说明安装部署Intel PCCS及其他软件。在Intel CPU的机器部署Intel SGX所需软件。参考资料Intel可信计算文档https://cc-enabling.trustedservices.intel.com/IntelAPI文档https://api.portal.trustedservices.intel.com/content/documentation.htmlGitHub下载加速https://gh-proxy.com/安装Intel开发环境https://cc-enabling.trustedservices.intel.com/intel-sgx-sw-installation-guide-linux/01/introduction/容器镜像加速https://1ms.run/准备服务器Intel CPUBIOS和BMC需是最新版本。操作系统推荐使用Ubuntu22及更高版本。服务器应可访问互联网且可访问Intel官网及GitHub。配置BIOS以厂商服务器配置说明书为准。 特殊配置部分服务器的SGX配置有下图所示开关务必选择完整重置SGX的配置。其他SGX开关尽可能都打开。例如下图所示配置后保存并重启主机。安装操作系统注意修改BIOS配置后务必重装系统使配置生效在系统内。 推荐安装Ubuntu22及更高版本。当前Intel推荐Ubuntu24 LTS。按照系统引导标准流程安装即可。检查系统时间时间差异会导致请求Intel证书失败。timedatectl set-ntp false timedatectl set-timezone Asia/Shanghai修改配置文件vim /etc/systemd/timesyncd.conf配置内容如下[Time] NTPntp.aliyun.com ntp1.aliyun.com ntp.tencent.com FallbackNTPntp.ubuntu.com RootDistanceMaxSec5 PollIntervalMinSec32 PollIntervalMaxSec2048使配置生效systemctl daemon-reload systemctl restart systemd-timesyncd timedatectl set-ntp true hwclock --systohc检查时间systemctl daemon-reload systemctl restart systemd-timesyncd timedatectl set-ntp true hwclock --systohc确认SGX可用确认服务器已开启SGX功能apt update apt install -y cpuid ls /dev | grep sgx cpuid | grep SGX dmesg | grep sgx配置Intel订阅订阅用于认证CPU务必使用长期使用的邮箱注册。邮箱丢失后续重新注册并重新认证设备。订阅英特尔软件防护扩展配置认证服务浏览器访问https://api.portal.trustedservices.intel.com/provisioning-certification注册并登录网站将获取的密钥保存。安装环境依赖包apt update apt install -y cracklib-runtime build-essential python3 libssl-dev libcurl4-openssl-dev libprotobuf-dev curl python-is-python3 wget debhelper zip pkgconf libboost-dev libboost-system-dev libboost-thread-dev protobuf-c-compiler libprotobuf-c-dev protobuf-compiler配置Intel软件源注意不同操作系统命令不同详见注释。mkdir -p /opt/intel /etc/apt/keyrings cd /opt/intel wget https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key cat intel-sgx-deb.key | sudo tee /etc/apt/keyrings/intel-sgx-keyring.asc /dev/null # Ubuntu 24 wget https://download.01.org/intel-sgx/latest/dcap-latest/linux/distro/ubuntu24.04-server/sgx_debian_local_repo.tgz # Ubuntu22 wget https://download.01.org/intel-sgx/latest/dcap-latest/linux/distro/ubuntu22.04-server/sgx_debian_local_repo.tgz tar -zxf sgx_debian_local_repo.tgz # ubuntu 24 echo deb [signed-by/etc/apt/keyrings/intel-sgx-keyring.asc archamd64] file:///opt/intel/sgx_debian_local_repo noble main | sudo tee /etc/apt/sources.list.d/intel-sgx-local.list # ubuntu 22 echo deb [signed-by/etc/apt/keyrings/intel-sgx-keyring.asc archamd64] file:///opt/intel/sgx_debian_local_repo jammy main | sudo tee /etc/apt/sources.list.d/intel-sgx-local.list apt-get update安装nodejs注意低版本会导致Intel的软件不可用。curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - apt install -y nodejs检查版本nodejs --version安装Intel PCCS操作系统需联网apt install -y --no-install-recommends sgx-dcap-pccs网络状态不好时可配置网络代理选1端口不冲突时可使用默认端口此处填写订阅获取的密钥此处随意填写自己务必记住备份配置文件cp /opt/intel/sgx-dcap-pccs/config/default.json /opt/intel/sgx-dcap-pccs/config/default.json.bak修改配置文件vim /opt/intel/sgx-dcap-pccs/config/default.json内容如下需检查配置 若使用默认数据库 ApiKey是在Intel订阅获取的。 hosts表示对外提供服务的IP HTTPS_PORT是PCCS对外提供服务的端口。 UserTokenHash和AdminTokenHash是user password和admin password 使用sha512加密计算后的数值。{ HTTPS_PORT : 8081, hosts : 0.0.0.0, uri: https://api.trustedservices.intel.com/sgx/certification/v4/, ApiKey : 058b7a8f459c43499350e33ef8c522f5, proxy : , RefreshSchedule: 0 0 1 * * *, UserTokenHash : 3f15fb99a7120297e35a9e47ae3b6a2399af47c1baaf28ebbdff7e7e8cb9b93952a926312b0d03f8a6bb9a962c6eec89a51191c7a98a79696d66afc9ac626683, AdminTokenHash : a1102957491b9ce5441e111f7725f2fd0201bc32465e2536e5182d1c5e3f6b0965355c09f2c8b9111ab6d18a73b75f0f3a06e788bd2a6dff4ddc7c4da6ada603, CachingFillMode : LAZY, OPENSSL_FIPS_MODE : false, LogLevel : info, DB_CONFIG : sqlite, sqlite : { options : { dialect: sqlite, define: { freezeTableName: true }, logging : false, storage: pckcache.db } } }若使用MySQL数据库需已有可用的MySQL database是MySQL中数据库的名字。 username和password是可以访问上述数据库的账户信息。 host是MySQL的IP或者域名需要在当前主机可直接访问到。 ca是ssl配置证书的绝对路径默认不启用ssl。{ HTTPS_PORT: 8081, hosts: 127.0.0.1, uri: https://api.trustedservices.intel.com/sgx/certification/v4/, ApiKey: , proxy: , RefreshSchedule: 0 0 1 * * *, UserTokenHash: , AdminTokenHash: , CachingFillMode: LAZY, OPENSSL_FIPS_MODE: false, LogLevel: info, DB_CONFIG: mysql, mysql: { database: pckcache, username: root, password: root123, options: { host: mysql-intel, port: 3306, dialect: mysql, pool: { max: 5, min: 0, acquire: 30000, idle: 10000 }, define: { freezeTableName: true }, logging: false }, ssl: { required: false, ca: /opt/intel/intel.ca } } }重启使服务生效systemctl restart pccs.service systemctl status pccs.service检查服务状态lsof -i :8081 systemctl status pccs.service验证服务可用curl -k -G https://localhost:8081/sgx/certification/v4/rootcacrl检查服务日志journalctl -u pccs配置文件默认路径/opt/intel/sgx-dcap-pccs/config/default.json检查数据库配置文件apt install -y sqlite3 sqlite3 /opt/intel/sgx-dcap-pccs/pckcache.db .tables查看部署的版本dpkg -l | grep sgx-dcap-pccs应不低于下图所示版本特殊情况因Intel PCCS代码仓库变更无法稳定复现部署操作。可采用下述方法临时解决服务故障。cd /opt/intel git clone https://github.com/intel/confidential-computing.tee.dcap.pccs.git cd confidential-computing.tee.dcap.pccs/service ./cleanup.sh ./install.sh ./startup.sh部署SGX-SDK下载最新文件例如当前sgx_linux_x64_sdk_2.28.100.1.bin根据操作系统选择。 Ubuntu22wget https://download.01.org/intel-sgx/latest/dcap-latest/linux/distro/ubuntu22.04-server/sgx_linux_x64_sdk_2.28.100.1.binUbuntu24wget https://download.01.org/intel-sgx/latest/dcap-latest/linux/distro/ubuntu24.04-server/sgx_linux_x64_sdk_2.28.100.1.bin部署软件chmod x sgx_linux_x64_sdk_2.28.100.1.bin ./sgx_linux_x64_sdk_2.28.100.1.bin根据提示输入yes 根据提示复制命令使环境配置生效source /root/sgxsdk/environment部署SGX-PSW用于向PCCS申请认证安装软件# 安装launch service apt-get install -y libsgx-launch libsgx-urts # 安装EPID-based attestation service apt-get install -y libsgx-epid libsgx-urts # 安装algorithm agnostic attestation service apt-get install -y libsgx-quote-ex libsgx-urts # DCAP ECDSA-based service apt-get install -y libsgx-dcap-ql # 若启用 ECDSA 认证需安装QPL apt-get install -y libsgx-dcap-default-qpl查询服务状态systemctl restart aesmd.service systemctl status aesmd.service服务状态正常时服务状态异常时需重启服务部署Intel DCAP用于安装Intel完整开发环境使用Intel测试用例调测SGX可用性。 获取最新代码cd /opt/intel git clone https://github.com/intel/confidential-computing.tee.dcap cd cd confidential-computing.tee.dcap/安装基础工具apt-get install -y \ build-essential \ cmake \ git \ wget \ curl \ zip \ debhelper \ pkg-config \ dkms \ gnupg \ python-is-python3 \ python3 \ libssl-dev \ libcurl4-openssl-dev \ libboost-dev \ libboost-system-dev \ libboost-thread-dev \ protobuf-c-compiler \ libprotobuf-c-dev \ protobuf-compiler \ libprotobuf-dev \ libsgx-urts \ libsgx-dcap-ql \ libsgx-dcap-default-qpl \ libsgx-enclave-common-dev \ libsgx-dcap-ql-dev \ libsgx-dcap-default-qpl-dev \ tee-appraisal-tool \ libsgx-aesm-ecdsa-plugin-dbgsym \ libsgx-aesm-pce-plugin-dbgsym \ libsgx-aesm-quote-ex-plugin-dbgsym \ libsgx-dcap-default-qpl-dbgsym \ libsgx-dcap-ql-dbgsym \ libsgx-dcap-quote-verify-dbgsym \ libsgx-enclave-common-dbgsym \ libsgx-pce-logic-dbgsym \ libsgx-qe3-logic-dbgsym \ libsgx-quote-ex-dbgsym \ libsgx-ra-network-dbgsym \ libsgx-ra-uefi-dbgsym \ libsgx-tdx-logic-dbgsym \ libsgx-uae-service-dbgsym \ libsgx-urts-dbgsym \ libtdx-attest-dbgsym \ sgx-aesm-service-dbgsym \ sgx-pck-id-retrieval-tool-dbgsym \ sgx-ra-service-dbgsym \ tdx-qgs-dbgsym \ tee-appraisal-tool-dbgsym \ libsgx-dcap-quote-verify-dev运行测试用例备份配置文件cp /etc/sgx_default_qcnl.conf /etc/sgx_default_qcnl.conf.bak修改配置文件vim /etc/sgx_default_qcnl.conf内容如下 user_token是部署PCCS时输入的user password。{ pccs_url: https://localhost:8081/sgx/certification/v4/, user_token: user123, use_secure_cert: false, pccs_api_version: 3.1, retry_times: 6, retry_delay: 10, pck_cache_expire_hours: 168, verify_collateral_cache_expire_hours: 168, local_cache_only: false }重启aesmd确认服务运行中systemctl restart aesmd.service systemctl status aesmd.service运行测试用例QuoteGenerationcd SampleCode/QuoteGenerationSample/ make ./app成功时如下所示运行测试用例QuoteVerificationcd ../QuoteVerificationSample/ make openssl genrsa -out private_key.pem -3 3072 /opt/intel/sgxsdk/bin/x64/sgx_sign sign -key private_key.pem -enclave enclave.so -out enclave.signed.so -config Enclave/linux/Enclave.config.xml ./app成功如下所示运行occlum测试用例