Confidential computing with Go
summary
A tiny key-value HTTP service is compiled with a modified Go toolchain called EGo (ego go build, ego sign, ego run), run inside an SGX enclave, and accessed over TLS that carries an attestation quote verified by the client using the enclave signer id. Secrets are sealed with enclave keys before being written to a mounted host file and later unsealed; set/get requests succeed in the demo and the persisted file is encrypted. MarvelRun is offered to scale and attest multiple enclave instances in Kubernetes.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:13Confidential computing intro
- 6:34Secure enclaves benefits
- 9:44Go for confidential apps
- 12:32Building Go enclave with EGo
- 18:40Verifying enclave identity remotely
- 29:07Sealing enclave state
- 36:34Deploying enclaves in Kubernetes
- 38:17Conclusion
related talks
32mSecure Container with SGX: Protecting Secret in Cloud Environment
15mSecured Routines: Language-based Construction of Trusted Execution Environments
32mSecure Container with SGX: Protecting Secret in Cloud Environment
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes- 40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
16mIntroduction to confidential computing
11mLightning Talk: Computing Confidentially in the Clouds