Jason: Secure Processing. 2 2
In this lesson, we're going to talk about secure processing 3 3
and a couple of key concepts associated with it. 4 4
Now, when we talk about secure processing, 5 5
this is a mechanism for ensuring the confidentiality, 6 6
integrity, and availability of software code and data 7 7
as it's executed in volatile memory, 8 8
because after all, we're going to take data 9 9
off of our hard drive or off of our network, 10 10
and we're going to put it into RAM, 11 11
and then from RAM into our processor. 12 12
And all of that time going from RAM to the processor 13 13
or while it's stored in RAM has the potential 14 14
for it to be modified or for it to be stolen 15 15
or for it to be not available. 16 16
And so by doing secure processing, 17 17
we want to harden that area of this process. 18 18
Now, there are lots of ways to do secure processing, 19 19
but we're going to focus on five of them in this lesson. 20 20
We're going to talk about processor security extensions, 21 21
Trusted Execution, Secure Enclaves, 22 22
atomic execution, and bus encryption. 23 23
The first one is processor security extensions. 24 24
Now, these are low-level CPU changes and instructions 25 25
that enable secure processing. 26 26
And these are built into your microprocessor. 27 27
Now, they're called different things 28 28
depending on if you're using an AMD or an Intel processor. 29 29
If you're using an AMD processor, 30 30
this is known as Secure Memory Encryption, SME, 31 31
or Secure Encrypted Virtualization, SEV. 32 32
On the other hand, if you're using Intel processors, 33 33
you're going to be using Trusted Execution Technology, or TXT, 34 34
or Software Guard Extensions, SGX. 35 35
All four of these things are a form 36 36
of processor security extensions. 37 37
And for the exam, 38 38
that's pretty much as deep as you need to go. 39 39
The next thing we want to talk about is Trusted Execution. 40 40
The CPU security extensions invoke TPM 41 41
and a secure boot attestation 42 42
to ensure a trusted operating system is running. 43 43
So anytime we want to boot up the system, 44 44
we want to make sure that we are using that trusted firmware, 45 45
using UEFI, and using TPM and Secure Boot 46 46
to tell us that this operating system that's being booted 47 47
is something we trust. 48 48
This is very common inside the world of using Microsofts 49 49
on an Intel or AMD processor set. 50 50
Next, we have a Secure Enclave. 51 51
Now, a Secure Enclave is an extension 52 52
that allows a trusted process 53 53
to create an encrypted container for sensitive data. 54 54
This will help us prevent things 55 55
like buffer overflow attacks. 56 56
And typical application usage here 57 57
would be able to store encryption keys 58 58
and other sensitive data inside of the Secure Enclave. 59 59
Once we have that trusted operating system, 60 60
we can then create the Secure Enclave 61 61
for us to be able to store that data within. 62 62
The next one we want to talk about is atomic execution. 63 63
Now, there are certain operations 64 64
that should only be performed once or not at all, 65 65
for example, initializing a memory location. 66 66
This should only happen one time, right? 67 67
And so once you've initialized it, that should be it. 68 68
Well, the idea of atomic execution 69 69
is there are these extensions in place 70 70
to make sure somebody can't reuse 71 71
or hijack an atomic execution operation 72 72
like doing a memory initialization. 73 73
This can help you prevent buffer overflows 74 74
and race conditions 75 75
by being able to control these processes. 76 76
And again, this is something that's built 77 77
into both processors these days. 78 78
And finally, we have bus encryption. 79 79
Now, bus encryption is data 80 80
that is encrypted by an application 81 81
prior to being placed on the data bus. 82 82
This will ensure that the data being sent over the network 83 83
or over a bus is going to be protected 84 84
because it's going to have end-to-end encryption. 85 85
Now, for this to work, 86 86
we have to ensure the device at the other end of the bus 87 87
is trusted to decrypt that data. 88 88
Now, what does this look like in the real world? 89 89
Well, I've had this happen to me, myself, 90 90
as I've plugged in something like my Roku device to my TV. 91 91
If I have my Roku device 92 92
and I have a cheap HDMI cable connecting it to my TV, 93 93
sometimes they can't do the three-way handshake 94 94
that's required for HDCP. 95 95
Now, HDCP was a copyright protection thing, 96 96
so it encrypts the data going from your device to your TV. 97 97
And so when that handshake happens, 98 98
if it doesn't happen properly, 99 99
you'll get something that looks like this, 100 100
"HGCP Unauthorized." 101 101
And this is because the bus encryption failed. 102 102
The TV or the Roku didn't trust each other. 103 103
And so you have to unplug the cable, 104 104
plug it back in, and try again. 105 105
And then, eventually, they'll make the three-way handshake, 106 106
and now you can watch your TV. 107 107
That's the idea here. 108 108
This is a form of bus encryption that most of us use 109 109
and we may not even realize we're using on a daily basis.