Service providing system, service providing method, enclave program, and user program

Abstract

A service providing system (10) for providing a user system (30) with a service utilizing a container (28) executed on a cloud system (20) comprises: a memory (12); hardware (13) that, by causing an enclave program (17) to run in a trusted execution environment constructed on the memory (12), generates an authentication key for authenticating the container (28), generates or acquires measurement values relating to a container image, a program group including a program for executing the container (28), and a program group including the enclave program (17) as measurement values to be collated respectively by the user system (30), and generates an electronic signature for the authentication key and the measurement values; and an interface (14) that provides the user system (30) with the authentication key, the measurement values, and the electronic signature.

Description

Service providing system, service providing method, enclave program, and user program

[0001] The present disclosure relates to a service providing system, a service providing method, an enclave program, and a user program.

[0002] Non-Patent Document 1 discloses CoCo. "CoCo" is an abbreviation for Confidential Containers. CoCo provides a method for service providers who deploy containers to safely deploy containers without having to trust cloud providers.

[0003] “Confidential Containers”, [online], GitHub, Inc., [Retrieved August 9, 2024], Internet <URL: https: / / github.com / confidential-containers>

[0004] There are known services that manage personal information on cloud systems, such as digital identity wallet services. Simply using CoCo for such services requires users to trust the service provider.

[0005] The purpose of the present disclosure, made in consideration of these circumstances, is to enable users to safely use services such as digital identity wallet services without having to trust the service providers.

[0006] a trusted execution environment constructed on the memory; and an authentication key used by the user system to authenticate the container by running an enclave program in the trusted execution environment constructed on the memory; generating a measurement value related to a container image used on the cloud system to execute the container as a first measurement value to be checked by the user system; obtaining a measurement value related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system to execute the container as a second measurement value to be checked by the user system; generating a measurement value related to a group of programs including the enclave program as a third measurement value to be checked by the user system; hardware that generates electronic signatures for the authentication key, the first measurement value, the second measurement value, and the third measurement value; and an interface that provides the authentication key, the first measurement value, the second measurement value, the third measurement value, and the electronic signature to the user system.

[0007] a trusted execution environment constructed on the memory by the hardware; and an enclave program running on the memory by the hardware, thereby generating an authentication key to be used by the user system to authenticate the container; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be checked by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system to execute the container as second measurement values ​​to be checked by the user system; generating measurement values ​​related to a group of programs including the enclave program as third measurement values ​​to be checked by the user system; generating digital signatures for the authentication key, the first measurement value, the second measurement value, and the third measurement value by the hardware; and providing the authentication key, the first measurement value, the second measurement value, the third measurement value, and the digital signature to the user system via an interface.

[0008] An enclave program according to one embodiment is an enclave program that operates in a trusted execution environment constructed on memory by hardware, and causes a computer having the memory and the hardware to perform operations including: generating an authentication key to be used by a user system receiving a service utilizing the container to authenticate a container executed on a cloud system; generating measurement values ​​relating to a container image used on the cloud system to execute the container as first measurement values ​​to be checked by the user system; obtaining measurement values ​​relating to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system and executes the container as second measurement values ​​to be checked by the user system; generating measurement values ​​relating to a group of programs including the enclave program as third measurement values ​​to be checked by the user system; and causing the hardware to generate electronic signatures for the authentication key, the first measurement values, the second measurement values, and the third measurement values.

[0009] A user program according to one embodiment causes a computer to perform operations including: obtaining an authentication key for authenticating a container executed on a cloud system from a service providing system that provides a service utilizing the container; obtaining, from the service providing system, measurement values ​​relating to a container image used on the cloud system to execute the container, measurement values ​​relating to a group of programs including a program that runs in a trusted execution environment constructed on the cloud system to execute the container, and measurement values ​​relating to a group of programs including an enclave program that runs in a trusted execution environment constructed in the memory of the service providing system by hardware of the service providing system; obtaining, from the service providing system, electronic signatures generated by the hardware for the authentication key and the measurement values; obtaining, from a repository, comparison values ​​for comparing each of the measurement values; verifying the electronic signature and comparing each of the measurement values ​​with reference to the comparison values, and then authenticating the container using the authentication key.

[0010] According to the present disclosure, users can safely use services such as digital identity wallet services without having to trust the service providers.

[0011] FIG. 1 is a block diagram showing the configuration of a system group according to an embodiment. FIG. 1 is a diagram showing the contents of CVMAR. FIG. 2 is a diagram showing the contents of RPAR. FIG. 2 is a sequence diagram showing the operation of each system. FIG. 3 is a sequence diagram showing the operation of each system. FIG. 3 is a sequence diagram showing the operation of each system. FIG. 4 is a sequence diagram showing the operation of each system. FIG. 4 is a block diagram showing the configuration of a system group according to a modified example. FIG. 4 is a diagram showing the contents of RPAR. FIG. 4 is a diagram showing the contents of SH. FIG. 4 is a sequence diagram showing the operation of each system. FIG. 5 is a sequence diagram showing the operation of each system.

[0012] An embodiment will be described below with reference to the drawings.

