A few weeks ago, we announced our collaboration with HP Enterprise (HPE) on a zero-trust cloud-native enterprise platform. We highlighted Gradient’s role in securing edge and cloud workloads by projecting silicon roots of trust to workloads in the cloud and federating trust, via identity and authentication credentials, across multiple environments. Since then, we have received a number of requests to understand the architecture in greater detail.
Gradient has been working with Scytale, the team that created the open source projects SPIFFE (Secure Production Identity Framework For Everyone) and SPIRE (SPIFFE Runtime Environment), for the last six months as part of an in-house project with HPE. At its core, SPIFFE provides a specification for secure, short-lived cryptographic identities for workloads. SPIRE is a production-ready implementation of SPIFFE for establishing trust between workloads (e.g. for Kubernetes). It manages platform and workload attestation, provides an API for controlling attestation policies, and coordinates certificate issuance and rotation.
The product of this collaboration was demonstrated at HPE Discover 2020. This blog post is a deeper dive into the demonstration and how it can work for any organization using or considering the SPIFFE Identity framework. More broadly, this blog post outlines just one application of Gradient’s Identity and Authentication as a Service (IDaaS) Zero Trust platform, which can ensure that every interaction between devices, software, and users — for servers, containers, VMs, laptops, mobile, infrastructure, and IoT — comes with a cryptographic proof that the connected system is authentic and trustworthy (and fully attested).
The challenge given to us by the HPE team was to project the silicon roots of trust of their servers to container workloads, and seamlessly link these workload identities to policies, which can be applied to specific machines, federated clusters, even whole networks. With that accomplished, they also wanted to have a way to federate trust between domains so that services and workloads, regardless of location, could securely interconnect based on a dynamic security policy framework enforced by Gradient’s Trust Fabric (maintained by our network of cloud-hosted, formally-verified secure enclave processors).
Securing Workload Identities: Projecting Silicon Roots of Trust to the Cloud
One of the primary use models for SPIFFE/SPIRE is to enable the authentication of workloads in untrusted networks using mutual TLS (as explained by SPIFFE.IO in their SPIRE use cases). While SPIRE, supported by SPIFFE, provides the infrastructure to enable this, workloads and services fundamentally need to be able to ensure that interactions are only with trusted identities. That can only be done with certainty when identity is firmly rooted to hardware. That’s where Gradient comes in. Gradient enables digital fingerprinting of devices and software to ensure that digital certificates are uniquely and immutably tied to the legitimate device/software.
In SPIFFE/SPIRE, a software plugin called a Node Attestor provides the validation logic for establishing the identity of servers. SPIRE uses self-certified certificates today. Typically, certificates/keys are files that are not anchored to the hardware. Anchoring these to platforms is cumbersome, though highly desirable, in order to provide identity with surety. Gradient automates and simplifies this process using existing TPMs, thereby also providing an identity for each server that is uniquely and immutably linked to it. And a Gradient-enabled Node Attestor enables policies to be applied to machines, clusters, and networks — and leveraged and enforced between workloads.
Federating Domains: Managing Policies and Mediating Trust Between Networks
If you are operating 100% within a trusted environment, which can be assumed only in increasingly rare circumstances, identity, authentication, and authorization become much simpler and deterministic. But what if you’d like to operate between two trust domains? What if you’d like to be able to connect to, and leverage, third-party services and environments? In these situations, you need a way to federate trust.
Gradient makes it easy to federate SPIRE servers and integrates natively with heterogeneous networks — extending to legacy systems, custom devices, IoT, laptops, and more. As a platform, Gradient:
- Serves as a trusted-third party to arbitrate between mutually distrusting entities. Gradient is designed bottom up to be a secure, privacy-preserving platform. It communicates trust between parties via time-limited, privacy-preserving X.509-compatible credentials, supported by a dynamic security policy language and enforced via a distributed network of formally verified secure enclave processors.
- Manages and enforces policies. In order to effectively communicate between disparate environments, in addition to understanding the identity of the corresponding side, the ability to make assessments about the level of trust to accord, make authorization decisions, and to arbitrate mutually distrusting sides, a policy language accompanied by the ability to manage and enforce policies is valuable.
- Supports mutual attestation. Assessing the authenticity and integrity of a connected system requires consistent methods for authenticating identity and conveying measurements of the platform, both with certainty.
In SPIFFE/SPIRE, a software plugin called an Upstream Authority provides the connectivity path to a trust authority. With a Gradient Upstream Authority plugin, our network of secure enclave processors replaces the function of a CA or PKI, in order to leverage the capabilities above, allowing you to add granularity, apply policies specific to machines, federated clusters, whole network, etc. and, through this, automate management of certificates based on these policies.
Until they are capable of determining the identity and trustworthiness of connected systems with certainty, software and systems will remain highly susceptible to attack and require costly, evolving defenses. The service-to-service connectivity of an edge-to-cloud world hinges upon the ability to identify and trust each service down to the silicon, and for that identity and trust to be communicated seamlessly across federated networks, diverse platforms, and even mutually distrusting operators, in the face of sophisticated malicious parties.
Operators and developers of cloud services need confidence that services execute the correct code on authorized machines -- and that connections with other services, wherever they are located, can be established with the confidence that they are trustworthy. SPIFFE and SPIRE provide the framework for establishing this trust between workloads. The plug-ins described here ensure this trust by projecting workload identities down to server TPMs, to provide workload identity with certainty, and making it easy to federate environments.
Further Reading: IBM Research has interesting research demonstrating how workload identities might be attested with SPIFFE/SPIRE in ISTIO.
If you would like to learn more about how Gradient projects hardware roots of trust to workloads, and across networks, please contact us: