README
¶
CloudProxy
CloudProxy implements a system for trustworthy computing. The core abstraction of CloudProxy is the Tao, an API for trustworthy computing. The Tao can be implemented by diverse components, including hardware, operating systems, virtual-machine monitors, and applications. Any code that can make calls to an implementation of the Tao can provide the Tao as well. So, an implementation of the Tao can depend recursively on lower-level Tao implementations. Code that provides the Tao is called a host and code running on a host is called a hosted program.
The Tao provides three main operations: Seal, Unseal, and Attest. Seal and Unseal are like encryption and decryption, except that Seal and Unseal can have policies for unsealing sealed data. For example, a Tao implementation might be willing to unseal data only for the code that originally sealed the data. The Attest operation provides cryptographic evidence of the code identity of a hosted program. For example, if the Tao host is a Trusted Platform Module, then attestation might be performed for a Linux operating system executing as a hosted program. In this case, the attestation would contain a signed TPM Quote2 for appropriate Platform Configuration Registers (PCRs). In this case, the PCRs contain information about the hash of the operating-system code.
Software components in a CloudProxy-based system execute in the context of a security domain. This domain is rooted in one or more cryptographic policy keys and provides signed policy statements about the kinds of hosts and hosted programs that are allowed to run. These statements make use of the code identity of hosts and hosted programs; the hash of a binary often forms a large part of the code identity of the software component using the binary.
Policy statements are managed by a policy guard, which interprets statements and provides answers to authorization queries. The current implementation of CloudProxy has an ACL-based guard and a Datalog one.
Code
The tao directory holds the Tao implementation, including subdirectories for
an authorization language (auth) and networking (net). The run/scripts
directory has scripts that are useful for setting up instances of example
applications from apps. The util directory is a library of utilities used by
the tao library.
The apps directory also includes programs for Tao deployment and
administration:
linux_hostprovides the Tao to three types of hosted program:- processes running on Linux
- Docker containers running on Linux
- CoreOS virtual machines running on Linux/KVM
tao_admincan set up new domains, add and remove signed policy statements, query the policy guard, and generate keys.tao_launchlaunches all supported types of hosted programs, given a path to the Unix domain socket forlinux_host.tccais a certificate authority for Tao connections. It provides certificates and short attestations to hosted programs.
Demo
The simplest demo in CloudProxy consists of a client that sends messages to a
server and a server that echoes the messages back. This application is
implemented in apps/demo. The demo application requires a security domain and
a policy that allows the demo_server and demo_client binaries to run. The
policy statements in run/scripts/domain_template.pb are sufficient if
CloudProxy is built and installed using run/scripts/build_standalone.sh.
To create a domain, run the run/scripts/set_up_domain.sh script and supply the
name of a guard type: Datalog, ACLs, or AllowAll. The last option (only
for debugging) creates a guard that returns true for any authorization query.
The opposite policy DenyAll is implemented but doesn't run, since the
application stops due to authorization failure. The set_up_domain.sh script
outputs the directory name of a domain that it created. This directory name is
needed to run the demo. For example, to get a domain with policy based on
Datalog, run the command
run/scripts/set_up_domain.sh Datalog Soft
The set_up_domain.sh script uses run/scripts/domain_template.pb to configure
the domain. This text-format protobuf structure contains rules and paths to
binaries. Relative paths in the domain template are taken to be relative to
${GOPATH}/bin; absolute paths are also permitted.
There are three demo configurations: Linux processes, Docker containers, and
KVM/CoreOS virtual machines. These correspond to the run/scripts/run_*.sh
scripts. All three scripts require sudo privileges (to start linux_host) and
require that the CloudProxy Go binaries were built in for a standalone
environment and have been installed in ${GOPATH}/bin. This can be accomplished
using the script run/scripts/build_standalone.sh.
