BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2 Solution Architecture

NIST platform security: roots of trust, firmware and secure enclaves IR 8320A
All changes in this version
first version loaded 3 During workload orchestration, periodically audit the asset tag of the cloud server platform part of 3

Title

Solution Architecture

Control

Figure 2 provides a layered view of the solution system architecture. The indicated servers in the resource pool include a hardware module for storing sensitive keys and measurements. All of the servers depicted in the diagram are configured by the management server.

The initial step in instantiating the architecture requires provisioning the server for enhanced hardware- based security features. This requires either physical or remote access to the server to access the BIOS, enable a set of configuration options to use the hardware module (including taking ownership of the module), and activate the enhanced hardware-based security features. This process is highly BIOS and original equipment manufacturer (OEM) dependent. This step is mandatory for a measured launch of the platform.

The management console provides remote monitoring and management of all servers in this solution architecture. It allows remote configuration of BIOS that are required for a server to be measured and secured. It periodically checks the measurements of all monitored servers and compares them against golden measurements that were taken in pristine condition. When any such measurements do not match, indicating a platform security compromise, it notifies the administrator through email and/or text message. The administrator can then use the management console to take remediation actions, which could include powering down the server or reconfiguring or updating the firmware of the server. Hardware (no crypto module) Container Runtime OS Kubelet Hardware Crypto Module Container Runtime OS Kubelet Hardware Crypto Module Container Runtime OS Kubelet

Worker Nodes Container Orchestation Software

Attestation Service

Management Server

Control Plane

Figure 2: Stage 0 Solution System Architecture

The platform undergoes a measured launch, and the BIOS and OS components are measured (cryptographically) and placed into the server hardware security module. These measurement values are accessible through the cloud management server via the application programming interface (API). When the hosts are initially configured with the cloud management server, the relevant measurement values are cached in the cloud management database.

In addition to the measured launch, this solution architecture also provides provisions to assign a secure asset tag to each of the servers during the provisioning process. The asset tag is provisioned to a non- volatile index in the hardware module via an out-of-band mechanism, and on a platform launch the contents of the index are inserted/extended into the hardware module. Enhanced hardware-based security features provide the interface and attestation to the asset tag information, including the asset tag lookup and user-readable/presentable string/description.