[0013] In each drawing, the same or corresponding parts are denoted by the same reference numerals. In the description of this embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate.

[0014] The configuration of the system group according to this embodiment will be described with reference to FIG.

[0015] The service providing system 10, the cloud system 20, and the user system 30 can communicate with each other via a network. The network may include, for example, the Internet, at least one WAN, at least one MAN, or any combination thereof. "WAN" is an abbreviation for wide area network. "MAN" is an abbreviation for metropolitan area network. The network may include at least one wireless network, at least one optical network, or any combination thereof. The wireless network may be, for example, an ad hoc network, a cellular network, a wireless LAN, a satellite communication network, or a terrestrial microwave network. "LAN" is an abbreviation for local area network.

[0016] The service providing system 10 is a system operated by a service operator 11. The service providing system 10 provides a service that utilizes a container 28 running on a cloud system 20, such as a digital identity wallet service, to a user system 30.

[0017] The service providing system 10 includes one or more computers, such as a server. The service providing system 10 may also include one or more terminals used by the service operator 11, such as a smartphone, a tablet, or a PC. "PC" is an abbreviation for personal computer.

[0018] The service providing system 10 includes a memory 12 , hardware 13 , and an interface 14 .

[0019] The memory 12 includes at least one semiconductor memory. The semiconductor memory is, for example, a RAM, a ROM, or a flash memory. "RAM" is an abbreviation for random access memory. "ROM" is an abbreviation for read only memory. The RAM is, for example, an SRAM or a DRAM. "SRAM" is an abbreviation for static random access memory. "DRAM" is an abbreviation for dynamic random access memory. The ROM is, for example, an EEPROM. "EEPROM" is an abbreviation for electrically erasable programmable read only memory. The flash memory is, for example, an SSD. "SSD" is an abbreviation for solid-state drive. The memory 12 functions, for example, as a main memory device, an auxiliary memory device, or a cache memory.

[0020] The hardware 13 includes at least one processor. The processor is, for example, a CPU or GPU that supports TEE. "TEE" is an abbreviation for trusted execution environment. "CPU" is an abbreviation for central processing unit. "GPU" is an abbreviation for graphics processing unit.

[0021] The hardware 13 constructs a reliable execution environment on the memory 12. The hardware 13 runs an enclave program 17 in the reliable execution environment constructed on the memory 12. The enclave program 17 is a program that executes various services required for processing, which will be described later, such as a key management service, a key broker service, and an attestation service.

[0022] Specifically, the hardware 13 runs firmware 15, such as a hypervisor, that supports virtualization on the memory 12. The hardware 13 uses the firmware 15 to run a secure virtual machine 16, including a TEE, on the memory 12. The hardware 13 runs an enclave program 17 in the TEE within the secure virtual machine 16. The enclave program 17 executes various services.

[0023] The interface 14 includes at least one communication module. The communication module is, for example, a module compatible with a wired LAN communication standard such as Ethernet (registered trademark), a wireless LAN communication standard such as IEEE 802.11, or a mobile communication standard such as LTE, 4G standard, or 5G standard. "IEEE" is an abbreviation for the Institute of Electrical and Electronics Engineers. "LTE" is an abbreviation for Long Term Evolution. "4G" is an abbreviation for 4th generation. "5G" is an abbreviation for 5th generation.

[0024] The interface 14 may be provided in the same computer as the memory 12 and the hardware 13, but in this embodiment, it is provided in a computer separate from the memory 12 and the hardware 13. For example, the interface 14 is provided in a web server accessible from the user system 30. Alternatively, the interface 14 may be provided in a terminal used by the service operator 11.

[0025] The cloud system 20 is a system operated by a cloud operator 21. The cloud system 20 executes a container 28.

[0026] The cloud system 20 includes one or more computers, such as servers, and may also include one or more terminals used by the cloud operator 21, such as smartphones, tablets, or PCs.

[0027] The cloud system 20 includes a memory 22 , hardware 23 , and a persistent volume 24 .

[0028] The memory 22 includes at least one semiconductor memory. The semiconductor memory is, for example, a RAM, a ROM, or a flash memory. The RAM is, for example, an SRAM or a DRAM. The ROM is, for example, an EEPROM. The flash memory is, for example, an SSD. The memory 22 functions as, for example, a main storage device, an auxiliary storage device, or a cache memory.

[0029] The hardware 23 includes at least one processor, which may be, for example, a CPU or GPU that supports TEE.

[0030] The hardware 23 builds a trusted execution environment on the memory 22. The hardware 23 runs an enclave program 27 in the trusted execution environment built on the memory 22. The enclave program 27 is a program that executes a container 28.

[0031] Specifically, the hardware 23 runs firmware 25 that supports virtualization, such as a hypervisor, on the memory 22. The hardware 23 uses the firmware 25 to run a secure virtual machine 26 that includes a TEE on the memory 22. The hardware 23 runs an enclave program 27 in the TEE within the secure virtual machine 26. The enclave program 27 executes a container 28.

[0032] A persistent volume 24 is storage that holds data used by a container 28, data generated by a container 28, or both.

