Mechanism for secure and resilient configuration upgrades
Various systems and methods for providing secure and resilient configuration upgrades are described herein. A system, includes a processor; and memory to store instructions, which when executed by the processor, cause the system to: receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node; verify, by the RSI, provenance of the update; apply, by the RSI, the update to modify a configuration of the RSI or the host partition; test, by the RSI, the modified configuration of the RSI or the host partition; and provide a cryptographic proof that the test was completed and an update status to an update coordinator.
1 . A system, comprising:
a processor; and
memory to store instructions, which when executed by the processor, cause the system to:
receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI partition comprising reserved hardware resources of the first network node, the reserved hardware resources including storage and networking resources, the RSI partition connected to a second RSI partition at a second node over a communication channel that is only for communication between RSI partitions, and the RSI partition having a Root of Trust (RoT) that is separate from an RoT of the first network node;
verify, by the RSI partition, provenance of the update;
apply, by the RSI partition, the update to modify a configuration of the RSI partition or the host partition;
test, by the RSI partition, the modified configuration of the RSI partition or the host partition; and
provide a cryptographic proof that the test was completed and an update status to an update coordinator.
2 . The system of claim 1 , wherein the source is a local device.
3 . The system of claim 2 , wherein the instructions cause the system to: after receiving the update from the source, verifying device credentials of the local device and chain of custody of the update.
4 . The system of claim 1 , wherein the source is a peer RSI partition at a second network node.
5 . The system of claim 4 , wherein the instructions to receive the update from the source comprise instructions to receive the update over a secure network that links the first network node with the second network node.
6 . The system of claim 5 , wherein the secure network is a resilient network.
7 . The system of claim 5 , wherein the secure network includes redundant paths.
8 . The system of claim 4 , wherein the instructions cause the system to perform attestation on the peer RSI partition prior to receiving the update from the peer RSI partition.
9 . The system of claim 1 , wherein the instructions to verify provenance of the update comprise instructions to:
obtain a cryptographic key from a chain-of-trust of the RSI partition; and
use the cryptographic key to verify provenance of the update.
10 . The system of claim 1 , wherein the instructions to apply the update is performed in a plurality of stages, wherein during the completion of a stage of the plurality of stages, the instructions cause the system to:
verify application of the update; and
perform a function depending on whether the application was verified.
11 . The system of claim 10 , wherein the instructions to perform the function comprise instructions to, if the verification fails, roll back to a previous safe point.
12 . The system of claim 10 , wherein the instructions to perform the function comprise instructions to, if the verification succeeds, commit the stage to a safe point.
13 . The system of claim 1 , wherein the instructions to apply the update comprise instructions to:
assume control over hardware assets of the host partition; and
apply the update to the hardware assets of the host partition.
14 . The system of claim 1 , wherein the instructions to test the modified configuration comprise instructions to:
assume control over hardware assets of the host partition;
place software of the host partition in a sandbox; and
apply the update to the software of the host partition.
15 . The system of claim 1 , wherein the instructions to test the modified configuration comprise instructions to:
obtain new measurements of components that were affected by the update;
generate a signature based on the new measurements; and
compare the signature against a pre-update signature that was generated based on the components before the update was applied.
16 . The system of claim 1 , wherein the instructions to provide a cryptographic proof comprise instructions to cryptographically signing a certification of completion.
17 . The system of claim 1 , wherein the update status indicates that the update was applied.
18 . The system of claim 1 , wherein the update status indicates that the update was not applied.
19 . The system of claim 1 , wherein the instructions cause the system to perform attestation on a host partition of the first network node.
20 . The system of claim 1 , wherein the instructions cause the system to maintain, at the RSI partition, a cryptographically verifiable chain of trust of prior attested bootstrap events that resulted in a current operating state.
21 . A method, comprising:
receiving at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI partition comprising reserved hardware resources of the first network node, the reserved hardware resources including storage and networking resources, the RSI partition connected to a second RSI partition at a second node over a communication channel that is only for communication between RSI partitions, and the RSI partition having a Root of Trust (ROT) that is separate from an RoT of the first network node;
verifying, by the RSI partition, provenance of the update;
applying, by the RSI partition, the update to modify a configuration of the RSI partition or the host partition;
testing, by the RSI partition, the modified configuration of the RSI partition or the host partition; and
providing a cryptographic proof that the test was completed and an update status to an update coordinator.
22 . The method of claim 21 , wherein the source is a peer RSI partition at a second network node.
23 . The method of claim 22 , wherein receiving the update from the source comprises receiving the update over a secure network that links the first network node with the second network node.
24 . At least one non-transitory machine-readable medium including instructions, which when executed by a machine, cause the machine to perform operations comprising:
receiving at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI partition comprising reserved hardware resources of the first network node, the reserved hardware resources including storage and networking resources, the RSI partition connected to a second RSI partition at a second node over a communication channel that is only for communication between RSI partitions, and the RSI partition having a Root of Trust (RoT) that is separate from an RoT of the first network node;
verifying, by the RSI partition, provenance of the update;
applying, by the RSI partition, the update to modify a configuration of the RSI partition or the host partition;
testing, by the RSI partition, the modified configuration of the RSI partition or the host partition; and
providing a cryptographic proof that the test was completed and an update status to an update coordinator.
25 . The at least one non-transitory machine-readable medium of claim 24 , wherein the source is a local device, and comprising instructions for after receiving the update from the source, verifying device credentials of the local device and chain of custody of the update.
26 . The at least one non-transitory machine-readable medium of claim 24 , wherein the source is a peer RSI partition at a second network node, and wherein the instructions for receiving the update from the source comprise instructions for receiving the update over a secure network that links the first network node with the second network node.
27 . The at least one non-transitory machine-readable medium of claim 26 , comprising instructions for performing attestation on the peer RSI partition prior to receiving the update from the peer RSI partition.
28 . The at least one non-transitory machine-readable medium of claim 24 , wherein the instructions for verifying provenance of the update comprise instructions for:
obtaining a cryptographic key from a chain-of-trust of the RSI partition; and
using the cryptographic key to verify provenance of the update.
29 . The at least one non-transitory machine-readable medium of claim 24 , wherein the instructions for applying the update comprise instructions for:
assuming control over hardware assets of the host partition; and
applying the update to the hardware assets of the host partition.
30 . The at least one non-transitory machine-readable medium of claim 24 , wherein the instructions for testing the modified configuration comprise instructions for:
obtaining new measurements of components that were affected by the update;
generating a signature based on the new measurements; and
comparing the signature against a pre-update signature that was generated based on the components before the update was applied.