1"use strict";(self.webpackChunkedgemesh=self.webpackChunkedgemesh||[]).push([[633],{4211:(e,t,n)=>{n.r(t),n.d(t,{data:()=>s});const s={key:"v-3d611c39",path:"/proposal/edgemesh-security-proposal.html",title:"Motivation",lang:"en-US",frontmatter:{},excerpt:"",headers:[{level:2,title:"Architecture",slug:"architecture",children:[]},{level:2,title:"Workflow",slug:"workflow",children:[{level:3,title:"Configuration of edgemesh-server with security",slug:"configuration-of-edgemesh-server-with-security",children:[]},{level:3,title:"Configuration of edgemesh-agent with security",slug:"configuration-of-edgemesh-agent-with-security",children:[]}]}],filePathRelative:"proposal/edgemesh-security-proposal.md",git:{updatedTime:1684140832e3,contributors:[]}}},7874:(e,t,n)=>{n.r(t),n.d(t,{default:()=>P});var s=n(6252),a=n(3326);const r=(0,s._)("h1",{id:"motivation",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#motivation","aria-hidden":"true"},"#"),(0,s.Uk)(" Motivation")],-1),i=(0,s._)("p",null,"Currently, the connections between edgemesh-server and edgemesh-agent, edgemesh-agent and edgemesh-agent are not securely designed, i.e. there is no authentication, authentication, encryption between EdgeMesh's service. This can lead to major security issues for EdgeMesh.",-1),l=(0,s._)("h1",{id:"goal",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#goal","aria-hidden":"true"},"#"),(0,s.Uk)(" Goal")],-1),o=(0,s._)("ul",null,[(0,s._)("li",null,"Based on KubeEdge's security framework, support bidirectional authentication between EdgeMesh services"),(0,s._)("li",null,"Supports secure transfers between EdgeMesh services"),(0,s._)("li",null,"Support for security options is configurable")],-1),c=(0,s._)("h1",{id:"design-detail",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#design-detail","aria-hidden":"true"},"#"),(0,s.Uk)(" Design detail")],-1),u=(0,s._)("h2",{id:"architecture",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#architecture","aria-hidden":"true"},"#"),(0,s.Uk)(" Architecture")],-1),h=(0,s._)("p",null,[(0,s._)("img",{src:a,alt:"edgemesh-security-sequence"})],-1),d=(0,s._)("h2",{id:"workflow",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#workflow","aria-hidden":"true"},"#"),(0,s.Uk)(" Workflow")],-1),p=(0,s._)("p",null,[(0,s._)("strong",null,"step0:"),(0,s._)("br"),(0,s.Uk)(" Make sure the cloudcore is health. EdgeMesh apply certificate from cloudcore.")],-1),_=(0,s._)("p",null,[(0,s._)("strong",null,"step1:"),(0,s._)("br"),(0,s.Uk)(" EdgeMesh( including edgemesh-server and edgemesh-agent) requests for CA certificate from the CloudCore(this time they don't verify the certificate of each other)")],-1),g=(0,s._)("p",null,[(0,s._)("strong",null,"step2:"),(0,s._)("br"),(0,s.Uk)(" Return CA certificate directly to EdgeMesh without verifying identity.")],-1),k=(0,s._)("p",null,[(0,s._)("strong",null,"step3:"),(0,s._)("br"),(0,s.Uk)(" Hash the CA certificate, and compare it with the cahash in the token to verify the validness of CA certificate.")],-1),m=(0,s._)("p",null,[(0,s._)("strong",null,"step4:"),(0,s._)("br"),(0,s.Uk)(" Generate a pair of key and store the private key locally. Submit the certificate signing request(CSR) to CloudCore with token in the http header(this time only EdgeCore verifies the certificate of CloudCore using cacert from step2). Unlike EdgeCore, EdgeMesh requires the types of certificates to be {x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth} rather than {x509.ExtKeyUsageClientAuth}")],-1),f=(0,s._)("p",null,[(0,s._)("strong",null,"step5:"),(0,s._)("br"),(0,s.Uk)(" Parse and verify token, If successful, use the CA certificate to sign the CSR and return a certificate to EdgeMesh.")],-1),b=(0,s._)("strong",null,"step6:",-1),y=(0,s._)("br",null,null,-1),U=(0,s.Uk)(" Parse and verify token, If successful, use the CA certificate to sign the CSR and return a certificate to EdgeMesh. Then the edgemesh-server and edgemesh-agent, edgemesh-agent and edgemesh-agent can establish mutual authentication TLS using "),v={href:"https://github.com/khalid-jobs/go-libp2p-tls",target:"_blank",rel:"noopener noreferrer"},w=(0,s.Uk)("go-libp2p-tls-ca"),C=(0,s.Uk)(" library which forks from "),x={href:"https://github.com/libp2p/go-libp2p-tls",target:"_blank",rel:"noopener noreferrer"},E=(0,s.Uk)("go-libp2p-tls"),A=(0,s.Uk)(" and add the ca authentication feature."),M=(0,s._)("h3",{id:"configuration-of-edgemesh-server-with-security",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#configuration-of-edgemesh-server-with-security","aria-hidden":"true"},"#"),(0,s.Uk)(" Configuration of edgemesh-server with security")],-1),S=(0,s._)("div",{class:"language-yaml