[0033] The user system 30 is a system used by a user 31. The user system 30 receives services that utilize a container 28, such as a digital identity wallet service, from the service providing system 10.

[0034] The user system 30 includes one or more terminals used by a user 31, such as a smartphone, a tablet, or a PC.

[0035] The container image repository 40 is a repository accessible from the cloud system 20. The container image repository 40 is, for example, a database that allows version management of registered data.

[0036] The open repository 50 is a repository that can be accessed from the user system 30. The open repository 50 is, for example, a database that allows version management of registered data.

[0037] Hereinafter, the hardware 23 of the cloud system 20 will also be referred to as "HW1." The firmware 25 that runs on the memory 22 of the cloud system 20 will also be referred to as "FW1." The enclave program 27 that runs in a trusted execution environment built on the memory 22 by the HW1 will also be referred to as "SW1."

[0038] Similarly, the hardware 13 of the service providing system 10 is also referred to as "HW2." The firmware 15 that runs on the memory 12 of the service providing system 10 is also referred to as "FW2." The enclave program 17 that runs in a trusted execution environment built on the memory 12 by HW2 is also referred to as "SW2."

[0039] 1 to 3, the operation that SW2 causes the computer of the service providing system 10, which includes the memory 12 and HW2, to execute will be described.

[0040] The operations that SW2 causes the computer to execute include the following steps 1-1 to 1-5.

[0041] 1-1. Generate an authentication key CPK to be used by the user system 30 to authenticate the container 28.

[0042] 1-2. Measurement values ​​related to a container image CI used on the cloud system 20 to execute a container 28 are generated as first measurement values ​​MC to be collated by the user system 30. In this embodiment, the first measurement values ​​MC are hash values ​​of the container image CI, but may be other values ​​measured related to the container image CI. In this embodiment, the container image CI is acquired from a computer having the interface 14.

[0043] 1-3. Measurement values ​​related to the group of programs including SW1 are acquired as second measurement values ​​ME to be verified by the user system 30. In this embodiment, the second measurement values ​​ME are values ​​calculated in the TEE from binary information of the group of programs including FW1 and SW1. More specifically, the second measurement values ​​ME are values ​​obtained by measuring the state of the memory 22 and the virtual CPU as hash values ​​when the group of programs is deployed in the isolated area. However, other values ​​measured related to the group of programs may also be used. The "other values" may be, for example, hash values ​​of program files including FW1 and SW1, or hash values ​​of program files including only SW1, or hash values ​​of source files including FW1 and SW1, or hash values ​​of source files including only SW1. In this embodiment, a CVMAR including the second measurement values ​​ME, as shown in FIG. 2, is acquired from the cloud system 20. In addition to the second measurement values ​​ME, the CVMAR includes the SW1 public key and digital signatures for the second measurement values ​​ME and the SW1 public key. The HW1 stores a private key corresponding to the public key used by the SW2 to verify the digital signature, and the HW1 uses the private key to generate a digital signature for the second measurement ME and the SW2 public key.

[0044] 1-4. A measurement value for the group of programs including SW2 is generated as a third measurement value MR to be collated by the user system 30. In this embodiment, the third measurement value MR is a value calculated in the TEE from the binary information of the group of programs including FW2 and SW2. More specifically, it is a value obtained by measuring the state of the memory 12 and the virtual CPU as a hash value when the group of programs is deployed in the isolated area, but it may also be another value measured for the group of programs. The "other value" may be, for example, a hash value of the program file including FW2 and SW2, or a hash value of the program file including only SW2, or a hash value of the source file including FW2 and SW2, or a hash value of the source file including only SW2.

[0045] 1-5. HW2 generates a digital signature for the authentication key CPK, the first measurement value MC, the second measurement value ME, and the third measurement value MR. In this embodiment, HW2 generates an RPAR including the third measurement value MR, as shown in FIG. 3 . In addition to the third measurement value MR, the RPAR includes a hash value H of the authentication key CPK, the first measurement value MC, and the second measurement value ME, and a digital signature for the third measurement value MR and the hash value H. HW2 previously stores an HW2 private key corresponding to the HW2 public key used by the user system 30 to verify the digital signature. HW2 uses the HW2 private key to generate a digital signature for the third measurement value MR and the hash value H.

[0046] Steps 1-1 to 1-4 do not have to be performed in numerical order, but may be performed in parallel or in a different order.

[0047] In this embodiment, the authentication key CPK is a public key. In step 1-1, a secret key CSK corresponding to the authentication key CPK is generated along with the authentication key CPK. The operations that SW2 causes the computer to execute further include the following steps 1-6 and 1-7.

[0048] 1-6. Insert the private key CSK into the container image CI to generate a keyed image CCI.

[0049] 1-7. The keyed image CCI is encrypts using an encryption key CE shared with the cloud system 20 to generate an encrypted image ECCI to be registered in the container image repository 40. In this embodiment, the encrypted image ECCI is registered in the container image repository 40 by a computer including the interface 14, but may also be registered in the container image repository 40 by a computer including the memory 12 and HW2. In this embodiment, SW1 causes a computer including the memory 22 and HW1 in the cloud system 20 to perform operations including the steps of obtaining the encrypted image ECCI from the container image repository 40, decrypting the encrypted image ECCI using the encryption key CE, and executing the container 28 using the container image CI included in the keyed image CCI.

