Where the cloud stands

Two steps built, a third half built, three ahead.

A cloud is built in the order its parts depend on one another: a server to serve, a way between networks, a date and a front, a machine a provider can boot, an update that rolls through the set, and a witness that checks every machine's record. This page says where each stands and what judges it. Everything built has run only in an emulator, and none of it for a customer.

The six steps

In the order each one needs the one before.

1 · A serverA solution's server, placed on a machine. A pack, the solution's server programs written apart from any machine, is put on a machine, and the machine runs the server as a confined program under a user of its own, with directories only that user may write. It is called ready only once it has answered a request. Judged by a boot compared line for line with its kept transcript, and by the same machine with no disk behind the server's directory, which does not start it.built · emulated

2 · Two linksA box that is the way between two networks. The fleet file, which names the machines of the cloud, says which box and which networks. The box answers for the far network's names and for nothing else, and a till on one network reaches a server on the other through it. Judged by three machines on two networks; by the same box without its one line, which goes silent about the far network; and by a device nobody declared, which is given nothing.built · emulated

3a · TimeA date a record can lean on. A fleet's one time authority signs, with its own key, that an entry of a machine's record existed no later than a time it read from its clock. A record with no such statement says it is ordered and undated. Judged by two machines on one wire, and by deliberately breaking each rule to see that a check catches it.built · emulated

3b · A frontA program at the edge that ends TLS, the encryption of a web connection, with its key on a disk the machine declares. Until it exists, a server is reached over plain HTTP from the networks of its own cloud, and from nowhere else.not built

4 · ProviderThe same file, booted on a machine somebody else owns. An image that a cloud provider's virtual machine can boot, with the same two slots and the same trial as a board has. Today the emulator is handed the kernel directly.not built

5 · RolloutAn update that goes through the set a wave at a time. The next wave starts only when every machine in the current one has kept its own trial, so the set judges itself as one machine does. Today each machine judges its own trial, and nothing judges the set.not built

6 · WitnessEach program's own network reach, a filter behind the routes, and a witness. The witness is a program that collects every machine's signed record and checks it with the fleet's public keys, holding no secret, so that an auditor reads one page. Today a route is a way both ways, and one record is checked at a time.not built

One step, shown

A record is dated by somebody else's word, or says it is undated.

A machine with no clock of its own cannot say what day it is, and a date it made up would be worse than none. So its record of its boots is ordered and undated, and what a fleet can have is another machine's word. One member, which the fleet names and enrols like any other, has a battery-backed clock. When a machine asks, it signs: the entry with this fingerprint existed no later than this time. That is an upper bound and nothing more, because it says nothing of how long before. The machine that asked keeps the statement beside its record, and anyone holding only the fleet file can check it.

harb time verify, from its pin

# a record and the authority's statements, checked with the fleet file alone
time: entry 4 is ORDERED and UNDATED: no statement is about it, or about any entry after it
time: 3 statements verified against the key clockbox holds in this fleet, and no secret took part

# one second added to a statement
time: statement 1 does not verify: it was changed after it was signed, or signed by another key
time: 1 of 3 statements refused: what a refused statement says is not taken

The authority was taken away after the third boot, and what it had said stayed said: the entries after its last statement say they are ordered and undated, and no date is made up for them. Add one second to a statement and it no longer verifies.

Said plainly

What the boots do not show.

No customer's server, and nothing to rent. RingServ stands in for a customer's server, and none is placed. Nothing here is a service you can rent.
A route is a way both ways. No packet filter exists to make it one-way, and two networks are joined through one box, not through a chain of boxes.
Forwarding filters nothing. A device nobody declared is given no address, router or resolver, but one that chose its own address and named the box as its gateway would be carried.
No board. Every boot on these pages ran in an emulator. The time statements read a clock the emulator hands the authority, a fixed time that runs with the virtual machine. Whether a board's battery keeps time is the first board's to show.
Time has one source and one bound. One authority per fleet, a clock it was declared to have, no time taken from the network, and a statement that says "no later than" and never "how long before". An authority's key cannot be replaced yet.

Back: How it is written → The three kinds of file, what is left out on purpose, and what you keep when somebody else owns the hardware. Enterprise IT →