ext-yml line-numbers-mode"},[(0,s._)("pre",{class:"language-yaml"},[(0,s._)("code",null,[(0,s.Uk)(" "),(0,s._)("span",{class:"token punctuation"},"..."),(0,s._)("span",{class:"token punctuation"},"..."),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"modules"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"tunnel"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token comment"},"# insert the following"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"enableSecurity"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)(),(0,s._)("span",{class:"token boolean important"},"true"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"ACL"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token comment"},"# cloudcore's https api for crts sign apply"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"httpServer"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)(" <cloudhub"),(0,s._)("span",{class:"token punctuation"},"-"),(0,s.Uk)("https"),(0,s._)("span",{class:"token punctuation"},"-"),(0,s.Uk)("addr"),(0,s._)("span",{class:"token punctuation"},">"),(0,s.Uk)("\n")])]),(0,s._)("div",{class:"line-numbers"},[(0,s._)("span",{class:"line-number"},"1"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"2"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"3"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"4"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"5"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"6"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"7"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"8"),(0,s._)("br")])],-1),R=(0,s._)("h3",{id:"configuration-of-edgemesh-agent-with-security",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#configuration-of-edgemesh-agent-with-security","aria-hidden":"true"},"#"),(0,s.Uk)(" Configuration of edgemesh-agent with security")],-1),q=(0,s._)("div",{class:"language-yaml ext-yml line-numbers-mode"},[(0,s._)("pre",{class:"language-yaml"},[(0,s._)("code",null,[(0,s.Uk)(" "),(0,s._)("span",{class:"token punctuation"},"..."),(0,s._)("span",{class:"token punctuation"},"..."),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"modules"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"tunnel"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token comment"},"# insert the following"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"enableSecurity"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)(),(0,s._)("span",{class:"token boolean important"},"true"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"ACL"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token comment"},"# cloudcore's https api for crt sign apply"),(0,s.Uk)("\n "),(0,s._)("span",{class:"token key atrule"},"httpServer"),(0,s._)("span",{class:"token punctuation"},":"),(0,s.Uk)(" <cloudhub"),(0,s._)("span",{class:"token punctuation"},"-"),(0,s.Uk)("https"),(0,s._)("span",{class:"token punctuation"},"-"),(0,s.Uk)("addr"),(0,s._)("span",{class:"token punctuation"},">"),(0,s.Uk)("\n")])]),(0,s._)("div",{class:"line-numbers"},[(0,s._)("span",{class:"line-number"},"1"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"2"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"3"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"4"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"5"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"6"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"7"),(0,s._)("br"),(0,s._)("span",{class:"line-number"},"8"),(0,s._)("br")])],-1),L=(0,s._)("h1",{id:"future-development-tasks",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#future-development-tasks","aria-hidden":"true"},"#"),(0,s.Uk)(" Future development tasks")],-1),T=(0,s._)("ol",null,[(0,s._)("li",null,"certification rotation: The certification rotation will affect the connection between edgemesh-server and edgemesh-agent, edgemesh-agent and edgemesh-agent, we need think more about this.")],-1),K=(0,s._)("h1",{id:"related-link",tabindex:"-1"},[(0,s._)("a",{class:"header-anchor",href:"#related-link","aria-hidden":"true"},"#"),(0,s.Uk)(" Related Link")],-1),W=(0,s._)("ol",null,[(0,s._)("li",null,"kubeedge edge authentication: https://github.com/kubeedge/kubeedge/blob/master/docs/proposals/edge-authentication.md")],-1),P={render:function(e,t){const n=(0,s.up)("OutboundLink");return(0,s.wg)(),(0,s.iD)(s.HY,null,[r,i,l,o,c,u,h,d,p,_,g,k,m,f,(0,s._)("p",null,[b,y,U,(0,s._)("a",v,[w,(0,s.Wm)(n)]),C,(0,s._)("a",x,[E,(0,s.Wm)(n)]),A]),M,S,R,q,L,T,K,W],64)}}},3326:(e,t,n)=>{e.exports=n.p+"assets/img/edgemesh-security-sequence-uml.4b6a4631.png"}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.