[0050] Steps 1-6 and 1-7 may be performed before, during, or after steps 1-1 to 1-5.

[0051] In this embodiment, the encryption key CE is a common key. The operations that SW2 causes the computer to execute further include the following steps 1-8 and 1-9.

[0052] 1-8. Generate a cryptographic key CE.

[0053] 1-9. After authenticating SW1 using the SW1 public key included in CVMAR, the encryption key CE is provided to SW1. In this embodiment, the encryption key CE is transmitted from the computer including the memory 12 and HW2 to the computer including the memory 22 and HW1.

[0054] Steps 1-8 are performed before steps 1-7. Steps 1-9 do not have to be performed before steps 1-7, and may be performed in parallel with steps 1-7 or after steps 1-7.

[0055] The authentication key CPK, the first measurement value MC, the second measurement value ME, the third measurement value MR, and the electronic signature are provided to the user system 30 via the interface 14. In this embodiment, the user system 30 obtains the RPAR including the authentication key CPK, the first measurement value MC, the second measurement value ME, and the third measurement value MR from a computer equipped with the interface 14.

[0056] 1 to 3, the operation that a user program running on the user system 30 causes the computer of the user system 30 to execute will be described.

[0057] The operations that the user program causes the computer to execute include the following steps 2-1 to 2-5.

[0058] 2-1. The authentication key CPK is obtained from the service providing system 10.

[0059] 2-2. The first measurement value MC, the second measurement value ME, and the third measurement value MR are acquired from the service providing system 10. In this embodiment, the third measurement value MR is acquired from the service providing system 10 as part of the RPAR.

[0060] 2-3. Digital signatures for the authentication key CPK, the first measurement value MC, the second measurement value ME, and the third measurement value MR are obtained from the service providing system 10. In this embodiment, the RPAR is obtained from the service providing system 10.

[0061] 2-4. A matching value MC' for matching the first measurement value MC, a matching value ME' for matching the second measurement value ME, and a matching value MR' for matching the third measurement value MR are obtained from the open repository 50.

[0062] 2-5. The electronic signature is verified, and each measurement value is verified with reference to the verification value, and then the container 28 is authenticated using the authentication key CPK. In this embodiment, the HW2 public key is acquired, and the electronic signature included in the RPAR is verified using the HW2 public key. The third measurement value MR included in the RPAR is verified with the verification value MR'. Then, a hash value H' of the authentication key CPK, the verification value MC', and the verification value ME' is calculated, and the hash value H included in the RPAR is verified with the hash value H'. If both are successful, the container 28 is authenticated using the authentication key CPK.

[0063] Steps 2-1 to 2-4 do not have to be performed in numerical order, but may be performed in parallel or in a different order.

[0064] The matched value MC', the matched value ME', and the matched value MR' are registered in advance in the open repository 50 via the interface 14. In this embodiment, the matched value MC', the matched value ME', and the matched value MR' are registered in the open repository 50 by a computer having the interface 14. The matched value ME' may also be provided to SW2 from the computer having the interface 14 so that SW2 can also compare the second measurement value ME.

[0065] The source code of the container image CI may be registered in advance in the open repository 50 via the interface 14 together with the matching value MC' or instead of the matching value MC'. If the user system 30 can obtain the source code of the container image CI from the open repository 50, it can more reliably verify that the container image CI has not been tampered with. The user system 30 may also independently generate the matching value MC' based on the source code of the container image CI.

[0066] The source code of SW1 may be registered in advance in the open repository 50 via the interface 14 together with the match value ME' or instead of the match value ME'. The source code of FW1 may also be registered in the open repository 50 via the interface 14. If the user system 30 can obtain the source code of SW1, or FW1 and SW1, from the open repository 50, it can more reliably verify that SW1, or FW1 and SW1, have not been tampered with. The user system 30 may independently generate the match value ME' based on the source code of SW1, or FW1 and SW1.

[0067] The source code of SW2 may be registered in advance in the open repository 50 via the interface 14 together with the matching value MR' or instead of the matching value MR'. The source code of FW2 may also be registered in the open repository 50 via the interface 14. If the user system 30 can obtain the source code of SW2, or FW2 and SW2, from the open repository 50, it can more reliably verify that SW2, or FW2 and SW2, have not been tampered with. The user system 30 may independently generate the matching value MR' based on the source code of SW2, or FW2 and SW2.

[0068] In this embodiment, when the container image CI, FW1, or SW1 is changed, at least steps 1-5 are executed again. That is, HW2 generates a new RPAR. Then, steps 2-2 to 2-5 are executed again.

[0069] Programs such as SW1, SW2, or user programs can be stored on a non-transitory computer-readable medium. Examples of non-transitory computer-readable media include flash memory, magnetic recording devices, optical disks, magneto-optical recording media, and ROMs. Programs are distributed by selling, transferring, or lending portable media such as SD cards, DVDs, or CD-ROMs that store the programs. "SD" is an abbreviation for Secure Digital. "DVD" is an abbreviation for digital versatile disc. "CD-ROM" is an abbreviation for compact disc read only memory. Programs may be distributed by storing them in server storage and transferring them from the server to other computers. Programs may also be provided as program products.

[0070] A computer temporarily stores a program stored on a portable medium or transferred from a server in its main storage device. The computer then reads the program stored in the main storage device with its processor and executes processing in accordance with the read program. The computer may also read the program directly from the portable medium and execute processing in accordance with the program. The computer may also execute processing in accordance with the received program each time a program is transferred from the server to the computer. Processing may also be executed using a so-called ASP-type service that realizes functions simply by issuing execution instructions and obtaining results, without transferring the program from the server to the computer. "ASP" is an abbreviation for application service provider. A program is information used for processing by a computer and includes something equivalent to a program. For example, data that is not a direct instruction to a computer but has properties that define computer processing falls under the category of "something equivalent to a program."

[0071] According to this embodiment, a confidential container service can be provided that can be used safely by the user 31 without trusting either the cloud service provider or the service provider, and whose safety can be verified. It is also possible to guarantee that the software cannot be tampered with. A system that communicates with the container 28 can verify that the container 28 is running in a TEE and that untampered, legitimate software is running.

[0072] In this embodiment, there are worker nodes on which the containers 28 run and a management node that starts and manages the containers 28. Because both the worker nodes and the management node have a TEE, the management node can verify that an unaltered container 28 runs on the TEE, and anyone, not just the user 31, can verify that the functions of the management node have not been tampered with. Verification of unaltered software is possible by verifying that the software is running on the TEE and by confirming that the measured values ​​of the software running match the published measured values. The private key of the container 28 can be a key used only within the container 28, rather than a key tied to TEE-compatible hardware.

[0073] The operation of each system according to this embodiment will be described with reference to Figures 4 to 10. The operation described below corresponds to the service providing method according to this embodiment.

[0074] FIG. 4 shows the procedure for setting a hardware key.

[0075] In S101, the interface 14 of the service providing system 10 acquires the HW1 public key from the hardware vendor. In S102, the interface 14 registers the HW1 public key in the SW2 code. In S103, the user system 30 acquires the HW2 public key from the hardware vendor.

[0076] 5 and 6 show the procedure for setting the matching value.

[0077] In S111, the interface 14 of the service providing system 10 transmits the measurement values ​​for the container image CI, the measurement values ​​for FW1 and SW1, and the measurement values ​​for FW2 and SW2 to the open repository 50 as the comparison value MC', the comparison value ME', and the comparison value MR', respectively. The interface 14 preferably further transmits the source code for the container image CI, FW1 and SW1, and FW2 and SW2 to the open repository 50. Then, it is preferable that a public review be conducted to confirm the functions and security requirements of each source code, as well as the correspondence between each source code and the comparison value. In S112, the open repository 50 accepts registration of the comparison value MC'. In S113, the open repository 50 accepts registration of the comparison value ME'. In S114, the open repository 50 accepts registration of the comparison value MR'.

[0078] In S121, HW1, which is the hardware 23 of the cloud system 20, uses FW1 to start the secure virtual machine 26. HW1 operates SW1 in a TEE within the secure virtual machine 26. In S122, SW1 generates a measurement value related to FW1 and SW1 as a second measurement value ME. In S123, HW2, which is the hardware 13 of the service providing system 10, uses FW2 to start the secure virtual machine 16. HW2 operates SW2 in a TEE within the secure virtual machine 16. In S124, SW2 generates a measurement value related to FW2 and SW2 as a third measurement value MR.

[0079] FIG. 7 shows the procedure for registering a container image.

[0080] In S131, the interface 14 of the service providing system 10 transmits the container image CI to SW2. In S132, SW2 generates a measurement value for the container image CI as a first measurement value MC. In S133, SW2 generates an encryption key CE. In S134, SW2 generates an authentication key CPK, which is a public key, and a private key CSK corresponding to the authentication key CPK. In S135, SW2 inserts the private key CSK into the container image CI to generate a keyed image CCI. In S136, SW2 encrypts the keyed image CCI using the encryption key CE to generate an encrypted image ECCI. SW2 transmits the encrypted image ECCI to the interface 14. In S137, the interface 14 registers the encrypted image ECCI in the container image repository 40.

[0081] 8 and 9 show the SW1 attestation procedure.

[0082] In S141, upon receiving the match value ME' from the interface 14 of the service providing system 10, SW2 sends an attestation request to SW1. In S142, SW1 causes HW1 to generate a CVMAR. As shown in FIG. 2, the CVMAR includes the second measurement value ME, the SW1 public key, and a digital signature for the second measurement value ME and the SW1 public key. SW1 sends the CVMAR to SW2. In S143, SW2 verifies the digital signature included in the CVMAR using the HW1 public key. In S144, SW2 compares the second measurement value ME included in the CVMAR with the match value ME'. In S145, SW2 authenticates SW1 using the SW1 public key included in the CVMAR. In S146, SW1 responds to the authentication using the SW1 private key. If the authentication is successful, an encrypted communication path is established between SW1 and SW2. In S147, SW2 transmits the encryption key CE to SW1 via the encrypted communication path.

