Security++: Hide Your Secrets via a Distributed Hardware Security Mod...
summary
A distributed HSM is implemented with Intel SGX enclaves so private keys are generated, sealed and used locally instead of shipped to cloud HSMs; attestation uses Intel Attestation Service and keys are only unwrapped inside the enclave. Integration with Istio/Envoy uses an Envoy SDS sidecar that routes TLS operations to the enclave, enabling mutual TLS and Gateway key upload flows with minimal latency impact, keys never exposed in clear text, adapters and source code are published on GitHub.
AI-written summary · about
chapters (10)
- 0:00Introduction to cloud HSM
- 0:46Limitations of cloud HSM
- 4:07Distributed HSM benefits
- 5:40Trusted execution environments
- 8:21Intel SGX overview
- 10:17Istio service mesh integration
- 13:26Mutual TLS flow enhancements
- 18:20Gateway and data plane security
- 22:09Implementation details
- 25:03Future roadmap and conclusion
related talks
43mShhh - Stop Sharing Secrets, a Secure Mindset for Embedded Development
37mSecuring Data in the Quantum Era: From the Root of Trust to Protecting Ecosystems
37mInstall "Hardware Wallet" for Consortium Blockchain -- Protect Hyperleger Fabric...
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
37mInstall "Hardware Wallet" for Consortium Blockchain -- Protect Hyperleger Fabric...
50mEnabling Hardware Security Modules for Confidential Computing
19mAttestation and identity provisioning to Intel SGX workloads
01h 00mPrivacy Preserving Smart Contracts