secretflow / trustedflow Goto Github PK

按照https://www.secretflow.org.cn/zh-CN/docs/trustedflow/0.2.0b0/quick_start/step1#csvcapsulemanager通过海光csv虚拟机启动 capsule-manager-csv镜像，并通过ifconfig查找到虚拟机的ip地址为10.0.2.15
但是按照步骤二https://www.secretflow.org.cn/zh-CN/docs/trustedflow/0.2.0b0/quick_start/step2#id2上传密钥时显示
(capsule-manager-sdk) root@user:/home/alice# cms --config-file alice.yaml register-data-keys
Traceback (most recent call last):
  File "/root/miniconda3/envs/capsule-manager-sdk/bin/cms", line 8, in <module>
    sys.exit(cms())
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/cli/cms.py", line 142, in register_data_keys
    ctx.obj.create_data_keys(
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/sdc/capsule_manager_frame.py", line 321, in create_data_keys
    request, self.get_public_key(), private_key, cert_pems
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/sdc/capsule_manager_frame.py", line 208, in get_public_key
    response = self.stub.GetRaCert(request)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/grpc/_channel.py", line 1176, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/grpc/_channel.py", line 1005, in _end_unary_response_blocking
    raise _InactiveRpcError(state)  # pytype: disable=not-instantiable
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
	status = StatusCode.UNAVAILABLE
	details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:10.0.2.15:8888: Failed to connect to remote host: FD Shutdown"
	debug_error_string = "UNKNOWN:Error received from peer  {created_time:"2024-04-24T06:20:34.956096988+00:00", grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:10.0.2.15:8888: Failed to connect to remote host: FD Shutdown"}"
>
请问，如何找到海光csv虚拟机下开启docker中CapsuleManager的服务地址

---

数据存储（data-at-rest）加密
TrustedFlow向外部存储（比如硬盘、网络存储等）写入数据前，会对数据进行加密，且密钥仅TrustedFlow可访问。

请问数据加密存储，这个能力是在哪个组件实现的？

大佬，您好！我在SGX模式下运行示例到执行PSI计算时出错，且报错信息有多种：
第一种：
thread '<unnamed>' panicked at 'failed to sync when dropping the SEFS Inode: DeviceError(5)', /tmp/deb_build/occlum-0.30.1/occlum-src/deps/sefs/rcore-fs-sefs/src/lib.rs:805:14
stack backtrace:
note: Some details are omitted, call backtrace::enable_backtrace() with 'PrintFormat::Full' for a verbose backtrace.
fatal runtime error: failed to initiate panic, error 5
/opt/occlum/build/bin/occlum: line 472:   167 Illegal instruction     (core dumped) RUST_BACKTRACE=1 "$instance_dir/build/bin/occlum-run" "$@"

第二种：
thread '<unnamed>' panicked at 'called `Option::unwrap()` on a `None` value', /tmp/deb_build/occlum-0.30.1/occlum-src/deps/sefs/rcore-fs-unionfs/src/lib.rs:543:24
stack backtrace:
note: Some details are omitted, call backtrace::enable_backtrace() with 'PrintFormat::Full' for a verbose backtrace.
fatal runtime error: failed to initiate panic, error 5
/opt/occlum/build/bin/occlum: line 472:   199 Illegal instruction     (core dumped) RUST_BACKTRACE=1 "$instance_dir/build/bin/occlum-run" "$@"

配置中除了SGX模式特有的，其余都在仿真模式下测试过。请问可能是什么原因导致出错？

无。

-- Downloading... done
-- extracting...
     src='/workspaces/trustedflow/build/external/dcap/src/DCAP_1.19.tar.gz'
     dst='/workspaces/trustedflow/build/external/dcap/src/dcap'
-- extracting... [tar xfz]
-- extracting... [analysis]
-- extracting... [rename]
-- extracting... [clean up]
-- extracting... done
[ 82%] No update step for 'dcap'
[ 82%] Performing patch step for 'dcap'
error: corrupt patch at line 103
make[2]: *** [CMakeFiles/dcap.dir/build.make:121: external/dcap/src/dcap-stamp/dcap-patch] Error 128
make[1]: *** [CMakeFiles/Makefile2:837: CMakeFiles/dcap.dir/all] Error 2
make[1]: *** Waiting for unfinished jobs....