[0083] In S151, SW1 obtains the encrypted image ECCI from the container image repository 40. In S152, SW1 decrypts the encrypted image ECCI using the encryption key CE. In S153, SW1 starts the container 28 using the container image CI included in the keyed image CCI. In S154, the container 28 notifies SW2 of the completion of the start-up. In S155, SW2 calculates a hash value H of the authentication key CPK, the first measurement value MC, and the second measurement value ME. In S156, SW2 causes HW2 to generate an RPAR. As shown in FIG. 3 , the RPAR includes a third measurement value MR, a hash value H, and digital signatures for the third measurement value MR and the hash value H. In S157, SW2 transmits the authentication key CPK, the first measurement value MC, the second measurement value ME, and RPAR to the interface 14 of the service providing system 10.

[0084] FIG. 10 shows the procedure for SW2 attestation.

[0085] In S161, the user system 30 requests the interface 14 of the service providing system 10 to use the container 28. In response to the request, the interface 14 transmits the authentication key CPK, the first measurement value MC, the second measurement value ME, and the RPAR to the user system 30. In S162, the user system 30 requests the match value MC', the match value ME', and the match value MR' from the open repository 50. In response to the request, the open repository 50 transmits the match value MC', the match value ME', and the match value MR' to the user system 30. In S163, the user system 30 verifies the electronic signature included in the RPAR using the HW2 public key. The user system 30 calculates a hash value H' of the authentication key CPK, the match value MC', and the match value ME'. The user system 30 compares the hash value H included in the RPAR with the hash value H'. In S164, the user system 30 compares the first measurement value MC with the comparison value MC'. In S165, the user system 30 compares the second measurement value ME with the comparison value ME'. In S166, the user system 30 compares the third measurement value MR included in the RPAR with the comparison value MR'. In S167, the user system 30 authenticates the container 28 using the authentication key CPK. In S168, the container 28 responds to the authentication using the private key CSK included in the keyed image CCI. If the authentication is successful, an encrypted communication path is established between the container 28 and the user system 30. Thereafter, the user system 30 can securely use services that utilize the container 28, such as digital identity wallet services, via the encrypted communication path.

[0086] In this embodiment, the above-described operations allow the user 31 to safely use services such as a digital identity wallet service without having to trust the service provider.

[0087] A modification of this embodiment will now be described.

[0088] 11 to 13, the operation that SW2 causes the computer of the service providing system 10, which includes the memory 12 and HW2, to execute will be described.

[0089] The operation that SW2 causes a computer to execute includes steps 1-1 to 1-9, but in step 1-5, an RPAR such as that shown in FIG. 12 is generated. The RPAR includes the SW2 public key instead of the hash value H of the authentication key CPK, the first measurement value MC, and the second measurement value ME. That is, the RPAR includes the SW2 public key and a digital signature for the third measurement value MR and the SW2 public key in addition to the third measurement value MR. HW2 generates a digital signature for the third measurement value MR and the SW2 public key using the HW2 private key.

[0090] The operations that SW2 causes the computer to perform further include the following steps 1-10 and 1-11.

[0091] 1-10. Generate the SW2 private key corresponding to the SW2 public key along with the SW2 public key.

[0092] 1-11. An SH as shown in Fig. 13 is generated. The SH includes the authentication key CPK, the first measurement value MC, the second measurement value ME, and a digital signature for the authentication key CPK, the first measurement value MC, and the second measurement value ME. This digital signature is generated using the SW2 private key.

[0093] Steps 1-10 and 1-11 are executed after steps 1-1 to 1-3.

[0094] The user system 30 acquires the authentication key CPK, the first measurement value MC, the SH including the second measurement value ME, and the RPAR including the third measurement value MR from a computer having an interface 14 .

[0095] 11 to 13, the operation that a user program running on the user system 30 causes the computer of the user system 30 to execute will be described.

[0096] The operations that the user program causes the computer to execute include steps 2-1 to 2-5. In step 2-2, the first measurement value MC and the second measurement value ME are obtained as part of the SH from the service providing system 10. In step 2-3, the SH is obtained from the service providing system 10 in addition to the RPAR. In step 2-5, the digital signature included in the SH is verified using the SW2 public key included in the RPAR.

[0097] In this modification, when the container image CI, FW1, or SW1 is changed, at least steps 1-11 are executed again, but steps 1-5 do not need to be executed again. In other words, HW2 does not need to newly generate an RPAR. Therefore, the processing time can be shortened.

[0098] The operation of each system according to this modification will be described with reference to Figures 14 and 15. The operation described below corresponds to the service providing method according to this modification.

[0099] The procedures for setting a hardware key, setting a matching value, and registering a container image are the same as those shown in Figures 4 to 7, and therefore will not be described here. The first half of the SW1 attestation procedure is also the same as that shown in Figure 8, and therefore will not be described here.

[0100] 14 shows the latter half of the SW1 attestation procedure. Steps S251 to S254 are the same as steps S151 to S154 shown in FIG. 9, and therefore a description thereof will be omitted.

[0101] In S255, SW2 generates an SW2 private key corresponding to the SW2 public key along with the SW2 public key. In S256, SW2 causes HW2 to generate an RPAR. As shown in FIG. 12 , the RPAR includes the third measurement value MR, the SW2 public key, and a digital signature for the third measurement value MR and the SW2 public key. In S257, SW2 generates an SH. As shown in FIG. 13 , the SH includes an authentication key CPK, the first measurement value MC, the second measurement value ME, and a digital signature for the authentication key CPK, the first measurement value MC, and the second measurement value ME. In S258, SW2 transmits the RPAR and the SH to the interface 14 of the service providing system 10.

[0102] Fig. 15 shows the procedure for SW2 attestation. Steps S265 to S269 are the same as steps S164 to S168 shown in Fig. 9, respectively, and therefore a description thereof will be omitted.

[0103] In S261, the user system 30 requests the interface 14 of the service providing system 10 to use the container 28. In response to the request, the interface 14 transmits the RPAR and the SH to the user system 30. In S262, the user system 30 requests the match values ​​MC', ME', and MR' from the open repository 50. In response to the request, the open repository 50 transmits the match values ​​MC', ME', and MR' to the user system 30. In S263, the user system 30 verifies the electronic signature included in the RPAR using the HW2 public key. In S264, the user system 30 verifies the electronic signature included in the SH using the SW2 public key included in the RPAR.

[0104] In this modified example, the above-described operations allow the user 31 to safely use services such as a digital identity wallet service without having to trust the service provider.

[0105] The following additional notes are provided regarding the above-described embodiments.

[0106] (Supplementary Item 1) A service providing system that provides a user system with a service that utilizes containers executed on a cloud system, the service providing system comprising: a memory; constructing a trusted execution environment on the memory; running an enclave program in the trusted execution environment constructed on the memory, thereby generating an authentication key used by the user system to authenticate the container; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be compared by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system to execute the container as second measurement values ​​to be compared by the user system; generating measurement values ​​related to the group of programs including the enclave program as third measurement values ​​to be compared by the user system; hardware that generates electronic signatures for the authentication key, the first measurement value, the second measurement value, and the third measurement value; and an interface that provides the authentication key, the first measurement value, the second measurement value, the third measurement value, and the electronic signature to the user system. (Supplementary Item 2) The service providing system according to Supplementary Item 1, wherein the interface registers a comparison value, which is referenced by the user system to compare each of the first measurement value, the second measurement value, and the third measurement value, in a repository accessible from the user system. (Supplementary Item 3) The service providing system according to Supplementary Item 1 or Supplementary Item 2, wherein the hardware holds in advance a private key corresponding to a public key used by the user system to verify the electronic signature, and generates the electronic signature using the private key.(Supplementary Item 4) The service providing system described in any one of Supplementary Items 1 to 3, wherein the authentication key is a public key, and the hardware, by running the enclave program, generates a private key corresponding to the authentication key along with the authentication key, inserts the private key into the container image to generate a keyed image, and encrypts the keyed image using an encryption key shared with the cloud system to generate an encrypted image to be registered in a repository accessible from the cloud system. (Supplementary Item 5) A service provision method for providing a user system with a service that utilizes a container executed on a cloud system, the service provision method comprising: constructing, by hardware, a trusted execution environment in memory; running, by the hardware, an enclave program in the trusted execution environment constructed on the memory, thereby generating an authentication key to be used by the user system to authenticate the container; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be checked by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system to execute the container as second measurement values ​​to be checked by the user system; generating measurement values ​​related to a group of programs including the enclave program as third measurement values ​​to be checked by the user system; generating, by the hardware, digital signatures for the authentication key, the first measurement value, the second measurement value, the third measurement value, and the digital signature; and providing, via an interface, the authentication key, the first measurement value, the second measurement value, the third measurement value, and the digital signature to the user system. (Supplementary Item 6) The service providing method described in Supplementary Item 5 further includes registering a comparison value referenced by the user system to compare each of the first measurement value, the second measurement value, and the third measurement value via the interface in a repository accessible from the user system.(Supplementary Item 7) An enclave program that operates in a trusted execution environment constructed on memory by hardware, the enclave program causing a computer having the memory and the hardware to perform operations including: generating an authentication key to be used by a user system receiving a service that utilizes the container to authenticate a container executed on a cloud system; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be compared by the user system; obtaining measurement values ​​related to a group of programs including a program that operates in the trusted execution environment constructed on the cloud system to execute the container as second measurement values ​​to be compared by the user system; generating measurement values ​​related to a group of programs including the enclave program as third measurement values ​​to be compared by the user system; and causing the hardware to generate electronic signatures for the authentication key, the first measurement value, the second measurement value, and the third measurement value.(Supplementary Item 8) A user program that causes a computer to perform operations including: obtaining an authentication key for authenticating a container executed on a cloud system from a service providing system that provides a service that utilizes the container; obtaining, from the service providing system, measurement values ​​related to a container image used on the cloud system to execute the container, measurement values ​​related to a group of programs including a program that runs in a trusted execution environment constructed on the cloud system to execute the container, and measurement values ​​related to a group of programs including an enclave program that runs in a trusted execution environment constructed in memory of the service providing system by hardware of the service providing system; obtaining, from the service providing system, digital signatures generated by the hardware for the authentication key and the measurement values; obtaining from a repository a comparison value for comparing each of the measurement values; verifying the digital signature, comparing each of the measurement values ​​with reference to the comparison value, and authenticating the container using the authentication key.

