How to provision client assets into JWT token in Azure CVM?

Joey 40

Hi~

This question is related to this FAQ.

Currently, I am using an Azure SNP-CVM:

Image: Ubuntu Server 20.04 LTS (Confidential VM - SEV-SNP Only)

VMsize: DCa series

Enabled features: SecureBoot, Trusted Launch Feature, and EncOSdisk.

To do attestation, I have successfully installed the AttestationClient{cvm-platform-checker-exe} and acquired the JWT response.

My question is, how can I provision client assets into the JWT token generated by Azure attestation in SNP-CVM?

The official AMD SEV-SNP hardware offers this ability that allows the attester to provide 512-bit <REPORT_DATA>, like a public key, into the AMD-generated attestation report.

Sai Krishna Katakam 345 Reputation points Microsoft Vendor

2024-09-30T08:41:47.19+00:00

Hi Joey,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

To provision client assets into the JWT token generated by Azure attestation in SNP-CVM, follow these steps:

Make sure you have the AttestationClient installed and configured on your Confidential VM (CVM). This client will help you interact with the Azure Attestation service. Use the AttestationClient to generate an attestation report, which will include the necessary details about the VM’s state and configuration.

The AMD SEV-SNP hardware allows you to include a 512-bit REPORT_DATA in the attestation report. This can be a public key or any other client-specific data. You can set this REPORT_DATA using the AttestationClient before generating the attestation report.

Once the attestation report is generated, use it to acquire a JWT token from the Azure Attestation service. This token will include the REPORT_DATA you provided. The JWT token can now be used to authenticate and authorize access to your resources, containing the client assets you provisioned in the REPORT_DATA.

For detailed steps and examples, please refer to the documentation on Secure Key Release with Confidential VMs How To Guide.

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".
Sai Krishna Katakam 345 Reputation points Microsoft Vendor

2024-10-01T01:27:10.24+00:00

Hi Joey,

Just checking in to see if you had a chance to review my comment on your question. Please let us know if it was helpful and feel free to reach out if you have any further queries.

If you found the information useful, please click "Upvote" on the post to let us know.

Thank You.
Joey 40 Reputation points

2024-10-01T05:36:11.84+00:00

Hi Sai Krishna Katakam,

The document you referred to above, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of service Seucre Key Release (SKU). To perform the SKU release, it should use the Microsoft Azure Attestation service (MAA).

Are there samples or documents that tell me how to use MAA to achieve the SKU?

Another question: As I mentioned above, the original SNP Attestation offers a 512-bit REPORT_DATA field for customization. If I just want to provision some user data ( don't rely on Azure Key Vault/SKR) directly in the SNP attestation / JWT token, how can I do that?

Thank you for your help!
Joey 40 Reputation points

2024-10-01T05:45:04.9033333+00:00

Hi Sai Krishna Katakam,

The document you provided, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of using the SKR service. In this case, it should be achieved by using Microsoft Azure Attestation service (MAA). Are there specific samples/documents that can tell me how to perform MAA with SKR?

Another question is, if I just want to provide some user data directly in the SNP Attestation Report /Azure JWT that does not rely on the SKR service, how can I do that?
Joey 40 Reputation points

2024-10-01T05:47:19.2066667+00:00

Hi Sai Krishna Katakam,

The document you provided, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of using the SKR service. In this case, it should be achieved by using Microsoft Azure Attestation service (MAA) together with SKR. Are there samples/documents that can tell me how to perform MAA with SKR?

Another question is, if I just want to provide some user data directly in the SNP Attestation Report /Azure JWT that does not rely on the SKR service, how can I do that?

Thank you for your help!
Sai Krishna Katakam 345 Reputation points Microsoft Vendor

2024-10-01T08:31:45.5333333+00:00

Hi Joey,

Based on your latest comment for using the Microsoft Azure Attestation (MAA) service together with Secure Key Release (SKR), you can refer to the following resources:

Secure Key Release feature with AKV and Azure Confidential Computing (ACC): This document provides a detailed guide on how to perform SKR using MAA. It includes steps for setting up Azure Key Vault, creating a secure key release policy, and performing the release operation.