Follow the instructions in https://github.com/secretflow/trustedflow/tree/main/trustedflow/attestation#cmake

大佬，您好！为了启用mTLS，我用openssl分别生成carol、alice、bob的公私钥、csr文件,ca的key、csr文件和crt文件，然后用ca相关的文件生成carol、alice和bob的证书。
然后正常启动capsule_manager:
    server_cert_path: Some(
        "/home/admin/capsule-manager/resources/carol.crt",
    ),
    server_cert_key_path: Some(
        "/home/admin/capsule-manager/resources/carol.key",
    ),
    client_ca_cert_path: Some(
        "/home/admin/capsule-manager/resources/ca",
    ),
    enable_tls: Some(
        true,
    ),
    mode: Some(
        "simulation",
    ),
}
O, AntGroup
L, HZ
OU, SecretFlow
C, CN
ST, HZ
CN, CapsuleManager
[2024-04-23T06:22:40.489337480+00:00] [capsule_manager] [INFO] Server run at: 0.0.0.0:8888 mode Some("simulation")

但是我在上传密钥时失败
raise _InactiveRpcError(state)  # pytype: disable=not-instantiable
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
	status = StatusCode.UNAVAILABLE
	details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8888: Ssl handshake failed: SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED"
	debug_error_string = "UNKNOWN:Error received from peer  {created_time:"2024-04-23T14:22:50.752018831+08:00", grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8888: Ssl handshake failed: SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED"}"
问题似乎是证书有问题，请问我的证书生成过程有问题吗，或者是必须要真实CA机构签的证书？

感谢帮助！

alice.yaml：

host: "127.0.0.1:8888"
# (required) str, capsule-manager's tee platform type, sim/sgx/tdx/csv
tee_plat: "sim"
# (optional) capsule-manager's identity constraints
tee_constraints:
  # (optional) str, The measurement of TEE implement internal stuff
  mr_plat:
  # (optional) str, The measurement of TEE instance boot time stuff
  mr_boot:
  # (optional) str, The static measurement of trust application when loading the code
  mr_ta:
  # (optional) str, The measurement or other identity of the trust application signer
  mr_signer:

# (optional) str, root ca cert path
root_ca_file: /home/u22/ca.crt
# (optional) str, sdk's private key path
private_key_file: /home/u22/alice.key
# (optional) List[str], sdk's cert chain path
cert_chain_file: "/home/u22/alice.crt"

common:
   # (required) str, should be generated from cert
   party_id: "OSA5326M7KIG7KFYC2BHWGPMY6UXUK3AW67VFF5UB73DUZ62EVKA"
   # (required) List[str], cert chain files, the order is [cert, mid_ca_cert, root_ca_cert]
   # file num can be 1 if the cert is self-signed
   cert_pems_file: 
     - alice.crt
     - ca.crt
   scheme: "RSA"
   # (required) str, file contains private key
   private_key_file: alice.key


register_data_keys:
  data_keys:
    -
      # (required) str
      resource_uri: breast_cancer_alice
      # (required) str
      data_key_b64: "uhq65rYinNeMuHO1CR272w=="

您好，我在上传密钥时遇到了如下错误：
  File "/home/u22/anaconda3/envs/alice/lib/python3.10/site-packages/cli/cms.py", line 134, in register_data_keys
    data_key_b64 = data_key.get("data_key_b64")
AttributeError: 'str' object has no attribute 'get'
请问data_key_b64是否是填写之前通过cms_util generate-data-key-b64生成的密钥，并且应该如何正确的填写？

