Cerberus 项目Project Cerberus

Cerberus 是符合 NIST 800-193 要求的硬件信任根,其标识无法克隆。Cerberus is a NIST 800-193 compliant hardware root-of-trust with an identity that cannot be cloned. Cerberus 旨在通过为固件完整性提供强大的信任锚来进一步提高 Azure 基础结构的安全状况。Cerberus is designed to further raise the security posture of Azure infrastructure by providing a strong anchor of trust for firmware integrity.

启用信任锚Enabling an anchor of trust

每个 Cerberus 芯片都有一个唯一的加密标识,该标识是使用植根于 Microsoft 证书颁发机构 (CA) 的签名证书链建立的。Every Cerberus chip has a unique cryptographic identity that is established using a signed certificate chain rooted to a Microsoft certificate authority (CA). 从 Cerberus 获得的度量可用于验证组件的完整性,例如:Measurements obtained from Cerberus can be used to validate integrity of components such as:

  • 主机Host
  • 基板管理控制器 (BMC)Baseboard Management Controller (BMC)
  • 所有外设,包括网络接口卡和系统芯片 (SoC)All peripherals, including network interface card and system-on-a-chip (SoC)

此信任锚可帮助保护平台固件免受以下攻击:This anchor of trust helps defend platform firmware from:

  • 平台上运行的已泄露固件二进制文件Compromised firmware binaries running on the platform
  • 利用操作系统、应用程序或虚拟机监控程序中的 bug 的恶意软件和黑客Malware and hackers that exploit bugs in the operating system, application, or hypervisor
  • 某些类型的供应链攻击(制造、组装、运输)Certain types of supply chain attacks (manufacturing, assembly, transit)
  • 具有管理特权或硬件访问权限的恶意内部攻击Malicious insiders with administrative privileges or access to hardware

Cerberus 证明Cerberus attestation

Cerberus 使用平台固件清单 (PFM) 验证服务器组件的固件完整性。Cerberus authenticates firmware integrity for server components using a Platform Firmware Manifest (PFM). PFM 定义授权固件版本的列表,并为 Azure 主机证明服务提供平台度量。PFM defines a list of authorized firmware versions and provides a platform measurement to the Azure Host Attestation Service. 主机证明服务可验证度量,并决定仅允许受信任的主机加入 Azure 机群以及托管客户工作负载。The Host Attestation Service validates the measurements and makes a determination to only allow trusted hosts to join the Azure fleet and host customer workloads.

结合主机证明服务,Cerberus 的功能可以增强和提升高度安全的 Azure 生产基础结构。In conjunction with the Host Attestation Service, Cerberus’ capabilities enhance and promote a highly secure Azure production infrastructure.

备注

要了解详细信息,请参阅 GitHub 上的 Project Cerberus 信息。To learn more, see the Project Cerberus information on GitHub.

后续步骤Next steps

若要详细了解为提高平台完整性和安全性而做的工作,请参阅:To learn more about what we do to drive platform integrity and security, see: