Ikhtisar Remote attestation service - Elastic Compute Service

Remote attestation service Alibaba Cloud merupakan solusi atestasi terpadu yang memverifikasi kepercayaan platform dan integritas binari yang berjalan di atasnya. Layanan ini mendukung atestasi lingkungan Trusted Platform Module (TPM) dan Trusted Execution Environment (TEE). Topik ini menjelaskan cara kerja Remote attestation service dan cara menggunakannya.

Cara kerja remote attestation service

Remote attestation service Alibaba Cloud dibuat berdasarkan RFC 9394 - Remote Attestation Procedures (RATS) Architecture dan digunakan untuk memverifikasi status keamanan dan kepercayaan instans Elastic Compute Service (ECS) yang memiliki fitur keamanan tingkat lanjut. Proses atestasi melibatkan entitas berikut:

Attester: Pengguna instans ECS yang perlu membuktikan keamanan identitas dan kepercayaan instans ECS.
Relying party: Entitas yang memverifikasi identitas dan kepercayaan Attester. Relying party menghasilkan appraisal policy berdasarkan metrik dari TPM dan TEE.
Verifier: Remote attestation service Alibaba Cloud, yang membandingkan evidence terhadap appraisal policy dan mengembalikan hasil atestasi.

Remote attestation service umumnya digunakan berdasarkan Passport Model dan Background-Check Model. Kedua model memiliki perbedaan berikut:

Passport Model memberikan skalabilitas lebih baik ketika jumlah Attester jauh lebih sedikit dibandingkan jumlah relying party.
Dalam Background-Check Model, relying party dapat menghubungi verifier (Remote attestation service Alibaba Cloud) untuk remote attestation kapan saja, sehingga memberikan keamanan lebih baik.

Penagihan

Anda tidak dikenakan biaya untuk remote attestation service.

Namun, Anda akan dikenakan biaya untuk instans ECS yang menggunakan remote attestation service.

Contoh API

Remote attestation service mendukung instans komputasi tepercaya berbasis Virtual TPM (vTPM) dan instans komputasi confidential berbasis Intel Software Guard Extensions (SGX), Trust Domain Extensions (TDX), serta Enclave.

Untuk menggunakan remote attestation service pada vTPM, Anda harus mengaktifkan Security Center (SAS) pada akun Alibaba Cloud Anda.
Untuk instans yang menggunakan Intel SGX atau TDX, Anda dapat menggunakan remote attestation service melalui permintaan HTTP anonim.

API terkait OIDC

Remote attestation service Alibaba Cloud menyediakan API kompatibel OpenID Connect (OIDC). Anda dapat menganggap remote attestation service Alibaba Cloud sebagai layanan Identity Provider (IdP) standar.

Remote attestation service Alibaba Cloud memberikan token OIDC kepada instans komputasi tepercaya dan instans komputasi confidential guna membuktikan identitas instans kepada relying party.
Relying party dapat memverifikasi validitas kriptografi token OIDC menggunakan proses OIDC standar.

OIDC Discovery

OIDC Discovery menyederhanakan dan mengotomatiskan proses interaksi antara relying party dan remote attestation service. OIDC Discovery memungkinkan relying party memperoleh informasi konfigurasi autentikasi secara dinamis melalui endpoint standar .well-known/openid-configuration tanpa perlu konfigurasi manual atau hardcoding.

Sebagai contoh, Anda dapat mengonfigurasi remote attestation service Alibaba Cloud sebagai IdP eksternal untuk Alibaba Cloud Resource Access Management (RAM) atau AWS Identity and Access Management (IAM) guna menyediakan kredensial identitas bagi instans komputasi tepercaya dan instans komputasi confidential.

curl https://attest.cn-beijing.aliyuncs.com/.well-known/openid-configuration

Contoh respons berhasil:

{
  "authorization_endpoint": "https://attest.cn-beijing.aliyuncs.com/authorize",
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "issuer": "https://attest.cn-beijing.aliyuncs.com",
  "jwks_uri": "https://attest.cn-beijing.aliyuncs.com/jwks.json",
  "response_types_supported": [
    "code",
    "code id_token",
    "id_token",
    "token id_token"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint": "https://attest.cn-beijing.aliyuncs.com/token",
  "userinfo_endpoint": "https://attest.cn-beijing.aliyuncs.com/userinfo"
}

Remote attestation untuk instans vTPM

Untuk informasi tentang instans komputasi tepercaya, lihat Ringkasan kemampuan komputasi tepercaya.

Kirim evidence

Contoh permintaan (Operasi PutMessage dapat dipanggil setelah autentikasi. Untuk informasi lebih lanjut, lihat Sintaks permintaan dan metode signature):

access https://trusted-server.cn-hangzhou.aliyuncs.com?Action=PutMessage&PropertyUuid=0f74b5cc-ff0e-4fa6-b457-************&FileData=******************

Contoh respons berhasil:

{
	"PropertyName": "instance-name",
	"SystemTrustDetail": {
		"pcr3": "d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198exxxx",
		"pcr4": "c35cef3b92c3850dc0bfa6139b25dc1c4c3d642b8587bde0fiemd847ufjxxxx",
		"pcr5": "aabd7d8c76c931dabed7ea53d1c8f96036c42a29435680ddff3f3148ff70xxxx",
		"pcr6": "d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198exxxx",
		"pcr0": "d22aa1bba22e829456f0cfda0d87690e6c252032864643da353133f161xxxx",
		"pcr1": "d9f056a703f04e4f408445752e97e92c890266d32e2ff1df3e80545aab4fxxxx",
		"pcr2": "d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198exxxx",
		"pcr7": "dd794f2d0c4cfa28dc9b5a3266e8516378ba551190d9844c38b890f7ad27xxxx",
		"pcr8": "deb301d065009d62980110d8173e350bbd43a4997ad74bf358ce5399c0ecxxxx",
		"pcr9": "ffe25e93ac7d245159184ac68c7dd5783e4cea978fafb1ad036bc861a8cdxxxx"
	},
	"RequestId": "D0E0C1D2-2937-54D4-9C52-XXXXXXXXXXXX",
	"SystemExceptionNum": 0,
	"ProgramWhiteListId": -1,
	"SystemWhiteListId": 1234,
	"ProgramTrustStatus": 4,
	"SystemTrustStatus": 1,
	"GmtModified": 1698975648000,
	"ProgramWhiteListName": "",
	"GmtRecentReport": 1698975648000,
	"OnlineStatus": 1,
	"Extensions": {
		"pcr5": "d1dac9c104c63c7e24f27962f4ad1df639a3f3224b1a968a45916207cf3xxxx"
	},
	"PropertyPrivateIp": "1.1.X.X",
	"PropertyPublicIp": "1.1.X.X",
	"GmtCreate": 1698385542000,
	"PropertyUuid": "c13fcabe-6683-4a9f-8cdd-xxxxxxxxxxxx",
	"ProgramTrustDetail": "{}",
	"ProgramExceptionNum": 0,
	"PropertyAffiliation": 1
}

Hasil kueri attestation

Contoh permintaan:

access https://trusted-server.cn-beijing.aliyuncs.com?Action=DescribeInstance&PropertyUuid=0f74b5cc-ff0e-4fa6-b457-1dc58072****

Contoh respons berhasil:

{
  "RequestId": "473469C7-AA6F-4DC5-B3DB-A3DC0DE3****"
  "data": {
    "nextClientIMAIndex": 0,
    "systemVerificationResult": {
      "status": 1,
      "code": "TrustedStatus"
    },
    "programVerificationResult": {
      "status": 1,
      "code": "TrustedStatus"
    }
  }
}

Remote attestation untuk instans SGX atau TDX

Untuk informasi tentang instans SGX dan TDX, lihat Buat lingkungan komputasi rahasia SGX dan Buat lingkungan komputasi rahasia TDX.

