View Source

Bug Reference

Branch

master, 4.2.0

Introduction

Trusted compute pools with Intel Trusted Execution Technology enable isolation and tamper detection in boot process and complement run time protections. Meanwhile, hardware-based trust provides verification useful in compliance and trust status, which security and policy applications use to control workload.

Using Intel's TXT technology, a number of painpoints of a secure computing environments can be addressed. For example, Isolation is a key concern in a shared infrastructure where a lack of traditional guarantees of physical separation are lacking and multiple workloads may interfere with each other. Enforcement i.e. controls needed to enforce protection of Infrastructure can prevent pre-runtime environments are target of new attacks and low-level attacks are hard to detect and can be difficult to recover from.Encryption is another problem that can get worse in a cloud where data protection can be harder due to lack of boundaries and multi-tenancy.

Source: Intel TXT Overview

Purpose

This document describes the specifications and design of the feature.

References

http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-execution-technology/malware-reduction-general-technology.html

Document History

Author	Description	Date
Hari Kannan	Inital Requirement	01/10/2013
Devdeep Singh	Draft of the FS	03/7/2013

Requirement:

CloudStack will work with an attestation server to secure the deployed Hosts - the attestation server has the capability to compare launch values against "known good"
When setting up a cloudstack environment, automatically understand which hosts are "trustworthy" and present it to the admin.
admins are able to create a service offering that will allow users to select if they need the VMs to be deployed on trusted hosts.
Ensure that VMs requested in such a manner are always placed on trusted hosts
Whenever a trusted host or the attestation server itself is rebooted, verify the trustworthiness.
Migration of VM from a trusted to untrusted host should raise an alert.

Glossary

Feature Specification

Test Guidelines

Hypervisor support

The functionality will be made available for VmWare, KVM and XenServer.

Supportability characteristics

Logging

All successful operations are logged to INFO, all exceptions/failures to ERROR, and all synchronization checks to DEBUG.

Events/Alerts

If an instance created from a service offering that requires trusted host, is placed on an untrusted or unattested host, an alert will be raised to bring it to administrators attention.