Azure Attestation Overview: This document offers an overview of Azure Attestation, including its integration with SKR.

Quickstart Set up Azure Attestation by using the Azure portal: This quickstart guide helps you set up and configure an attestation provider using the Azure portal.

Regarding your second question about providing user data directly in the SNP Attestation Report or Azure JWT without relying on the SKR service, you can customize the 512-bit REPORT_DATA field in the SNP attestation report. This field can be used to include user-specific data, which will then be part of the attestation token.

For more detailed guidance, you can refer to the Azure Attestation documentation and the specific sections on customizing attestation policies.
Secure Key Release with Confidential VMs How To Guide
Examples of an attestation token

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".

joeyjoy 20

Hi Sai Krishna Katakam,

I will go through the links you provided to figure out how to provision SKR and user data in JWT.

Here, I want to ask another question. As the initial question posted, I have installed the Attestation Client and can obtain the JWT token.

station_client$ sudo ./AttestationClient -o token
eyJhbGiLCJraWQiOiJKMHBBUGRmWFhIcVdXaW1nckg4NTN3TUlkaDUvZkxlMXo2dVNYWVBYQ2EwPSIsInR5cCI6IkpXVC
...
...
iI6IjEuMCJ9.uIGgXtjMswlHNhXiR27riErCU6fgCmvIvf3LtpiAFDyFMe_UitM4Zmkx_SGA_lgOtm9-uL2T45BUKmKlKv6VpUVIjHj2NPqXRi3eOjGmhGW6doiFlXyNN3td3gEbY16qobM6BiBAEMhxUrpQUQPF07GnX8KWGqZGvpy6UDtgmyOVK5Ztu9fUYinDd3Nnj6OssQI0dZk5jU87avzRtNinLTxKdREiRw00gyfJdYfpdUfSDMEGMcVv-S-LU4iydYaIHrfccgoaqJT3ukK74VgjbcwT2n5Dze54cgCGTnws9wqKt9G8zFF6amwrcouNLCsvxYDUNMp-r4BjA4-anw2XFg

With the parser, I can obtain the following info.:

{
  "alg": "RS256",
  "jku": "https://sharedeus2.eus2.attest.azure.net/certs",
  "kid": "J0pAPdfXXHqWWimgrH853wMIdh5/fLe1z6uSXYPXCa0=",
  "typ": "JWT"
}.{
  "exp": 1727800337,
  "iat": 1727771537,
  "iss": "https://sharedeus2.eus2.attest.azure.net",
  "jti": "9ce7081d108f631cf73b39b4cae5549d0a5bd5f946ea30c46ae9dead15e0b928",
  "nbf": 1727771537,
  "secureboot": true,
  "x-ms-attestation-type": "azurevm",
  "x-ms-azurevm-attestation-protocol-ver": "2.0",
  "x-ms-azurevm-attested-pcrs": [
...
...
} ] }, "x-ms-ver": "1.0" }.[Signature]

After searching some documents, I found that the signing certs and the JWT signature should be :

Signing certs:
"jku": "https://sharedeus2.eus2.attest.azure.net/certs"

Signature:
iI6IjEuMCJ9.uIGgXtjMswlHNhXiR27riErCU6fgCmvIvf3LtpiAFDyFMe_UitM4Zmkx_SGA_lgOtm9-uL2T45BUKmKlKv6VpUVIjHj2NPqXRi3eOjGmhGW6doiFlXyNN3td3gEbY16qobM6BiBAEMhxUrpQUQPF07GnX8KWGqZGvpy6UDtgmyOVK5Ztu9fUYinDd3Nnj6OssQI0dZk5jU87avzRtNinLTxKdREiRw00gyfJdYfpdUfSDMEGMcVv-S-LU4iydYaIHrfccgoaqJT3ukK74VgjbcwT2n5Dze54cgCGTnws9wqKt9G8zFF6amwrcouNLCsvxYDUNMp-r4BjA4-anw2XFg

If correct, my question is, how can I verify the JWT signature with the signing certs? I think there should be a code of practice.

I have searched some documents, and I found this document (https://video2.skills-academy.com/en-us/azure/attestation/overview) and the code samples (https://github.com/Azure-Samples/microsoft-azure-attestation/blob/e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c/sgx.attest.sample.oe.sdk/validatequotes.net/MaaQuoteValidator.cs#L62-L65) it given is not so clear.

joeyjoy 20 Reputation points

2024-10-01T12:10:27.47+00:00

Hi Sai Krishna Katakam,

I looked up some JWT standards, and now I know how they should be verified.
Sai Krishna Katakam 345 Reputation points Microsoft Vendor

2024-10-04T06:21:29.3566667+00:00

Hi Joey,

Base on your reply we assume that now you are able to verify the JWT signature with the signing certs.

If yes, please confirm on same.

Thank you.
joeyjoy 20 Reputation points

2024-10-04T09:32:33.1033333+00:00

Yes, it is a standard JWT validation process.
Joey 40 Reputation points

2024-10-06T06:42:22.3633333+00:00

Hi Sai Krishna Katakam,

Other than the SKR, I want to ask how I can provision the user data directly into the SNP Hardware report and then into the JWT. If there were documents or samples, that would be helpful.

In particular, from parsing the JWT, I noticed there is a 'user-data' field. Is it that the 512-bit <REPORT_DATA> field comes from the AMD SNP Hardware Attestation report?

Inside the SNP-CVM guest, how can I provision assets to this field in each request of a JWT token?

Many thanks~

1 answer

Rachid Labiëd 5 Reputation points

2024-10-04T09:36:16.7133333+00:00
To provisiion client assets into the JWT token generated by Azure Attestation in an SNP-CVM, you can follow these steps:

Use the Azure Attestation API**:** Utilize the Azure Attestation service to create a custom attestation policy that allows you to include client assets.

Prepare Your Attestation Request: When sending an attestation request, include your REPORT_DATA in the request body. This REPORT_DATA can include the public key or other assets you wish to provision.

Modify the AttestationClient: If you're using the AttestationClient, ensure it's configured to send the custom REPORT_DATA in the request.

Process the JWT Response**:** After the attestation is processed, the JWT token will include your client assets as part of its claims, which can then be used by your application.
Please sign in to rate this answer.

1 person found this answer helpful.
Joey 40 Reputation points

2024-10-06T06:32:18.4266667+00:00

Hi Rachid Labiëd,

This is exactly something I want to do. I think there are several key points:

Utilize the Azure Attestation service to create a custom attestation policy that allows you to include client assets;

Modify the AttestationClient to send custom REPORT_DATA in the request.

Are there any documents/samples about the issue? Especially for 'Modify the AttestationClient,' does it mean the default AttestationClient tool doesn't support the feature at the moment?

Rachid Labiëd 5 Reputation points

2024-10-06T07:21:21.12+00:00

Hi Joey, Hi,

that is correct regarding the steps to integrate client assets into the attestation process using Azure Attestation.

1. Azure Attestation Service and Custom Attestation Policy:

You can use the Azure Attestation service to define custom policies for verifying the integrity and authenticity of the environment where your application runs. This includes configuring policies that handle custom REPORT_DATA, which can include your client assets.

Custom attestation policy allows you to define rules on what the attestation token must contain, such as specific claims in the REPORT_DATA, to be deemed valid. You can find more about custom policies here: Azure Attestation Policies Documentation

2. Modifying the AttestationClient:

Modifying the AttestationClient refers to customizing how your client interacts with the Azure Attestation service. You would modify it to include custom REPORT_DATA in the request payload that is sent to the Azure Attestation service for verification.

The default AttestationClient may not natively support sending custom REPORT_DATA directly in all scenarios. In this case, you might need to extend the client code or use a lower-level API to modify the requests.

To help you get started, check out:

• Azure SDK for .NET Attestation Client Library

• Azure Attestation REST API Documentation

Sample Resources:

• A relevant sample for custom REPORT_DATA might be found in the official Azure-Samples repository or via the SDK docs:

• Azure Samples GitHub

• Azure Attestation SDK Examples

If the current AttestationClient doesn’t support the feature directly, modifying it to send your custom payloads would be the way forward. Using the REST API might also give you more control over the data you send.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to provision client assets into JWT token in Azure CVM?

1 answer

Your answer