Peroleh informasi Trusted Computing Base (TCB)

Contoh permintaan:

curl https://sgx-dcap-server.cn-beijing.aliyuncs.com/sgx/certification/v3/tcb?fmspc=00606A000000

Contoh respons berhasil:

{
	"tcbInfo": {
		"version": 2,
		"issueDate": "2023-10-11T08:09:33Z",
		"nextUpdate": "2023-12-18T08:09:33Z",
		"fmspc": "00606A000000",
		"pceId": "0000",
		"tcbType": 0,
		"tcbEvaluationDataNumber": 12,
		"tcbLevels": [{
			"tcb": {
				"sgxtcbcomp01svn": 4,
				"sgxtcbcomp02svn": 4,
				"sgxtcbcomp03svn": 3,
				"sgxtcbcomp04svn": 3,
				"sgxtcbcomp05svn": 255,
				"sgxtcbcomp06svn": 255,
				"sgxtcbcomp07svn": 0,
				"sgxtcbcomp08svn": 0,
				"sgxtcbcomp09svn": 0,
				"sgxtcbcomp10svn": 0,
				"sgxtcbcomp11svn": 0,
				"sgxtcbcomp12svn": 0,
				"sgxtcbcomp13svn": 0,
				"sgxtcbcomp14svn": 0,
				"sgxtcbcomp15svn": 0,
				"sgxtcbcomp16svn": 0,
				"pcesvn": 11
			},
			"tcbDate": "2021-11-10T00:00:00Z",
			"tcbStatus": "UpToDate"
		}, {
			"tcb": {
				"sgxtcbcomp01svn": 4,
				"sgxtcbcomp02svn": 4,
				"sgxtcbcomp03svn": 3,
				"sgxtcbcomp04svn": 3,
				"sgxtcbcomp05svn": 255,
				"sgxtcbcomp06svn": 255,
				"sgxtcbcomp07svn": 0,
				"sgxtcbcomp08svn": 0,
				"sgxtcbcomp09svn": 0,
				"sgxtcbcomp10svn": 0,
				"sgxtcbcomp11svn": 0,
				"sgxtcbcomp12svn": 0,
				"sgxtcbcomp13svn": 0,
				"sgxtcbcomp14svn": 0,
				"sgxtcbcomp15svn": 0,
				"sgxtcbcomp16svn": 0,
				"pcesvn": 10
			},
			"tcbDate": "2020-11-11T00:00:00Z",
			"tcbStatus": "OutOfDate"
		}, {
			"tcb": {
				"sgxtcbcomp01svn": 4,
				"sgxtcbcomp02svn": 4,
				"sgxtcbcomp03svn": 3,
				"sgxtcbcomp04svn": 3,
				"sgxtcbcomp05svn": 255,
				"sgxtcbcomp06svn": 255,
				"sgxtcbcomp07svn": 0,
				"sgxtcbcomp08svn": 0,
				"sgxtcbcomp09svn": 0,
				"sgxtcbcomp10svn": 0,
				"sgxtcbcomp11svn": 0,
				"sgxtcbcomp12svn": 0,
				"sgxtcbcomp13svn": 0,
				"sgxtcbcomp14svn": 0,
				"sgxtcbcomp15svn": 0,
				"sgxtcbcomp16svn": 0,
				"pcesvn": 5
			},
			"tcbDate": "2018-01-04T00:00:00Z",
			"tcbStatus": "OutOfDate"
		}]
	},
	"signature": "21750a9a4173140379971c9eeaeee8dd27364cae4fdc45e19825bcddb0e5942941cb7cad8067aaaa98c75a0a0cfa9de329eb7d875957bd633a248bc328a0xxxx"
}

Peroleh identitas Quoting Enclave (QE)

Contoh permintaan:

curl https://sgx-dcap-server.cn-beijing.aliyuncs.com/sgx/certification/v3/qe/identity

Contoh respons berhasil:

{
	"enclaveIdentity": {
		"id": "QE",
		"version": 2,
		"issueDate": "2023-11-01T14:57:38Z",
		"nextUpdate": "2023-12-01T14:57:38Z",
		"tcbEvaluationDataNumber": 16,
		"miscselect": "00000000",
		"miscselectMask": "FFFFFFFF",
		"attributes": "11000000000000000000000000000000",
		"attributesMask": "FBFFFFFFFFFFFFFF0000000000000000",
		"mrsigner": "8C4F5775D796503E96137F77C68A829A0056AC8DED70140B081B094490C5xxxx",
		"isvprodid": 1,
		"tcbLevels": [{
				"tcb": {
					"isvsvn": 8
				},
				"tcbDate": "2023-08-09T00:00:00Z",
				"tcbStatus": "UpToDate"
			},
			{
				"tcb": {
					"isvsvn": 6
				},
				"tcbDate": "2021-11-10T00:00:00Z",
				"tcbStatus": "OutOfDate"
			}, {
				"tcb": {
					"isvsvn": 5
				},
				"tcbDate": "2020-11-11T00:00:00Z",
				"tcbStatus": "OutOfDate"
			}, {
				"tcb": {
					"isvsvn": 4
				},
				"tcbDate": "2019-11-13T00:00:00Z",
				"tcbStatus": "OutOfDate"
			}, {
				"tcb": {
					"isvsvn": 2
				},
				"tcbDate": "2019-05-15T00:00:00Z",
				"tcbStatus": "OutOfDate"
			}, {
				"tcb": {
					"isvsvn": 1
				},
				"tcbDate": "2018-08-15T00:00:00Z",
				"tcbStatus": "OutOfDate"
			}
		]
	},
	"signature": "593f79398d6400e62d14f1066e69e4e5bb44ed7544b18713d8020354e7601481681dc812a124672bfedd0e54ab31179fac442400c011ebca6b00c44d805bxxxx"
}

Peroleh identitas Quote Verification Enclave (QVE)

Contoh permintaan:

curl https://sgx-dcap-server.cn-beijing.aliyuncs.com/sgx/certification/v3/qve/identity

Contoh respons berhasil:

{
	"enclaveIdentity": {
		"id": "QVE",
		"version": 2,
		"issueDate": "2023-11-01T15:45:01Z",
		"nextUpdate": "2023-12-01T15:45:01Z",
		"tcbEvaluationDataNumber": 16,
		"miscselect": "00000000",
		"miscselectMask": "FFFFFFFF",
		"attributes": "01000000000000000000000000000000",
		"attributesMask": "FBFFFFFFFFFFFFFF0000000000000000",
		"mrsigner": "8C4F5775D796503E96137F77C68A829A0056AC8DED70140B081B094490C5xxxx",
		"isvprodid": 2,
		"tcbLevels": [{
			"tcb": {
				"isvsvn": 3
			},
			"tcbDate": "2023-08-09T00:00:00Z",
			"tcbStatus": "UpToDate"
		}]
	},
	"signature": "251bb1301cb499cb8161a9b885fad8ceeb06b497f1e4a83c8de2d0f2e9e82c3ce0f22ce2ef6c6a789dcc287bb0a1da12a822a465395b54c9046aacfee7ceaff6"
}

Remote attestation untuk instans TDX

Peroleh token OIDC

Kirim TEE evidence ke remote attestation service Alibaba Cloud. Layanan akan mengevaluasi evidence berdasarkan platform policy dan mengembalikan JSON Web Token (JWT, RFC 7519) yang dibuat oleh Alibaba Cloud.

curl -X POST https://attest.cn-beijing.aliyuncs.com/v1/attestation -d '{
  "evidence": "evidencebase64",
  "tee": "tdx",
  // empty policy_ids means only check the cryptographic integrity of the evidence
  "policy_ids": []
}'

Tabel berikut menjelaskan field dalam request body.

Field	Tipe	Deskripsi
tee	String	Tipe TEE. Nilai yang valid termasuk: `tdx`: Instans Intel TDX. `nvgpu`: Instans yang dipercepat GPU NVIDIA. `acstdxnvgpu`: Instans komputasi rahasia Alibaba Cloud.
evidence	String	Evidence yang di-encode dengan URL SAFE NO PAD Base64.
policy_ids	String[]	Daftar policy ID yang digunakan untuk memeriksa evidence. `policy_ids` bersifat opsional. Jika field ini dikosongkan, nilai default akan digunakan.
runtime_data	JSON	Opsional. Runtime data. Jika runtime_data ditentukan, field `raw` harus berisi fragmen runtime data yang di-encode Base64, sebagai runtime data ekspektasi untuk diperiksa terhadap data dalam evidence. Contoh: `{"raw": "YWFhCg==..."}`.

Respons berupa JWT yang sesuai dengan standar OIDC. Contoh respons:

eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ2NTM1NTBjLTU1NTEtNWU2Zi05MmI1LTIyZjUzMDIyOTc1MSIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJodHRwczovL2F0dGVzdC5jbi1iZWlqaW5nLmFsaXl1bmNzLmNvbSIsImN1c3RvbWl6ZWRfY2xhaW1zIjp7ImluaXRfZGF0YSI6bnVsbCwicnVudGltZV9kYXRhIjpudWxsfSwiZWF0X3Byb2ZpbGUiOiJodHRwczovL3d3dy5hbGliYWJhY2xvdWQuY29tL2hlbHAvZW4vZWNzL3VzZXItZ3VpZGUvZWF0LXByb2ZpbGUiLCJldmFsdWF0aW9uLXJlcG9ydHMiOlt7InBvbGljeS1oYXNoIjpudWxsLCJwb2xpY3ktaWQiOiJkZWZhdWx0In1dLCJleHAiOjE3NDMwMDUzNjUsImlhdCI6MTc0Mjk4Mzc2NSwiaXNzIjoiaHR0cHM6Ly9hdHRlc3QuY24tYmVpamluZy5hbGl5dW5jcy5jb20iLCJqdGkiOiIwMzljZGZjOS02ZWMxLTQxZDQtOGRhOC02YTU5NTg0YzJmYTkiLCJuYmYiOjE3NDI5ODM3NjUsInRjYi1zdGF0dXMiOiJ7XCJpbml0X2RhdGFcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwicmVwb3J0X2RhdGFcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwXCIsXCJ0ZHgucXVvdGUuYm9keS5tcl9jb25maWdfaWRcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkubXJfb3duZXJcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkubXJfb3duZXJfY29uZmlnXCI6XCIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDBcIixcInRkeC5xdW90ZS5ib2R5Lm1yX3NlYW1cIjpcIjFjYzZhMTdhYjc5OWU5YTY5M2ZhYzc1MzZiZTYxYzEyZWUxZTBmYWJhZGE4MmQwYzk5OWUwOGNjZWUyYWE4NmRlNzdiMDg3MGY1NThjNTcwZTdmZmU1NWQ2ZDQ3ZmEwNFwiLFwidGR4LnF1b3RlLmJvZHkubXJfc2VydmljZXRkXCI6XCIzODNjODdkM2JiYjA0N2IyZDE3MWVhY2E5NTMxMmVkZTk5ZjI1ODA4OGRjNzg4ZjZhZTJjY2Y4YjZkZDg0OGZlOGQ0NzYyOWUwOGIzZjZjYmQ0YTAwZGQ0N2E1YTAzM2RcIixcInRkeC5xdW90ZS5ib2R5Lm1yX3RkXCI6XCJiMGU1MmM1OTU3NzUyM2IxN2FkNTUzYzZmZmZiMGY1ZjM0OTZkYmYzY2NjYTY5ZmJiMmVhODdjZjRmOTM4MTU3NTUwMDA1YzkyYTk4MTMwZDhkMzA1MDdjYTVjNjUyZGZcIixcInRkeC5xdW90ZS5ib2R5Lm1yc2lnbmVyX3NlYW1cIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkucmVwb3J0X2RhdGFcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwXCIsXCJ0ZHgucXVvdGUuYm9keS5ydG1yXzBcIjpcIjIyM2JlNjdmMWRiYzBjMmM2N2JiYWU5MTliMjk1MGY2MGY2OGFhYTlkNjA5NzM5OGFmMmRhZGE2ZDk4Zjk2NGY2YWVjY2U5YjM3NjQzYTc2NzA4ZTA3ZTBkOTUxOWY4NFwiLFwidGR4LnF1b3RlLmJvZHkucnRtcl8xXCI6XCI1YzNjZDMzNjQ4YmQ0N2I4ZDI0MjZlYzQ3NjBlMGYwZGI1MTAzYjk1NmY4ZTAzN2VmMmIxNzkzOWVkMTI1YTI5N2U5NjZmMzExMTJjMDUwYjVhMDliNDQ0ZmI2NDMyZDdcIixcInRkeC5xdW90ZS5ib2R5LnJ0bXJfMlwiOlwiMTA4MzU3YzM5ZThkYzhmMTUwYTMzNzM4NTY3YWY0NTE5MDhmODBkZGZjOGMxNDgwMWZiZDUxM2YzMDdkYTk5MDgyZWEwYWJhOGNjN2UwNDI5NDBmMzEwZTU0YzhhYjEwXCIsXCJ0ZHgucXVvdGUuYm9keS5ydG1yXzNcIjpcIjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkuc2VhbV9hdHRyaWJ1dGVzXCI6XCIwMDAwMDAwMDAwMDAwMDAwXCIsXCJ0ZHgucXVvdGUuYm9keS50Y2Jfc3ZuXCI6XCIwNTAxMDYwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkudGRfYXR0cmlidXRlc1wiOlwiMDAwMDAwMTAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkudGVlX3RjYl9zdm4yXCI6XCIwNTAxMDYwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmJvZHkueGZhbVwiOlwiZTc0MjA2MDAwMDAwMDAwMFwiLFwidGR4LnF1b3RlLmhlYWRlci5hdHRfa2V5X3R5cGVcIjpcIjAyMDBcIixcInRkeC5xdW90ZS5oZWFkZXIucmVzZXJ2ZWRcIjpcIjAwMDAwMDAwXCIsXCJ0ZHgucXVvdGUuaGVhZGVyLnRlZV90eXBlXCI6XCI4MTAwMDAwMFwiLFwidGR4LnF1b3RlLmhlYWRlci51c2VyX2RhdGFcIjpcIjJjMzBhZDEyYzAzNzFhMmMyNDlmNGE5MDMwNWMzZjU2MDAwMDAwMDBcIixcInRkeC5xdW90ZS5oZWFkZXIudmVuZG9yX2lkXCI6XCI5MzlhNzIzM2Y3OWM0Y2E5OTQwYTBkYjM5NTdmMDYwN1wiLFwidGR4LnF1b3RlLmhlYWRlci52ZXJzaW9uXCI6XCIwNTAwXCIsXCJ0ZHgucXVvdGUuc2l6ZVwiOlwiODgwMjAwMDBcIixcInRkeC5xdW90ZS50eXBlXCI6XCIwMzAwXCIsXCJ0ZHgudGRfYXR0cmlidXRlcy5kZWJ1Z1wiOmZhbHNlLFwidGR4LnRkX2F0dHJpYnV0ZXMua2V5X2xvY2tlclwiOmZhbHNlLFwidGR4LnRkX2F0dHJpYnV0ZXMucGVyZm1vblwiOmZhbHNlLFwidGR4LnRkX2F0dHJpYnV0ZXMucHJvdGVjdGlvbl9rZXlzXCI6ZmFsc2UsXCJ0ZHgudGRfYXR0cmlidXRlcy5zZXB0dmVfZGlzYWJsZVwiOnRydWV9IiwidGVlIjoidGR4In0.apt9yyHsJ4WoUwuqw-GivyjM_-W0m3p2p0xavtILExgAnaHMTv7hVvvuyjlnKHmLc8svTPZMAfYvbl0UJTpFkJ5TPQQ0wLijS69bsvG1mG8cltAwzI92BaAV8BdgMxUu9GWGQGaZRyEH-OJdM5HQBmo35YwCVYeNmwVGNdZ2h59D6fHIk1BUkVoPTmk0sE7aSnP_KblkfPL_Vh3ovs9MpAralCv2JO7cMCau0CqSoQTIORjh9i0BBXrt1y8y6gmpjEFDWMsIqW-k8cRhdANk_9CpBCN02jVwQXEHMnk0SAm4BCrCdyteXBNZfpN-3LCXQkkTyUEoaZXGHPm15cTbpg

Anda dapat menggunakan JWT Debugger untuk memverifikasi validitas token OIDC dalam lingkungan uji. Untuk konten dan penjelasan spesifik mengenai JWT Claims, lihat Remote attestation service EAT Profile.