[0107] The present disclosure is not limited to the above-described embodiments. For example, two or more blocks shown in the block diagram may be integrated, or one block may be divided. Two or more steps shown in the flowchart may be executed in parallel or in a different order, instead of being executed in chronological order as described, depending on the processing capabilities of the device executing each step, or as needed. Other modifications are possible within the scope of the present disclosure.

[0108] 10 Service providing system 11 Service operator 12 Memory 13 Hardware 14 Interface 15 Firmware 16 Confidential virtual machine 17 Enclave program 20 Cloud system 21 Cloud operator 22 Memory 23 Hardware 24 Persistent volume 25 Firmware 26 Confidential virtual machine 27 Enclave program 28 Container 30 User system 31 User 40 Container image repository 50 Open repository

Claims

1. A service provision system that provides a user system with a service that utilizes containers executed on a cloud system, the service provision system comprising: a memory; constructing a trusted execution environment on the memory; running an enclave program in the trusted execution environment constructed on the memory, thereby generating an authentication key used by the user system to authenticate the container; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be compared by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system to execute the container as second measurement values ​​to be compared by the user system; generating measurement values ​​related to the group of programs including the enclave program as third measurement values ​​to be compared by the user system; hardware that generates electronic signatures for the authentication key, the first measurement values, the second measurement values, the third measurement values, and the electronic signatures; and an interface that provides the authentication key, the first measurement values, the second measurement values, the third measurement values, and the electronic signatures to the user system.

2. The service providing system of claim 1, wherein the interface registers a matching value referenced by the user system to match each of the first measurement value, the second measurement value, and the third measurement value in a repository accessible from the user system.

3. The service providing system according to claim 1, wherein the hardware pre-stores a private key corresponding to a public key used by the user system to verify the electronic signature, and generates the electronic signature using the private key.

4. The service providing system of claim 1, wherein the authentication key is a public key, and the hardware, by running the enclave program, generates a private key corresponding to the authentication key along with the authentication key, inserts the private key into the container image to generate a keyed image, and encrypts the keyed image using an encryption key shared with the cloud system to generate an encrypted image to be registered in a repository accessible from the cloud system.

5. A service provision method for providing a user system with a service that utilizes a container executed on a cloud system, the service provision method comprising: constructing a trusted execution environment in memory using hardware; running an enclave program in the trusted execution environment constructed in memory using the hardware, thereby generating an authentication key used by the user system to authenticate the container; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be checked by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system and executes the container as second measurement values ​​to be checked by the user system; generating measurement values ​​related to a group of programs including the enclave program as third measurement values ​​to be checked by the user system; generating digital signatures for the authentication key, the first measurement value, the second measurement value, and the third measurement value using the hardware; and providing the authentication key, the first measurement value, the second measurement value, the third measurement value, and the digital signature to the user system via an interface.

6. The service providing method described in claim 5, further comprising registering, via the interface, a matching value referenced by the user system to match each of the first measurement value, the second measurement value, and the third measurement value in a repository accessible from the user system.

7. An enclave program that operates in a trusted execution environment constructed on memory by hardware, and causes a computer having the memory and the hardware to perform the following operations: generating an authentication key used by a user system that receives a service that utilizes the container to authenticate a container executed on a cloud system; generating measurement values ​​related to a container image used on the cloud system to execute the container as first measurement values ​​to be checked by the user system; obtaining measurement values ​​related to a group of programs including a program that runs in the trusted execution environment constructed on the cloud system and executes the container as second measurement values ​​to be checked by the user system; generating measurement values ​​related to a group of programs including the enclave program as third measurement values ​​to be checked by the user system; and causing the hardware to generate digital signatures for the authentication key, the first measurement values, the second measurement values, and the third measurement values.

8. A user program that causes a computer to perform operations including: obtaining an authentication key for authenticating a container executed on a cloud system from a service providing system that provides a service that utilizes the container; obtaining from the service providing system, as measurement values, measurement values ​​related to a container image used on the cloud system to execute the container, measurement values ​​related to a group of programs including a program that runs in a trusted execution environment established on the cloud system and executes the container, and measurement values ​​related to a group of programs including an enclave program that runs in a trusted execution environment established in the memory of the service providing system by hardware of the service providing system; obtaining from the service providing system digital signatures generated by the hardware for the authentication key and the measurement values; obtaining from a repository a comparison value for comparing each of the measurement values; verifying the digital signature, comparing each of the measurement values ​​with reference to the comparison value, and authenticating the container using the authentication key.

Images