Monday, October 4, 2021

Secure a web app architecture with Azure confidential computing

In this post, we’ll show you how to build a Personal Identifiable Information (PII) -protecting web application architecture using Azure confidential computing (ACC). ACC completes your traditional cloud privacy with protections for data in use based on state-of-the-art hardware available in Azure today.

 

Architecture

The diagram below showcases a typical architecture pattern for hosting a web application (e.g. On-Premises or Cloud Platform):

 

stempesta_0-1633360730033.png

Typical architecture for a web application.

 

The problem with this typical approach is that malicious actors could gain access to, as well as manipulate, sensitive data running on this architecture. For example:

  • Curious SQL DBA - with db_owner  access can access sensitive tables, as well as leverage SQL Server Extended Events Sessions to intercept query predicates.
  • Curious VM admin - with access to application logs can manipulate sensitive application logs, e.g. to erase a subset of the history.
  • Curious host/provider admin - with access to the underlying Hypervisor can access the Virtual Machines.

 

Azure confidential computing enhances the security posture of your applications by protecting data and code when in use, that is when running and being processed in memory. This additional level of protection elevates the existing security posture in Azure by running application in hardware-encrypted trusted execution environments.

For an overview of what Azure confidential computing offers, please refer to this article: Navigating confidential computing across Azure

 

Going Confidential

Next, we'll show you how to enhance your web application privacy with Azure confidential computing.

stempesta_1-1633360730061.png

Confidential architecture leveraging Azure confidential computing services.

 

Core components:

 

All components of this architecture, including Sensitive DataSensitive Data Encryption KeysSensitive Application Logic and Sensitive Application logs - are hosted at or above the blue dotted line highlighted below:

stempesta_2-1633360730091.png

Trust boundary across Azure confidential computing services.


To transform an existing (or net-new) application to leverage confidentiality via ACC – the following activities can be easily accomplished for each of the 3 tiers of the application: Data, Code and Logs:

  1. Sensitive Data: For an existing database, to migrate the data to Azure SQL DB – Always Encrypted with secure enclaves, we can leverage any of the migration techniques available with Azure SQL DB today. For a net new database, we can leverage several techniques to hydrate our database – as illustrated in this repository via T-SQL.
  2. Sensitive Application Code: Azure Confidential VM with AMD EPYC 3 Sev-SNP allows us to lift-and-shift existing application logic - meaning there are no code changes expected of our application to take advantage of the elevated confidentiality. Any web app framework (see demo below for a simple ASP.NET example) can continue to function as is.
  3. Sensitive Application Logs: To programmatically send sensitive application logs to Azure Confidential Ledger, we can use any of the SDKs available. In the demo below, we use the Python SDK from PyPi for demonstration – at the time of writing Java and .NET SDK are available as well.

 

Demonstration

A live demonstration of this architecture pattern is showcased in the short demo video below. In this demonstration, we leverage a Confidential VM to emphasize one core point - no code changes are required of an existing application (in our case, an ASP.NET Web App) to run on an AMD Sev-SNP enabled Virtual Machine on Azure:


Demo Video from Build – starts at 27:34

 

Get Started

Instructions on how to publish this app are described on the author's GitHub repo.

 

Posted at https://sl.advdat.com/3DcOjNk