs the remote environment execution unit 12 to generate and initialize a remote environment, and places data, processing logic, execution rules, and the like in the remote environment.

[0020] The remote environment execution unit 12 includes functional units including a remote environment generation unit 121, an attestation report generation unit 122, and a storage unit 123. The remote environment generation unit 121 generates a remote environment in which the memory area is encrypted using the TEE function of the CPU hardware in the storage unit 123. The attestation report generation unit 122 verifies the remote environment at the verification timing and generates an attestation report including the verification result. The storage unit 123 stores the remote environment, the attestation report, etc.

[0021] Next, the operation of the processing device 10 will be described with reference to the flowchart of Fig. 2. When an agreement is reached between users, execution rules based on the agreement are input from the client application 30 to the processing device 10, and the processing shown in the flowchart of Fig. 2 is executed.

[0022] In step S11, the remote environment management unit 11 instructs the remote environment generation unit 121 to generate a remote environment based on the input execution rule. The remote environment generation unit 121 constructs a virtual machine (VM) or a container in the storage unit 123 based on the execution rule. The execution rule may include information for generating a remote environment, information on the data and processing logic to be multiplied, and other conditions.

[0023] In step S12, the attestation report generating unit 122 generates attestation report 1 when generating the isolated environment and stores it in the storage unit 123. Attestation report 1 is a report for certifying the reliability of the isolated environment, such as a container image.

[0024] In step S13, the remote environment management unit 11 initializes the remote environment. The initialization of the remote environment involves placing execution rules in the remote environment and generating a public key / private key pair in the remote environment. The public key is used to securely place data and the like in the remote environment.

[0025] In step S14, after initializing the isolated environment, the attestation report generation unit 122 generates attestation report 2 including the hash value of the execution rule, the hash value of the public key, and the hash value of the previous attestation report 1, and stores it in the memory unit 123.

[0026] Once the isolation environment has been initialized, each user obtains the public key generated in the isolation environment and attestation reports 1 and 2 via the client application 30. Using attestation report 1, each user can verify that the container image in the isolation environment is correct. Using attestation report 2, each user can verify that the execution rules deployed in the isolation environment and the obtained public key are correct. Furthermore, it can be verified that no unintended processing has occurred between attestation report 1 and attestation report 2.

[0027] In step S15, each user places data and processing logic in the remote environment via the remote environment management unit 11. By using a public key, data and processing logic can be safely placed in the remote environment.

[0028] In step S16, the remote environment processes the data using the processing logic in accordance with the execution rules and stores the resulting data in the storage unit 123. The remote environment management unit 11 may obtain the resulting data from the storage unit 123 and store it in an external storage device prepared by the user. The remote environment may obtain a key for encrypting the resulting data from the data user and encrypt the resulting data. This allows only the data user to use the resulting data.

[0029] In step S17, immediately after executing the processing logic, the attestation report generation unit 122 generates attestation report 3 including the data, processing logic, and hash values ​​of the result data, as well as the hash value of the previous attestation report 2, and stores it in the memory unit 123.

[0030] When processing in the isolated environment is complete, each user accesses the storage unit 123 via the client application 30 and obtains the result data and attestation report 3. Each user obtains the hash value of the result data from the isolated environment via the client application 30, and can verify that the hash value is correct using attestation report 3, and then verify that the result data and the data and processing logic used in the processing are correct. Furthermore, it can be verified that no unintended processing has occurred between attestation report 2 and attestation report 3.

[0031] Next, the attestation report will be described.

[0032] As shown in Figure 3, an attestation report contains the hash value of the previous attestation report, chaining the previous and subsequent attestation reports. Each user can verify that no status changes have occurred between the previous attestation report and the current report by calculating the hash value of the previous attestation report and comparing it with the hash value contained in the attestation report. In addition, each attestation report contains a signature from the manufacturer of the hardware, such as the CPU, which allows verification that the attestation report was created using the functions of the legitimate hardware manufacturer.

[0033] FIG. 4 shows an example of the contents and uses of each attestation report.

[0034] Attestation Report 1 is an attestation report generated when an isolation environment is created. Attestation Report 1 includes the initial hash value (0-padding) and the hash value of information about the VM / container determined at startup. Attestation Report 1 can be used to verify that the isolation environment (e.g., container image) is correct.

[0035] Attestation report 2 is an attestation report generated when the isolation environment is initialized. Attestation report 2 includes the hash value of attestation report 1, the hash values ​​of the execution rules and the public key. Attestation report 2 can be used to verify that the execution rules and the public key are correct.

[0036] Attestation Report 3 is an attestation report generated immediately after data processing. Attestation Report 3 includes the hash value of Attestation Report 2, the data immediately after processing, the processing logic, and the hash value of the result data. Attestation Report 3 allows verification of the state immediately after data processing.

