Add Fabric Private Chaincode support

[mbrandenburger]

Fabric Private Chaincode allows to execute chaincode using trusted execution environments (i.e., Intel SGX). This adds another level of protection to the smart contract and its data.

The idea is to enable support for Fabric Private Chaincode to allow FSC users to develop and orchestrate applications with enhanced security requirements which can be satisfied using trusted execution.

[adecaro]

I would identify at least two macro tasks for this issue:

• Extending Fabric topology and NWO infrastructure to support FPC
• Adding support for the invocation of an FPC

[adecaro]

Regarding Extending Fabric topology and NWO infrastructure to support FPC, we need to identify a list of actions that are needed to bootstrap an FPC in a Fabric network. @mbrandenburger, do you want start sketching this list?

[mbrandenburger]

Let me summaries the FPC build and deployment steps here. All steps are taken from the FPC sample using the fabric-samples test network.

1. Build FPC Enclave Registry (ERCC). Outputs a docker image.

2. Build FPC chaincode (ECC) using the FPC SDK. Outputs a docker image and mrenclave (located in ${CC_PATH}/_build/lib/mrenclave)

   See an example here

3. Add externalBuilder to peer core.yaml

chaincode:
  externalBuilders:
    - path: /opt/gopath/src/github.com/hyperledger/fabric-private-chaincode/fabric/externalBuilder/chaincode_server
      name: fpc-external-launcher
      propagateEnvironment:
        - CORE_PEER_ID
        - FABRIC_LOGGING_SPEC

The external builder scripts are located in https://github.com/hyperledger/fabric-private-chaincode/tree/main/fabric/externalBuilder/chaincode_server/bin

1. Start fabric network

2. Install ERCC and ECC

   • Create package containing a connection.json
     https://github.com/hyperledger/fabric-private-chaincode/blob/main/samples/deployment/test-network/package.sh
     https://github.com/hyperledger/fabric-private-chaincode/blob/main/utils/packaging/utils.sh

   • Lifecycle install package, returns CHAINCODE_PKG_ID
     For ECC version use CC_VER="$(cat ${CC_PATH}/_build/lib/mrenclave)"

   • Lifecycle approve

   • Lifecycle commit

3. Spawn docker ERCC and ECC package

   Define container envs
   CHAINCODE_SERVER_ADDRESS, the chaincode server host and port
   CHAINCODE_PKG_ID, the package id returned during isntallation
   SGX_MODE=SIM, default set to simulation mode; set HW for hardware mode

   For SGX HW mode, mount SGX_DEVICE_PATH into ECC container

4. Invoke initEnclave at the peer which will host the enclave. This happens using the FPC Client SDK. See example.

[adecaro]

@mbrandenburger , questions:

• is the ERCC already available?
• does ERCC require external builder as well?

[mbrandenburger]

• is the ERCC already available?

Not yet published, working on that. Currently, ERCC images can be built from FPC source.

• does ERCC require external builder as well?

Yes