enclaive/arangodb-sgx

    </a>
    <br>ArangoDB-SGX</td>     

sh
docker pull enclaive/arangodb-sgx
docker-compose up -d

https://www.arangodb.com

Intel Security Guard Extension (SGX) delivers advanced hardware and RAM security encryption features, so called ***s, in order to isolate code and data that are specific to each application. When data and application code run in an *** additional security, privacy and trust guarantees are given, making the container an ideal choice for (untrusted) cloud environments.

https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html

Application code executing within an Intel SGX ***:

• Remains protected even when the BIOS, VMM, OS, and drivers are compromised, implying that an ***er with full execution control over the platform can be kept at bay
• Benefits from memory protections that thwart memory bus snooping, memory tampering and “cold boot” ***s on images retained in RAM
• At no moment in time data, program code and protocol messages are leaked or de-anonymized
• Reduces the trusted computing base of its parent application to the smallest possible footprint

Why use ArangoDB-SGX (instead of "vanilla" ArangoDB) images?

Following benefits come for free with ArangoDB-SGX :

• security: ArangoDB-SGX gives data the safest place a database can give going beyond database encryption ("data at rest")
• black box database: not only is the database encrypted, but also queries to the database remain fully encrypted in the memory ("data in use")
• no static table encryption needed: database running in a confidential container by design encrypts the query, query processing on data, and the database
• no key rotation needed: avoid key management and update complexities known from data-at-rest databases
• untraceability: when com***ed with TLS, ArangoDB-SGX keeps the user interacting with the database indistinguishable from any other user interaction even
• hardened security against memory dumps, query and user de-anonymization including kernel-space exploits, malicious and accidental privilege https://www.ibm.com/topics/insider-threats ***s, UEFI firmware exploits and other "root" ***s using the corruption of the application to infiltrate your network and system
• runs on any hosting environment irrespectivably of geo-location and complies with privacy export regulation, such as Schrem-II652073_EN.pdf)
• GDPR/CCPA compliant processing ("data in use") of user data in the cloud as data is anonymized thanks to the ***

How to deploy ArangoDB-SGX in a zero-trust cloud?

The following cloud infrastractures are SGX-ready out of the box

• Microsoft Azure Confidential Cloud
• OVH Cloud
• https://www.alibabacloud.com/blog/alibaba-cloud-released-industrys-first-trusted-and-virtualized-instance-with-support-for-sgx-2-0-and-tpm_596821

Confidential compute is a fast growing space. Cloud providers continiously add confidential compute capabilities to their portfolio. Please contact us if the infrastracture provider of your preferred choice is missing.

Getting started

Platform requirements

Check for Intel Security Guard Extension (SGX) presence by running the following

grep sgx /proc/cpuinfo

Alternatively have a thorough look at Intel's https://www.intel.com/content/www/us/en/support/articles/000028173/processors.html. (We remark that macbooks with CPUs transitioned to Intel are unlikely supported. If you find a configuration, please contact us know.)

Note that in addition to SGX the hardware module must support FSGSBASE. FSGSBASE is an architecture extension that allows applications to directly write to the FS and GS segment registers. This allows fast switching to different threads in user applications, as well as providing an additional address register for application use. If your kernel version is 5.9 or higher, then the FSGSBASE feature is already supported and you can skip this step.

There are several options to proceed

• If: No SGX-ready hardware
  Azure Confidential Compute cloud offers VMs with SGX support. Prices are fair and have been recently reduced to support the developer community. First-time users get $200 USD free credit. Other cloud provider like OVH or https://www.alibabacloud.com/blog/alibaba-cloud-released-industrys-first-trusted-and-virtualized-instance-with-support-for-sgx-2-0-and-tpm_596821 cloud have similar offerings.

• Elif: Virtualization
  Ubuntu 21.04 (Kernel 5.11) provides the driver off-the-shelf. Read the https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-21-04. Go to https://ubuntu.com/download/desktop page.

• Elif: Kernel 5.9 or higher
  Install the DCAP drivers from the Intel SGX https://github.com/intel/linux-sgx-driver

  sh
  sudo apt update
  sudo apt -y install dkms
  wget https://download.01.org/intel-sgx/sgx-linux/2.13.3/linux/distro/ubuntu20.04-server/sgx_linux_x64_driver_1.41.bin -O sgx_linux_x64_driver.bin
  chmod +x sgx_linux_x64_driver.bin
  sudo ./sgx_linux_x64_driver.bin
  
  sudo apt -y install clang-10 libssl-dev gdb libsgx-enclave-common libsgx-quote-ex libprotobuf17 libsgx-dcap-ql libsgx-dcap-ql-dev az-dcap-client open-enclave
  

• Else: Kernel older than version 5.9
  Upgrade to Kernel 5.11 or higher. Follow the instructions here.

Software requirements

Install the docker engine

sh
 sudo apt-get update
 sudo apt-get install docker-ce docker-ce-cli containerd.io
 sudo usermod -aG docker $USER    # manage docker as non-root user (obsolete as of docker 19.3) 

Use docker run hello-world to check if you can run docker (without sudo).

Get this image

The recommended way to get the enclaive ArangoDB-SGX Docker Image is to pull the prebuilt image from the https://hub.docker.com/r/enclaive/arangodb-sgx.

console
docker pull enclaive/arangodb-sgx:latest

To use a specific version, you can pull a versioned tag. You can view the https://hub.docker.com/r/enclaive/arangodb-sgx/tags/ in the Docker Hub Registry.

console
docker pull enclaive/arangodb-sgx:[TAG]

Connect to the container

Use arangosh to connect to hostname:8529 or use the web interface on the same address. No authentication is required as this a demo setup. Login as root with an e***y password on the web interface.

Build the image

If you wish, you can also build the image yourself.

console
docker build -t enclaive/arangodb-sgx:latest 'https://github.com/enclaive/enclaive-docker-arangodb-sgx.git#master'

Release Notes

• application currently breaks on restart due to issues with gramine
• also unstable due to memory issues with javascript and fixed sizes for stack and memory
• a useless fork is removed from sources
• unimplemented syscalls splice and utimensat are disabled during compilation

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated. If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement".

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

Support

Don't forget to give the project a star! Spread the word on social media! Thanks again!

License

Distributed under the Apache License 2.0 License. See LICENSE for more information.

Contact

enclaive.io - @enclaive_io - *** - [***]

Acknowledgments

This project greatly celebrates all contributions from the gramine team. Special shout out to https://github.com/dimakuv from Intel for his support.

• https://github.com/gramineproject
• https://github.com/intel/linux-sgx-driver
• https://www.arangodb.com

Trademarks

This software listing is packaged by enclaive.io. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.