[0037] The user area of ​​the attestation report of SEV-SNP in Non-Patent Document 1 is 512 bits. The second and subsequent attestation reports include a hash value for chaining attestation reports and verification information for each stage, with future expansion area reserved. Therefore, a 256-bit hash value is used for the verification information, and the remaining area is used as a hash value for chaining attestation reports and an expansion area. Because there is a connection between the previous and next attestation reports, it is virtually impossible to forge a hash value that conflicts with the verifiable previous and next attestation reports.

[0038] In addition to the ability to verify in advance that the isolated environment is safe, the system also leaves behind a trail of actual processing that cannot be tampered with, giving the isolated environment auditability and traceability.

[0039] Next, an example of a process for arranging data and processing logic will be described with reference to the sequence diagram in Fig. 5. In the example of Fig. 5, the processing logic and data are arranged in the isolated environment in that order, and the data is processed by the processing logic. The data may also be arranged in the isolated environment in that order.

[0040] In step S101, the client application 30 instructs the processing device 10 to generate and initialize a remote environment. The attestation report generation unit 122 generates attestation report 1 when the remote environment is generated, and generates attestation report 2 when the remote environment is initialized.

[0041] In step S102, the processing logic provider receives attestation reports 1 and 2 from the processing system 1 and verifies whether the isolated environment is correct and whether the policies (execution rules) placed in the isolated environment are correct. Each user receives a public key generated in the isolated environment and verifies the validity of the public key using the information included in attestation report 2, but this is not described here.

[0042] After verification using the attestation report, in step S103, the processing logic provider places the processing logic in an isolated environment.

[0043] In step S104, the data provider receives the attestation reports 1 and 2 from the processing system 1 and verifies whether the isolated environment is correct and whether the policy deployed in the isolated environment is correct.

[0044] After verification using the attestation report, in step S105, the data provider places the data in an isolated environment.

[0045] In step S106, the data user receives the attestation reports 1 and 2 from the processing system 1 and verifies whether the isolated environment is correct and whether the policy deployed in the isolated environment is correct.

[0046] After verification using the attestation report, in step S107, the data user places a key for encrypting the result data in the isolated environment and executes data processing using the processing logic. The isolated environment processes the data using the processing logic and encrypts the result data with the key placed by the data user. The attestation report generation unit 122 generates attestation report 3, which includes the hash value of attestation report 2, the data immediately after processing, the processing logic, and the hash value of the result data.

[0047] In step S108, the processing device 10 transmits the encrypted result data to the data user. The data user decrypts the result data and utilizes it. The processing device 10 may transmit the result data and an attestation report 3. The data user can verify the attestation report 3 to verify that the data has been processed by the processing logic in accordance with the policy.

[0048] Each user can receive an attestation report 3 from the processing system 1 and verify that the data has been processed by the processing logic in accordance with the policy. Each user can receive a series of attestation reports 1, 2, and 3 and verify that no tampering has occurred during the series of processes.

[0049] As described above, the processing device 10 of this embodiment provides an isolated environment in which data is processed using processing logic in accordance with a policy. The processing device 10 includes an attestation report generation unit 122 that verifies the isolated environment at verification timings after the isolated environment is generated, after the isolated environment is initialized, and after data processing is executed in the isolated environment, and generates report data including the verification results. The attestation report includes a hash value of the previous attestation report. This makes it possible to verify that no state changes have occurred between the times when the attestation report was generated. Furthermore, it is possible to trace the order in which the processes were performed, ensuring reproducibility.

[0050] The processing device 10 described above can be, for example, a general-purpose computer system including a central processing unit (CPU) 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 6. In this computer system, the processing device 10 is realized by the CPU 901 executing a predetermined program loaded onto the memory 902. This program can be recorded on a computer-readable non-transitory recording medium such as a magnetic disk, an optical disk, or a semiconductor memory, or can be distributed via a network.

[0051] REFERENCE SIGNS LIST 1 Processing system 10 Processing device 11 Isolated environment management unit 12 Isolated environment execution unit 121 Isolated environment generation unit 122 Attestation report generation unit 123 Storage unit 30 Client application

Claims

1. A processing device comprising: an isolated environment execution unit that provides an isolated environment in which data is processed using processing logic in accordance with a policy; and a report generation unit that verifies the isolated environment at a verification timing and generates report data including the results of the verification, wherein the report data includes a unique value related to the previous report data.

2. The processing device according to claim 1, wherein the unique value is a hash value of the previous report data.

3. A processing device according to claim 1, wherein the verification timing is after the isolated environment is generated, after the isolated environment is initialized, and after data processing is executed in the isolated environment.

4. A processing device according to claim 3, wherein the verification timing is when the data is placed in the isolated environment and when the processing logic is placed in the isolated environment.

5. A processing device according to claim 3, wherein the initialization of the isolated environment involves inputting the policy and generating a key.

6. A processing method in which a computer provides an isolated environment in which data is processed using processing logic in accordance with a policy, verifies the isolated environment at a verification timing, and generates report data including the results of the verification, the report data including a unique value related to the previous report data.

7. A program for causing a computer to operate as each part of the processing device according to any one of claims 1 to 5.

Images