Let the generated domain directory be $TAO_DOMAIN. Then to start the Linux
process demo, run the command
run/scripts/run_processes.sh $TAO_DOMAIN Soft
The Docker-based demo assumes that $PATH contains a Docker binary called
docker. To start the Linux Docker demo, run the command
run/scripts/run_docker.sh $TAO_DOMAIN ${GOPATH/bin/demo_{client,server}.img.tgz
The KVM/CoreOS demo assumes that $PATH contains a QEMU binary called
qemu-system-x86_64. It also requires a CoreOS virtual-machine image (call it
$IMG), a file containing at least one SSH public key (call it $KEYFILE), and
a running SSH agent that holds a private key corresponding to one of the keys in
$KEYFILE. The CoreOS image should be referenced in domain_template.pb in
vm_paths. If all these requirements are satisfied, then the Linux KVM/CoreOS
demo can be started by running the command
run/scripts/run_kvm.sh $IMG $KEYFILE $TAO_DOMAIN
Directories
¶
| Path | Synopsis |
|---|---|
|
apps
|
|
|
genauth/genauth
Package genauth supports tao auth-code generation from the Go version.
|
Package genauth supports tao auth-code generation from the Go version. |
|
host
Package host exposes the functionality of a linux_host implementation as a library.
|
Package host exposes the functionality of a linux_host implementation as a library. |
|
mixnet
Package mixnet is a generated protocol buffer package.
|
Package mixnet is a generated protocol buffer package. |
|
newfileproxy/common
Package common is a generated protocol buffer package.
|
Package common is a generated protocol buffer package. |
|
newfileproxy/resourcemanager
Package resourcemanager is a generated protocol buffer package.
|
Package resourcemanager is a generated protocol buffer package. |
|
roughtime
This contains adapted version of the roughtime client to use Tao.
|
This contains adapted version of the roughtime client to use Tao. |
|
roughtime/agl_roughtime/config
Package config contains JSON structs for encoding information about Roughtime servers.
|
Package config contains JSON structs for encoding information about Roughtime servers. |
|
roughtime/agl_roughtime/monotime
Package monotime provides access to the system's monotonic clock.
|
Package monotime provides access to the system's monotonic clock. |
|
roughtime/agl_roughtime/protocol
Package protocol implements the core of the Roughtime protocol.
|
Package protocol implements the core of the Roughtime protocol. |
|
roughtime/client
this is an adapted version of the client code to cnonect to cloudproxy.
|
this is an adapted version of the client code to cnonect to cloudproxy. |
|
roughtime/server
this is an adapted version of the server code in the roughtime for cloudproxy.
|
this is an adapted version of the server code in the roughtime for cloudproxy. |
|
simpleexample/common
Package simpleexample_messages is a generated protocol buffer package.
|
Package simpleexample_messages is a generated protocol buffer package. |
|
support_infrastructure
|
|
|
domain_service
Package domain_service is a generated protocol buffer package.
|
Package domain_service is a generated protocol buffer package. |
|
secret_service
Package secret_service is a generated protocol buffer package.
|
Package secret_service is a generated protocol buffer package. |
|
support_libraries
|
|
|
domain_policy
Package domain_policy is a generated protocol buffer package.
|
Package domain_policy is a generated protocol buffer package. |
|
protected_objects
Package protected_objects is a generated protocol buffer package.
|
Package protected_objects is a generated protocol buffer package. |
|
secret_disclosure_support
Package secret_disclosure is a generated protocol buffer package.
|
Package secret_disclosure is a generated protocol buffer package. |
|
tao_support
Package tao_support is a generated protocol buffer package.
|
Package tao_support is a generated protocol buffer package. |
|
Package tao is a generated protocol buffer package.
|
Package tao is a generated protocol buffer package. |
|
auth
Package auth supports Tao authorization and authentication, primarily by defining and implementing a logic for describing principals, their trust relationships, and their beliefs.
|
Package auth supports Tao authorization and authentication, primarily by defining and implementing a logic for describing principals, their trust relationships, and their beliefs. |
|
Package tpm2 is a generated protocol buffer package.
|
Package tpm2 is a generated protocol buffer package. |
|
options
Package options works in concert with flag, adding prettier printing of options.
|
Package options works in concert with flag, adding prettier printing of options. |
|
protorpc
Package protorpc implements a protobuf-based ClientCodec and ServerCodec for the rpc package.
|
Package protorpc implements a protobuf-based ClientCodec and ServerCodec for the rpc package. |