# Copyright 2023 Ant Group Co., Ltd.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# (required) str, capsule-manager's ip:port
host: "127.0.0.1:8888"
# (required) str, capsule-manager's tee platform type, sim/sgx/tdx/csv
tee_plat: "sim"
# (optional) capsule-manager's identity constraints
tee_constraints:
  # (optional) str, The measurement of TEE implement internal stuff
  mr_plat:
  # (optional) str, The measurement of TEE instance boot time stuff
  mr_boot:
  # (optional) str, The static measurement of trust application when loading the code
  mr_ta:
  # (optional) str, The measurement or other identity of the trust application signer
  mr_signer:

# (optional) str, root ca cert path
root_ca_file:
# (optional) str, sdk's private key path
private_key_file:
# (optional) List[str], sdk's cert chain path
cert_chain_file:

common:
  # (required) str, should be generated from cert
  party_id: "XDQSXTKQC4LGD3V5LXROVB5C4THPWULM45M6DQX32SPBAE7Y66DA"
  # (required) List[str], cert chain files, the order is [cert, mid_ca_cert, root_ca_cert]
  # file num can be 1 if the cert is self-signed
  cert_pems_file:
    - alice.crt
  # (required) str, keep it be "RSA" here
  scheme: "RSA"
  # (required) str, file contains private key
  private_key_file: alice.key


register_data_keys:
  data_keys:
      # (required) str
    resource_uri: breast_cancer_alice
      # (required) str
    data_key_b64: "peaNmQvlnFaEkJlATjruJQ=="

get_data_policys:
  # (required) str
  scope:

register_data_policy:
  # (required) str
  scope:
  # (required) str
  data_uuid:
  rules:
      # (required) str
    rule_id:
      # (required) List[str]
    grantee_party_ids:
      # (required) List[str]
    columns:
      # (optional) List[str]
    global_constraints:
      # (required) List[dict]
    op_constraints:
          # (required) str
      op_name:
          # (optional) List[str]
      constraints:

delete_data_policy:
  # (required) str
  scope:
  # (required) str
  data_uuid:

add_data_rule:
  # (required) str
  scope:
  # (required) str
  data_uuid:
  # (required) dict
  rule:
    # (required) str
    rule_id:
    # (required) List[str]
    grantee_party_ids:
    # (required) List[str]
    columns:
    # (optional) List[str]
    global_constraints:
    # (required) List[dict]
    op_constraints:
        # (required) str
      op_name:
        # (optional) List[str]
      constraints:

delete_data_rule:
  # (required) str
  scope:
  # (required) str
  data_uuid:
  # (required) str
  rule_id:

get_export_data_key_b64:
  # (required) str
  party_id:
  # (required) str
  resource_uri:
  # (required) str
  data_export_certificate_file:

delete_data_key:
  # (required) str
  resource_uri:

大佬，您好！我在仿真模式第四步运行psi时又遇到一个错误：
2024-04-18 09:19:21.941 [info] [app.cc:GetInputDataKeys:214] Got Ra Cert
2024-04-18 09:19:21.941 [info] [app.cc:GetInputDataKeys:215] Try to get data keys from Capsule Manager
2024-04-18 09:19:21.958 [error] [app.cc:Run:139] Running TEE application failed, error message: [Enforce fail at teeapps/framework/capsule_manager_client.cc:42] status.code() == secretflowapis::v2::Code::OK. Call service failed, error code: 7, message: err code: Permission denied; err detail: request is not satisfied with the policy breast_cancer_alice.; location: [line = 52, file = capsule-manager/src/core/policy_enforcer.rs]
Stacktrace:
#0 teeapps::framework::CapsuleManagerClient::GetDataKeys()+0x64c4a10f9836
#1 teeapps::framework::App::GetInputDataKeys()+0x64c4a10edddc
#2 teeapps::framework::App::PreProcess()+0x64c4a10eefc8
#3 teeapps::framework::App::Run()+0x64c4a10f0ebf
#4 main+0x64c4a10adb12
#5 (unknown)+0x7446f82aad90

2024-04-18 09:19:21.958 [error] [main.cc:main:53] [teeapps/framework/app.cc:143] Exiting application with exception task process error: 
 task execution error: 

之前的步骤都没有问题，请问可能是什么原因导致的？

无

执行到trustedflow框架的步骤二，第三步，仿真模式，第5的alice上传密钥"cms --config-file alice.yaml register-data-keys"命令后，报错。我检查了，第4的"register_data_keys"配置alice.yaml文件，格式和内容都没有错，密钥也对应上了。

报错信息如下：
Traceback (most recent call last):
 File "/root/miniconda3/envs/capsule-manager-sdk/bin/cms", line 8, in <module>
  sys.exit(cms())
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1157, in __call__
  return self.main(*args, **kwargs)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1078, in main
  rv = self.invoke(ctx)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1685, in invoke
  super().invoke(ctx)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 1434, in invoke
  return ctx.invoke(self.callback, **ctx.params)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/core.py", line 783, in invoke
  return __callback(*args, **kwargs)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/click/decorators.py", line 33, in new_func
  return f(get_current_context(), *args, **kwargs)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/cli/cms.py", line 55, in cms
  config = file.read_yaml_file(CONFIG_FILE)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/sdc/util/file.py", line 38, in read_yaml_file
  res = yaml.load(f)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/main.py", line 451, in load
  return constructor.get_single_data()
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/constructor.py", line 114, in get_single_data
  node = self.composer.get_single_node()
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 72, in get_single_node
  document = self.compose_document()
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 94, in compose_document
  node = self.compose_node(None, None)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 130, in compose_node
  node = self.compose_mapping_node(anchor)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 211, in compose_mapping_node
  item_value = self.compose_node(node, item_key)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 130, in compose_node
  node = self.compose_mapping_node(anchor)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 211, in compose_mapping_node
  item_value = self.compose_node(node, item_key)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 128, in compose_node
  node = self.compose_sequence_node(anchor)
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/composer.py", line 172, in compose_sequence_node
  while not self.parser.check_event(SequenceEndEvent):
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/parser.py", line 141, in check_event
  self.current_event = self.state()
 File "/root/miniconda3/envs/capsule-manager-sdk/lib/python3.10/site-packages/ruamel/yaml/parser.py", line 546, in parse_block_sequence_entry
  raise ParserError(
ruamel.yaml.parser.ParserError: while parsing a block collection
 in "alice.yaml", line 52, column 5
expected <block end>, but found '<scalar>'
 in "alice.yaml", line 56, column 7

alice.yaml文件只做了以下变动：
register_data_keys:
  data_keys:
    - 
      # (required) str
      resource_uri: breast_cancer_alice
      # (required) str
      data_key_b64: xxxx###对应上没问题的

运行 cms_config common --party-id xxx --scheme RSA  和 cms_config init --host {CapsuleManager的服务地址} --sim true --private-key-file alice.key --cert-chain-file alice.crt --root-ca-file alice_ca.crt 均会莫名增加!!python/tuple []

cms_util generate-party-id --cert-file alice.crt
BCXWUIUOSS34POIMZEPR7HJS7XW6HGCXDVTCPQFLKQMK6QHLU25Q
cms_config common --party-id BCXWUIUOSS34POIMZEPR7HJS7XW6HGCXDVTCPQFLKQMK6QHLU25Q --scheme RSA 
cli.yaml中显示
common:
  cert_pems_file: !!python/tuple []
  party_id: BCXWUIUOSS34POIMZEPR7HJS7XW6HGCXDVTCPQFLKQMK6QHLU25Q
  private_key_file: null
  scheme: RSA
CapsuleManager 显示
[2024-03-12T08:25:38.961825103+00:00] [monitor] [INFO] |create_data_keys|13|"err code: Assert err; err detail: party_id BCXWUIUOSS34POIMZEPR7HJS7XW6HGCXDVTCPQFLKQMK6QHLU25Q is wrong derived from public key; location: [line = 108, file = capsule-manager/src/server.rs]"

