Skip to content

Commit 7094bf3

Browse files
lacabralacabra
authored
Merge pull request #38 from enigmampc/rightenclave
BLD: key exchange + quote (WIP)
2 parents 4df411a + 23f6156 commit 7094bf3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+812
-1637
lines changed

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,4 +116,6 @@ crashlytics-build.properties
116116
fabric.properties
117117

118118
/target
119-
**/*.rs.bk
119+
**/*.rs.bk
120+
121+
enigma-types.h

‎.gitmodules‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +0,0 @@
1-
[submodule "enclave/incubator-teaclave-sgx-sdk"]
2-
path = enclave/incubator-teaclave-sgx-sdk
3-
url = git@github.com:apache/incubator-teaclave-sgx-sdk.git
4-
branch = v1.1.1-testing

‎api-server/README.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,18 +69,20 @@ The geolocation + datetime data is to be provided in an array in JSON format as
6969
"lat": 40.757339,
7070
"lng": -73.985992,
7171
"startTS": 1583064000,
72-
"endTS": 1583067600
72+
"endTS": 1583067600,
73+
"testResult": false,
7374
},
7475
{
7576
"lat": 40.793840,
7677
"lng": -73.956900,
7778
"startTS": 1583150400,
78-
"endTS": 1583154000
79+
"endTS": 1583154000,
80+
"testResult": true,
7981
},
8082

8183
]
8284
```
83-
In the example above, the first datapoint is for Times Square in New York City on March 1st, 2020 from 12pm to 1pm, whereas the second data point is somewhere in Central Park the following day March 2nd, 2020 from 12pm to 1pm.
85+
In the example above, the first datapoint is for Times Square in New York City on March 1st, 2020 from 12pm to 1pm, whereas the second data point is somewhere in Central Park the following day March 2nd, 2020 from 12pm to 1pm. This user did not test positive for Coronavirus the first day, but he tested positive the following day.
8486

8587

8688
# Installation

‎client/data.js‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
module.exports.DataUser1 = [
2+
{
3+
"lat": 40.757339,
4+
"lng": -73.985992,
5+
"startTS": 1583064001,
6+
"endTS": 1583067601,
7+
"testResult": false,
8+
},
9+
{
10+
"lat": 40.793840,
11+
"lng": -73.956900,
12+
"startTS": 1583150401,
13+
"endTS": 1583154001,
14+
"testResult": false,
15+
},
16+
]
17+
18+
module.exports.DataUser2 = [
19+
{
20+
"lat": 41.757339,
21+
"lng": -73.985992,
22+
"startTS": 1583064000,
23+
"endTS": 1583067600,
24+
"testResult": true,
25+
},
26+
{
27+
"lat": 40.793840,
28+
"lng": -73.956900,
29+
"startTS": 1583150400,
30+
"endTS": 1583154000,
31+
"testResult": true,
32+
},
33+
]

‎client/index.js‎

Lines changed: 80 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const EthCrypto = require('eth-crypto');
44
const jaysonBrowserClient = require('jayson/lib/client/browser');
55
const enigma = require('enigma-js/lib/enigma-js.node');
66
const web3utils = require('web3-utils');
7+
const data = require('./data.js');
78

89

910
const JSON_RPC_Server='http://localhost:8080';
@@ -47,15 +48,55 @@ function getClientKeys(seed='') {
4748
return {privateKey, publicKey};
4849
}
4950

50-
async function add_data(userId, data){
51+
async function getEncryptionKey(publicKey) {
52+
const getEncryptionKeyResult = await new Promise((resolve, reject) => {
53+
client.request('newTaskEncryptionKey', {userPubKey: publicKey},
54+
(err, response) => {
55+
if (err) {
56+
reject(err);
57+
return;
58+
}
59+
resolve(response);
60+
});
61+
});
62+
63+
const {result, id} = getEncryptionKeyResult;
64+
const {taskPubKey, sig} = result;
65+
// ToDo: verify signature
66+
return taskPubKey;
67+
}
68+
69+
function encrypt(taskPubKey, privateKey, variable){
70+
// Generate derived key from enclave public encryption key and user's private key
71+
const derivedKey = enigma.utils.getDerivedKey(taskPubKey, privateKey);
72+
// Encrypt function and ABI-encoded args
73+
return enigma.utils.encryptMessage(derivedKey, variable);
74+
}
75+
76+
function decrypt(taskPubKey, privateKey, enc_variable){
77+
// Generate derived key from enclave public encryption key and user's private key
78+
const derivedKey = enigma.utils.getDerivedKey(taskPubKey, privateKey);
79+
// Decrypt function and ABI-encoded args
80+
let outputHex = enigma.utils.decryptMessage(derivedKey, enc_variable);
81+
let outputStr = enigma.utils.hexToAscii(outputHex);
82+
return JSON.parse(outputStr);
83+
}
5184

52-
let {publicKey, privateKey} = getClientKeys();
5385

54-
console.log(publicKey)
86+
async function addData(userId, data){
87+
88+
let {publicKey, privateKey} = getClientKeys();
5589

5690
try {
57-
const getWorkerEncryptionKeyResult = await new Promise((resolve, reject) => {
58-
client.request('newTaskEncryptionKey', {userPubKey: publicKey},
91+
let taskPubKey = await getEncryptionKey(publicKey);
92+
let encryptedUserId = encrypt(taskPubKey, privateKey, userId);
93+
let encryptedData = encrypt(taskPubKey, privateKey, data);
94+
95+
const addPersonalDataResult = await new Promise((resolve, reject) => {
96+
client.request('addPersonalData', {
97+
encryptedUserId: encryptedUserId,
98+
encryptedData: encryptedData,
99+
userPubKey: publicKey},
59100
(err, response) => {
60101
if (err) {
61102
reject(err);
@@ -65,28 +106,30 @@ async function add_data(userId, data){
65106
});
66107
});
67108

68-
const {result, id} = getWorkerEncryptionKeyResult;
69-
const {taskPubKey, sig} = result;
70-
// ToDo: verify signature
109+
const {addPersonalData} = addPersonalDataResult;
71110

72-
// Generate derived key from worker's encryption key and user's private key
73-
const derivedKey = enigma.utils.getDerivedKey(taskPubKey, privateKey);
74-
// Encrypt function and ABI-encoded args
75-
const encryptedUserId = enigma.utils.encryptMessage(derivedKey, userId);
76-
const encryptedData = enigma.utils.encryptMessage(derivedKey, data);
77-
const msg = web3utils.soliditySha3(
78-
{t: 'bytes', v: encryptedUserId},
79-
{t: 'bytes', v: encryptedData},
80-
);
111+
if(addPersonalData.status == 0) {
112+
console.log('Personal data added successfully to the enclave.');
113+
} else {
114+
console.log('Something went wrong. Time to debug...')
115+
}
116+
} catch(err) {
117+
console.log(err);
118+
// Or throw an error
119+
}
120+
}
81121

82-
// const a = getClientKeys();
122+
async function findMatch(userId){
83123

84-
// console.log(a.publicKey);
124+
let {publicKey, privateKey} = getClientKeys();
85125

86-
const addPersonalDataResult = await new Promise((resolve, reject) => {
87-
client.request('addPersonalData', {
126+
try {
127+
let taskPubKey = await getEncryptionKey(publicKey);
128+
let encryptedUserId = encrypt(taskPubKey, privateKey, userId);
129+
130+
const findMatchResult = await new Promise((resolve, reject) => {
131+
client.request('findMatch', {
88132
encryptedUserId: encryptedUserId,
89-
encryptedData: encryptedData,
90133
userPubKey: publicKey},
91134
(err, response) => {
92135
if (err) {
@@ -97,26 +140,28 @@ async function add_data(userId, data){
97140
});
98141
});
99142

100-
const {addPersonalData} = addPersonalDataResult;
143+
if(findMatchResult.findMatch.status == 0) {
144+
console.log('Find Match operation successful');
101145

102-
if(addPersonalData.status == 0) {
103-
console.log('Personal data added successfully to the enclave.');
146+
let output = decrypt(taskPubKey, privateKey, findMatchResult.findMatch.encryptedOutput);
147+
148+
if(output.length){
149+
console.log('Find matches:');
150+
console.log(output);
151+
} else {
152+
console.log('No matches');
153+
}
104154
} else {
105155
console.log('Something went wrong. Time to debug...')
106156
}
107-
108-
109157
} catch(err) {
110-
console.log(err);
111-
// Or Throw an error
158+
console.log(err);
159+
// Or throw an error
112160
}
113-
114161
}
115162

116-
add_data('myUserId', 'myDataString')
117-
118-
119-
120-
let seed = '';
121163

164+
addData('user1', JSON.stringify(data.DataUser1));
165+
addData('user2', JSON.stringify(data.DataUser2));
122166

167+
findMatch('user1');

‎enclave/README.md‎

Lines changed: 7 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -24,54 +24,28 @@ This folder contains the code that runs inside the enclave using Intel Secure Gu
2424
git clone git@github.com:enigmampc/covid-self-reporting.git
2525
```
2626

27-
2. Move into this `enclave` subfolder:
27+
2. Install the SGX driver and SDK, as per these [instructions](https://github.com/enigmampc/EnigmaBlockchain/blob/master/docs/dev/setup-sgx.md).
2828

29-
```bash
30-
cd enclave
31-
```
3229

33-
3. Initialize the gitsubmodule:
30+
3. Move into the `enclave/safetrace` subfolder:
3431

3532
```bash
36-
cd incubator-teaclave-sgx-sdk
37-
git submodule init
38-
git submodule update
33+
cd enclave/safetrac
3934
```
4035

41-
4. Install the SGX driver and SDK, as per these [instructions](https://github.com/enigmampc/EnigmaBlockchain/blob/master/docs/dev/setup-sgx.md).
42-
43-
5. A sample code is temporarily included in this repo as a starting point. You can try it out:
36+
4. Compile the code:
4437

4538
```bash
46-
cd hello-rust
4739
make
48-
cd bin
49-
./app
5040
```
5141

52-
*Note: This code is very particular, and you need to run `./app` from inside the `bin` folder. If you try to run it from anywhere else (e.g. its parent folder, as in `./bin/app`), you will get the following error, because it expects another file in the same folder from where the command is run:*
42+
5. Run the enclave code:
5343

5444
```bash
55-
[-] Init Enclave Failed SGX_ERROR_ENCLAVE_FILE_ACCESS!`*
56-
```
57-
58-
Which should print something similar to this:
59-
60-
```bash
61-
[+] Init Enclave Successful 2!
62-
This is a normal world string passed into Enclave!
63-
This is a in-Enclave Rust string!
64-
gd: 1 0 0 1
65-
static: 1 eremove: 0 dyn: 0
66-
EDMM: 0, feature: 9007268796301311
67-
supported sgx
68-
[+] say_something success...
45+
cd bin
46+
./safetrace-app
6947
```
7048

7149
## ToDo
7250

73-
* Use the `hello-rust` folder and scaffolding for the COVID-19 code
74-
* Write the actual Rust code for the application
75-
* Implement Remote Attestation to provide proof of code running in legitimate enclave
76-
* Implement data sealing and unsealing choosing the right configuration so that data is uniquely assigned to this enclave
7751
* Sign code and deploy

0 commit comments

Comments
 (0)