Skip to content
This repository has been archived by the owner on Apr 15, 2024. It is now read-only.

doc: update the readme of SDK and bump version to 0.0.2 #108

Merged
merged 1 commit into from
Sep 1, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 73 additions & 12 deletions sdk/python3/README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,15 @@
# Confidential Cloud-Native Primitives client library for Python
# Confidential Cloud-Native Primitives SDK for Python

The Confidential Cloud-Native Primitives (CCNP) project is the solution targeted on simplify the use of Trusted Execution Environment (TEE) in cloud native environment. The service supports attestation, measurement fetching and event log collecting of various platforms including Intel Trusted Domain Extensions (TDX), Trusted Platform Modules (TPM) and AMD SEV-SNP. More platforms will be supported later.
The Confidential Cloud-Native Primitives (CCNP) project is the solution targeted on simplifying the use of Trusted Execution Environment (TEE) in cloud-native environment. Currently, there are 2 parts included in CCNP, the services and the SDK.

- Service is designed to hide the complexity of different TEE platforms and provides common interfaces and scalability for cloud-native environment.
- SDK is to simplify the use of the service interface for development, it covers communication to the service and parses the results from the services.

The service supports attestation, measurement fetching and event log collecting of various platforms including Intel Trusted Domain Extensions (TDX), Trusted Platform Modules (TPM) and AMD SEV-SNP. More platforms will be supported later.

Attestation is a common process within TEE platform and TPM to verify if the software binaries were properly instantiated on a trusted platform. Third parties can leverage the attestation process to identify the trustworthiness of the platform (by checking the measurements or event logs) as well as the software running on it, in order to decide whether they shall put their confidential information/workload onto the platform.

CCNP, as the overall framework for attestation, measurement and event log fetching, provides user with both customer-facing client sdk and overall framework. By leveraging this sdk, user can easily retrieve different kinds of measurements or evidence such as event logs. Working along with different verification services (such as Amber) and configurable policies, user can validate the trustworthiness of the platform and make further decision.
CCNP, as the overall framework for attestation, measurement and event log fetching, provides user with both customer-facing SDK and overall framework. By leveraging this SDK, user can easily retrieve different kinds of measurements or evidence such as event logs. Working along with different verification services (such as Amber) and configurable policies, user can validate the trustworthiness of the platform and make further decision.

[Source code][source_code]
| [Package (PyPI)][ccnp_pypi]
Expand Down Expand Up @@ -37,24 +42,79 @@ There are three major functionalities provided in this SDK:

### Quote

Using this SDK, user could fetch the quote from different platforms, the service detect the platform automatically and return the type and the quote.

#### Quote type for platform

* TYPE_TDX - This provides the quote fetching based on Intel TDX.
* TYPE_TPM - This provides the quote fetching based on TPM.

#### Example usage of quote SDK

The interface input of quote is `nonce` and `user_data`, both of them are optional and will be measured in quote.
Here are the example usages of quote SDK:

* Fetch quote without any inputs
```python
from ccnp import Quote

quote = Quote.get_quote()

print(quote.quote_type)
print(quote.quote)

```

* Fetch quote with a `nonce`
```python
import secrets
from ccnp import Quote

nonce = secrets.token_urlsafe()
quote = Quote.get_quote(nonce=nonce)

print(quote.quote_type)
print(quote.quote)

```

* Fetch quote with a `nonce` and `user_data`
```python
import base64
import secrets
from ccnp import Quote

nonce = secrets.token_urlsafe()
user_data = base64.b64encode(b'This data should be measured.')
quote = Quote.get_quote(nonce=nonce, user_data=user_data)

print(quote.quote_type)
print(quote.quote)

# For TD quote, it includes RTMRs, TD report, etc.
if quote.quote_type == Quote.TYPE_TDX:
print(quote.rtmrs)
print(quote.tdreport)
```

### Measurement

Using this sdk, user could fetch various measurements from different perspective and categories.
Using this SDK, user could fetch various measurements from different perspective and categories.
Basic support on measurement focus on the platform measurements, including TEE report, values within TDX RTMR registers or values reside in TPM PCR registers.
There's also advanced support to provide measurement for a certain workload or container. The feature is still developing in progress.

#### MeasurementType for platform

The measurement sdk supports fetching different types of evidence depending on the environment.
The measurement SDK supports fetching different types of evidence depending on the environment.
Currently, CCNP supports the following categories of measurements:

* TYPE_TEE_REPORT - This provides the report fetching on various Trusted Execution Environment from all kinds of vendors, including Intel TDX, AMD SEV (Working in Progress), etc.
* TYPE_TDX_RTMR - This provides the measurement fetching on TDX RTMR. Users could fetch the measurement from one single RTMR register with its index.
* TYPE_TPM_PCR - This provides th measurement fetching on TPM PCR. Users could fetch measurement from one single PCR register with its index.

#### Example usage of measurement sdk
#### Example usage of measurement SDK

Here are the example usages for measurement sdk:
Here are the example usages for measurement SDK:

* Fetch TEE report base on platform
```python
Expand Down Expand Up @@ -90,17 +150,17 @@ container_measurement = Measurement.get_container_measurement()

### Event log

Using this sdk, user can fetch the event logs to assist the attestation/verification process. It also enables two different categories of event logs - for the platform or for a single workload/container.
Using this SDK, user can fetch the event logs to assist the attestation/verification process. It also enables two different categories of event logs - for the platform or for a single workload/container.
From platform perspective, it can support different Trusted Execution Environment and TPM. This sdk can also do fetching on certain number of event logs.

##### EventlogType for platform
#### EventlogType for platform

* TYPE_TDX - This provides the event log fetching based on Intel TDX.
* TYPE_TPM - This provides the event log fetching based on TPM.

#### Example usage of Eventlog sdk
#### Example usage of Eventlog SDK

Here are the example usages of eventlog sdk:
Here are the example usages of eventlog SDK:

* Fetch event log of Intel TDX platform for platform and check the information inside
```python
Expand Down Expand Up @@ -150,10 +210,11 @@ logs = Eventlog.get_container_eventlog()

## End-to-end examples

TBA.

## Troubleshooting

Troubleshooting information for the CCNP sdk can be found here.
Troubleshooting information for the CCNP SDK can be found here.

## Next steps
For more information about the Confidential Cloud-Native Primitives, please see our documentation page.
Expand Down
3 changes: 3 additions & 0 deletions sdk/python3/ccnp/quote/quote_sdk.py
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ class Quote():
_type (str): The type of a quote.
"""

TYPE_TDX = 'TDX'
TYPE_TPM = 'TPM'

def __init__(self, quote: str = None, quote_type: str = None):
"""Initialize Quote object.

Expand Down
2 changes: 1 addition & 1 deletion sdk/python3/pyproject.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "ccnp"
version = "0.0.1"
version = "0.0.2"
authors = [
{ name="Lu, Ken", email="ken.lu@intel.com" },
{ name="Ying, Ruoyu", email="ruoyu.ying@intel.com" },
Expand Down
Loading