System Architecture
Technical Principles
The CCA Kit implements the cVM capabilities in the Armv9 CCA. Figure 1 shows the technical principles of the CCA Kit.
CCA builds a Realm Management Monitor (RMM) based on an Arm trusted firmware (ATF). This module implements mechanisms for memory isolation, context management, lifecycle management, and page table management across cVMs, enabling the migration of customer applications to a confidential environment without modification.
Security
CCA cVMs leverage isolation mechanisms to construct an isolated, verifiable execution environment based on the underlying system hardware and software, protecting internal code and data from external access or tampering. Even attackers with the highest system privilege cannot access the code and data in the CCA cVMs.
CCA cVMs use the remote verification mechanism to verify signatures through the Public Key Infrastructure (PKI) provided by the remote attestation service. This establishes trust in the initial state of the internal software within the cVMs, thereby building a complete chain of trust.
Combined with conventional data encryption technologies, CCA cVMs offer a secure environment for data storage, transfer, and computing throughout the data lifecycle. They use hardware mechanisms to ensure that data is available but invisible.
CCA Kit Architecture
The Kunpeng BoostKit Confidential Computing CCA Kit mainly includes virtualization components (such as Host OS, Guest kernel, and QEMU), the RMM module, and hardware-level firmware, as shown in Figure 2 CCA framework.
Category |
Subcategory |
Description |
|---|---|---|
Open-source software |
Virtualization components such as the host OS, guest kernel, and QEMU |
Customers can choose a CCA-compatible Linux OS to install the host and guest OS kernels. The host and guest OS kernels are open-sourced in the openEuler community. libvirt and QEMU: deploy and manage cVMs. KVM: runs in the normal world to schedule tasks, allocate resources, and manage the lifecycle of all cVMs. Realm Management Interface (RMI): KVM communicates with RMM through the RMI. |
Huawei deliverables |
RMM |
A virtualization component running in the CCA. It is responsible for the virtualization management of cVM CPUs and memory. Generally, if a customer purchases a Kunpeng server that supports the CCA Kit, the RMM is pre-integrated into the hardware platform and can be updated through subsequent RMM upgrades. |
Hardware-level Firmware |
To support the CCA Kit, the hardware-level firmware has been adapted as follows:
|