大佬，您好！我在用cms_util sign-vote-request --vote-request-file vote-request.yaml --signed-vote-request-file signed-vote-request.yam获取结果解密密钥时出现了一个错误:
  File "/home/u22/.local/lib/python3.10/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/u22/.local/lib/python3.10/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/home/u22/anaconda3/envs/alice/lib/python3.10/site-packages/cli/cms_util.py", line 216, in sign_vote_request
    cert_chain.append(file.read_file(filename, "r"))
  File "/home/u22/anaconda3/envs/alice/lib/python3.10/site-packages/sdc/util/file.py", line 26, in read_file
    with open(file_path, mode) as f:
FileNotFoundError: [Errno 2] No such file or directory: 'a'

我用查看下a的调用，发现似乎是cert_chain_file，但是我已经将alice.crt放到了运行命令的目录下。请问如何能解决这个问题？

vote_request:
  # (required) str, vote type, should be "TEE_DOWNLOAD" when export data keys for tee tasks' encrypted result
  type: "TEE_DOWNLOAD"
  # (required) int, vote approved threshold
  approved_threshold: 1
  # (required) str, vote approved action, shoule be "tee/download,xxxx_uuid", replace "xxxx_uuid" with tee task's result data_uuid
  approved_action: "tee/download,model_uuid"
  # (required) List[str], cert chain files, the order is [cert, mid_ca_cert, root_ca_cert]
  # file num can be 1 if the cert is self-signed
  cert_chain_file: "alice.crt"
  # (required) str, file contains private key
  private_key_file: "alice.key"

大佬，您好！我在最后一步从alice请求解密结果的密钥时失败。
    raise CapsuleManagerError(
sdc.error.CapsuleManagerError: CapsuleManager server error code: 13, error message: err code: Assert err; err detail: model_uuid xgb_model is not the same as expected; location: [line = 346, file = capsule-manager/src/core/model/request.rs]
model_uuid xgb_model应该是对应的一组吧，为什么会出错呢？

get_export_data_key_b64:
  # (required) str
  party_id: "XDQSXTKQC4LGD3V5LXROVB5C4THPWULM45M6DQX32SPBAE7Y66DA"
  # (required) str
  resource_uri: xgb_model
  # (required) str
  data_export_certificate_file: vote-result.json

您好，我按照快速上手教程执行到步骤二，在执行cms register-data-keys上传密钥时失败。报错信息为：
  File "/home/u22/anaconda3/envs/alice/lib/python3.8/site-packages/cli/cms.py", line 77, in cms
    config["host"], config["mr_enclave"], None, config["sim"]
cli.yaml中确实没有后两个选项，模板中也没有这两项。
请问如何才能正确的生成cli.yaml以正确地通过第二步？

配置文件
add_data_rule:
  data_uuid: null
  rule:
    columns: null
    global_constraints: null
    grantee_party_ids: null
    op_constraints:
    - constraints: null
      op_name: null
    rule_id: null
  scope: null
cert_chain_file: null
common:
  cert_pems_file: null
  party_id: ZFBZB6LPM4SAYH2JUTYD26D65MVO2IZWSABUVUEBF6A7GWVPEXUA
  private_key_file: null
  scheme: RSA
delete_data_key:
  resource_uri: null
delete_data_policy:
  data_uuid: null
  scope: null
delete_data_rule:
  data_uuid: null
  rule_id: null
  scope: null
get_data_policys:
  scope: null
get_export_data_key_b64:
  data_export_certificate_file: null
  party_id: null
  resource_uri: null
host: 127.0.0.1:8888
private_key_file: null
register_data_keys:
  resource_uris:
    - breast_cancer_alice
  data_key_b64s: 
    - Rg0QdwhWd6hugT9KS78cTA==
  data_keys:
  - data_key_b64: null
    resource_uri: null
register_data_policy:
  data_uuid: null
  rules:
  - columns: null
    global_constraints: null
    grantee_party_ids: null
    op_constraints:
    - constraints: null
      op_name: null
    rule_id: null
  scope: null
root_ca_file: null
tee_constraints:
  mr_boot: null
  mr_plat: null
  mr_signer: null
  mr_ta: null
tee_plat: sim