Quickstart Guide

1.0 Introduction

Fortanix Confidential Computing Manager (CCM) enables an application to run in a confidential environment. The solution orchestrates critical security policies such as identity verification, data access control, and code attestation for enclaves that are required for confidential computing.

This quickstart guide will help you get started with Fortanix CCM. For a detailed user guide refer to https://support.fortanix.com/hc/en-us/sections/360008695591-User-Guide 

1.2 Prerequisites: Getting Started Video

• A private Docker registry to push converted application image(s)
• An Azure Portal subscription account

Step 1: Signup and Log in to Fortanix Confidential Computing Manager

1.  Visit https://ccm.fortanix.com and signup.
2. After your account is approved by the Administrator, log in by entering your email address and password.
   Figure 1: Logging in

Step 2: Create and Select an Account

1. Once you log in to your account, you will be taken to the Accounts page. Click ADD ACCOUNT to create a new account.
2. Enter a name for the new account and optionally add a custom logo for the account.
3. To allow compute nodes to bypass Intel's IAS attestation and successfully enroll regardless of attestation failing, click the check box “This is a test-only deployment”. For more details about Attestation Bypass refer to the user guide Disable Fortanix CCM Attestation.
4. Click CREATE ACCOUNT to complete the account creation.
   Figure 2: Create an Account
5. Once the account is created, click SELECT ACCOUNT to select the newly created account and start enrolling compute nodes and creating applications.
   Figure 3: Select an Account

Step 3: Add an Application - Example: Flask Server

1. Navigate to the Applications tab and click + APPLICATION to add an application. In this example, we will add an Enclave OS application running a Python Flask server. Figure 4: Create an Application
2. Click the ADD button for the Enclave OS Application.
   NOTE

   This quickstart guide covers adding an Enclave OS application.

   • Refer to the following link for EDP applications: EDP applications on CCM.
   • Refer the following link for ACI application: ACI application on CCM.

   
   Figure 5: Add an Enclave OS Application

3. Fill in the relevant details as shown below and click NEXT. You can use Fortanix's public docker registry for the sample app.
   Details:
   Docker Hub: https://hub.docker.com/u/fortanix
   Optional: You can run the original application with the following command:

   sudo docker run fortanix/python-flask

   NOTE

   It is recommended that you use your private docker registry to store the output image.
   Figure 6: Configure an Application

For more details on how to configure an Enclave OS application please refer to Adding an Enclave OS application.

Step 4: Create an Image

1. A Fortanix CCM Image is a particular software release or a version of an application. Each image is associated with one enclave hash (MRENCLAVE).
2. Once you create an Enclave OS application and click the NEXT button, you will see the Add image page where you must configure the image of the Enclave OS application. Click the + IMAGES button to create an image. Figure 7: Create an Image
3. For the Tag field, use “latest” if you want to use the latest image builds.
4. Enter the REGISTRY CREDENTIALS for the Output image name. Here, the registry credentials are the credentials needed to access the private docker registry where the image will be pushed. Since the input image is stored in a public registry, there is no need to provide credentials for the input image.
   
   • If you have added these registry credentials through the Settings page, then the check box Use saved credentials will be selected by default and the registry name will be filled automatically for the Add Registry Credentials fields.
     Figure 8: Add Saved Registry Credentials
   • If you have not saved any Registry Credentials on the Settings page, then manually enter the registry credentials for the Output image name.
     Figure 9: Add Registry Credentials Manually
5. Click CREATE to proceed (Figure 9).
6. If you selected the Image Type as Intel SGX, enter the following details:
   • ISVPRODID is a numeric product identifier. A user must choose a unique value in the range of 0-65535 for their applications.
   • ISVSVN is a numeric security version to be assigned to the Enclave. This number should be incremented if security relevant change is made to the application.
   • Memory size – Choose the memory size from the drop-down to change the memory size of the enclave.
   • Thread count – Change the thread count to support the application.
     
     If you selected the Image Type as AWS Nitro, enter the following details:
   • Memory size
   • CPU count – CPU count is the number of CPUs to dedicate to an enclave out of all the CPUs available to the host machine.
7. On successful completion of the image creation, you will see a notification that the image was successfully created and your application will be listed in the Applications tab.

For more details refer to the URLs below:

• To add multiple image registries: https://support.fortanix.com/hc/en-us/articles/360048967971-User-s-Guide-Image-Registry
• To create an EOS application image: https://support.fortanix.com/hc/en-us/articles/360043529411-User-s-Guide-Create-an-Image#CreateanImageforEnclaveOSApplications 
• To create an EDP application image: https://support.fortanix.com/hc/en-us/articles/360043529411-User-s-Guide-Create-an-Image#create-an-image-for-edp-applications-0-4
• To create an ACI application image: https://support.fortanix.com/hc/en-us/articles/360043529411-User-s-Guide-Create-an-Image#create-image-for-aci-application-0-5

Step 5: Application Image Approval

1. On the Tasks tab, click on the "Build Whitelist for app: Python Application Server" task.
2. Click APPROVE to whitelist the image created in the step above. Figure 10: Approve the Application Image Figure 11: Approve the Application Image

Step 6: Enroll Compute Node Agent - SGX

1. Navigate to the Compute Nodes tab and click the + ENROLL NODE button.
2. Click COPY to copy the Join Token. This Join Token is used by the compute node to authenticate itself. Figure 12: Copy the Generated Join Token
3. Visit https://azuremarketplace.microsoft.com/en-us/marketplace/apps/fortanix.rte_node_agent to create the Node Agent VM to register the compute node.
   NOTE

   Alternatively, you can also download the latest node agent software from Fortanix Node Agent and install it on your own machine.
   Figure 13: Create Node Agent in Azure
4. Fill in the information as shown below to spin up the node agent on Azure. Paste the Token generated earlier on the "Join Token" field on the Azure portal.
   NOTE

   Information about the available regions and supported VMs can be found here.
   Figure 14: Configure the Node Agent  Figure 15: Configuring the Node Agent 
5. Once the node agent is created, the compute node will be enrolled in Fortanix CCM, you will see it under the Compute Nodes overview table. Figure 16: Node Enrolled

For more details on how to enroll compute nodes refer to CCM Compute Nodes.

Step 6: Enroll Compute Node Agent - AWS Nitro

For details to set up the environment, refer to User's Guide: Setting up the Environment.

1. Obtain the join token from Fortanix CCM. To generate your Join Token, please log in to https://ccm.fortanix.com/. In the Infrastructure tab, click +ENROLL NODE on the Compute Nodes page. 
2. In the ENROLL NODE window, a Join Token will be generated in the text box for "Get a join token to register a compute node". This Join Token is used by the compute node to authenticate itself. Figure 17: Copy Join Token
3. Click Copy to copy the Join Token (Figure 17).  
4. Download the Amazon Nitro node agent installer.
5. Extract the contents of the package and open the folder.
6. Open the readme file which contains the steps to enroll the compute node in Fortanix CCM.
7. To enroll the compute node:
   1. Copy the file installer.sh to your VM.
   2. Run the installer.sh with the join token copied in Step 3 . This will enroll the compute node in Fortanix CCM.

      sudo bash ./installer.sh <join-token>

   3. Once the compute node is enrolled in Fortanix CCM, you will see it under the Compute Nodes overview table. Figure 18: Node Enrolled

Step 7: Run the Application Image on the Enrolled Compute Node

1. Install docker on the enrolled compute node. To install docker, use the command:

   sudo apt install docker.io

2. Finally, run this application image on the node by using the following command:
   For this example application, for SGX Platform, the command would be:
   

   sudo docker run --privileged --volume /dev:/dev -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket -e NODE_AGENT_BASE_URL=http://52.152.206.164:9092/v1/ fortanix-private/python-flask-sgx

   Where,
   
   • 9092 is the default port on which Node Agent listens to.
   • 52.152.206.164 is the node agent Host IP.
   • fortanix-private/python-flask-sgx is the converted app that can be found in the Images tab under the Image Name column in the Images table.
   
   
   For AWS Nitro Platform, the command would be:
   

   sudo docker run -it --rm --privileged -v /run/nitro_enclaves:/run/nitro_enclaves -e RUST_LOG=debug -e NODE_AGENT_BASE_URL=http://172.31.14.110:9092/v1/ -p 80:80 -p 443:443 513076507034.dkr.ecr.us-west-1.amazonaws.com/development-images/em-test-framework-nginx-9913:nitro

   Where,
   
   • 9092 is the default port on which Node Agent listens to.
   • 172.31.14.110 is the node agent Host IP.
   • em-test-framework-nginx-9913:nitro is the converted app that can be found in the Images tab under the Image Name column in the Images table.
   NOTE

   Please use your own values for node IP, port (if you changed it), and Converted Image in the above format. The information in the example above is just a sample.

3.0 Where to go from here

Congratulations, you have just deployed your first confidential computing application using the Fortanix Confidential Computing Manager! To explore more features of Fortanix CCM please visit one of the following guides:

• Provision a TLS certificate using CCM: Certificate Configuration
• Use identity and policy management on applications and compute nodes
  • Application and compute node policy enforcement
  • Compute node labels
• Build and deploy confidential computing applications in Rust using the Fortanix EDP platform: EDP applications on CCM.

For quick support, please join our Slack community: https://fortanix.com/community
Channel: #enclavemanager