NIST platform security: roots of trust, firmware and secure enclaves IR 8320D (Draft)

17 requirements · published 2023-02-23
Changes in this version

All 1 Inventory/Discovery 266 2 Reporting/Analysis 267 3 Enforce Policy 268 4 Assign Roles 269 5 Automate Lifecycle 270 Appendix A Hardware Architecture 342 Appendix B AMI TruE Machine Identity Management Implementation 362 Appendix C Intel In-Use Secret Key Protection Implementation 485 Appendix D Machine Identity Runtime Protection and Confidential Computing 558 Appendix E Acronyms and Other Abbreviations 630

Controls in this version
Ref	Title	Text
1	Inventory/Discovery 266
2	Reporting/Analysis 267
3	Enforce Policy 268
4	Assign Roles 269
5	Automate Lifecycle 270	Fig. 1. Stage 0 Implementation: Typical Enterprise-Grade Machine Identity Management 271 For more detailed information and the solution architecture for Stage 0, please refer to Sec. 3 of 272 IR 8320C [IR8320C] . 273 Stage 1: Secret Key I
Appendix A	Hardware Architecture 342	This appendix provides an overview of the high-level hardware architecture of the prototype 343 implementation. 344 The prototype implementation is comprised of three servers that reside in geographically 345 separate locations. Two of the
Appendix B	AMI TruE Machine Identity Management Implementation 362	This appendix contains supplementary information describing the components and the steps 363 needed to set up the prototype implementation for AMI TruE. 364
B.1 in B	Hardware and Software Requirements 365	This section explains the hardware and software requirements for AMI TruE installation. AMI 366 TruE services are released as docker containers and require a Kubernetes control plane node and 367 one or more Kubernetes worker nodes. 368 Dep
B.2 in B	AMI TruE Deployment 425	AMI TruE core services are deployed as containers in the Kubernetes cluster. Please refer to 426 the AMI TruE Quick Start Guide that comes with the release for the deployment procedures. It 427 provides step-by-step details on the pre-confi
B.3 in B	Platform Security Services Configuration 452	The web user interface (UI) is launched with a compatible browser by accessing 453 https://<host>:30567/WEBAPPS/True 454 where <host> is the IP address or host name of the installation. Upon a successful connection, 455 the login dialog is
B.4 in B	Uninstallation 482	Refer to the AMI TruE Quick Start Guide for detailed steps on the uninstallation and cleanup of 483 all components and services installed for AMI TruE. 484
Appendix C	Intel In-Use Secret Key Protection Implementation 485	This appendix contains supplementary information describing the components and the steps 486 needed to set up the prototype implementation for enabling hardware components for Intel-based 487 confidential computing. 488 The prototype uses I
Appendix D	Machine Identity Runtime Protection and Confidential Computing 558	Integration 559 This appendix contains supplementary information explaining how the components are 560 integrated with each other to provide runtime protection of machine identities. 561
D.1 in D	Solution Overview 562	Machine identity runtime protection leverages the Intel SGX Attestation Infrastructure to support 563 the SKC use case. SKC provides key protection at rest and in-use using Intel SGX. Intel SGX 564 implements the TEE paradigm. 565 Using the
D.2 in D	Solution Architecture 579	Fig. 8 shows how the components of the solution interact with each other in the step-by-step 580 process to launch NGINX workloads utilizing Intel SKC to protect its key. 581 Fig. 8. NGINX Key Transfer Workflow with Secure Key Caching 582
D.3 in D	Installation and Configuration 595	Log in to the Kubernetes control plane node and perform the following steps. 596
Appendix E	Acronyms and Other Abbreviations 630	API 631 Application Programming Interface 632 BIOS 633 Basic Input/Output System 634 CA 635 Certificate Authority 636 CPU 637 Central Processing Unit 638 CSP 639 Cloud Service Provider 640 CSR 641 Certificate Signing Request 642 DB ME

17 of 17.