This document describes how to build a Tencent SGX confidential computing environment in an M6ce instance and use the Intel SGX SDK to verify SGX features.
4. After installing the SGX runtime and Intel SGX SDK, restart the instance as instructed in Restarting Instances .
5. Configure the Tencent Cloud SGX remote attestation service.
The Tencent Cloud SGX remote attestation service is deployed at the regional level. You can access the service in the region where your SGX CVM instance resides to get the optimal experience. After you install the Intel SGX SDK, the default configuration file /etc/sgx_default_qcnl.conf of the service will be generated automatically. Manually modify the file in the following steps to adapt to the service in the region of your SGX CVM instance.
Note:
Currently, the SGX remote attestation service is available only in the Beijing, Shanghai, and Guangzhou regions.
Intel Ice Lake supports only the remote attestation method based on Intel SGX DCAP rather than Intel EPID.
Use the Vim editor to modify /etc/sgx_default_qcnl.conf as follows:
# To accept insecure HTTPS cert, set this option to FALSE
USE_SECURE_CERT=TRUE
Examples of SGX Feature Verification
Example 1. Start an enclave
The Intel SGX SDK provides sample SGX code for verifying SGX features in the default directory of /opt/intel/sgxsdk/SampleCode. The effect of this sample code (SampleEnclave) is to start an enclave to check whether the installed SGX SDK works normally and whether the confidential memory resource of your SGX CVM instance is available.
1. Run the following command to set the relevant environment variables of the Intel SGX SDK:
source /opt/intel/sgxsdk/environment
2. Run the following command to compile the sample code SampleEnclave:
cd /opt/intel/sgxsdk/SampleCode/SampleEnclave &&make
3. Run the following command to run the complied executable file:
./app
If a result in the following figure is returned, the enclave is started.
Example 2. Perform remote SGX verification
The code tree of Intel SGX provides sample code to verify the SGX remote attestation feature, i.e., DCAP. This example is to generate and verify a quote and involves the quote generator (QuoteGenerationSample) and verifier (QuoteVerificationSample).
1. Run the following command to set the relevant environment variables of the Intel SGX SDK:
source /opt/intel/sgxsdk/environment
2. Run the following commands in sequence to install Git and download the Intel SGX DCAP code tree:
