WEBVTT NOTE Sentence-level transcript of https://www.youtube.com/watch?v=IvE8n-ylFYY NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/IvE8n-ylFYY.html. A cue ends where the next begins, or 2 s after its last word. s1 00:00:01.309 --> 00:00:03.309 [music] s2 00:00:12.480 --> 00:00:13.280 Hello everyone. s3 00:00:13.280 --> 00:00:16.400 I hope this talk will be shorter. s4 00:00:16.400 --> 00:00:19.439 Uh I'm from Amazon. s5 00:00:19.439 --> 00:00:28.640 Uh our company was acquired about 8 months ago and we built the uh AI wearable which is on my hand. s6 00:00:28.640 --> 00:00:42.079 Uh which is essentially a microphone that records everything and builds your personal agent, personal AI and uh on top of that you can extract all the data that you record and plug it to your s7 00:00:42.079 --> 00:00:47.039 systems or agents uh and do whatever you want. s8 00:00:47.039 --> 00:00:59.440 Uh just to be to get in perspective how confidential how like private data we capturing uh a single person usually like captures about 10 million tokens per year. s9 00:00:59.440 --> 00:01:12.159 So this um and even within like a first week of recording uh uh people usually tell uh extremely sensitive stuff to their friends to their family. s10 00:01:12.159 --> 00:01:19.920 uh you can learn virtually everything about the person within the just like one week of wearing the B device which is extremely sensitive. s11 00:01:19.920 --> 00:01:25.680 I think we one of the most sensitive uh capture device on the market now. s12 00:01:25.680 --> 00:01:39.840 So and uh because of this we had to encrypt everything and our mission was to not have access to any of this data and not being able to look at it anyone at Amazon s13 00:01:39.840 --> 00:01:53.040 and it became a little bit challenging for us at Amazon because uh Amazon itself provides strong security and privacy guarantees but if you Amazon and you using Amazon stuff s14 00:01:53.040 --> 00:01:58.960 there is like much more uh serious security stuff you need to do. s15 00:01:58.960 --> 00:02:06.159 Uh first of all we defined like few core principles what we needed to do for our specific agent. s16 00:02:06.159 --> 00:02:12.640 First of all we believe the agent should be like working all the time non-stop for for your good. s17 00:02:12.640 --> 00:02:16.160 Um it should be doing stuff on your behalf. s18 00:02:16.160 --> 00:02:23.760 Uh and um we should not consume uh customer resources such as batteries and stuff. s19 00:02:23.760 --> 00:02:36.160 So this way uh we uh so this leads us to one specific design uh of the um of the our system. s20 00:02:36.160 --> 00:02:52.720 Current system usually builds the uh on state uh on request response uh system where you send uh request to a l from your say iPhone uh calculate something and the back end that gives you back. s21 00:02:52.720 --> 00:03:11.519 Unfortunately, we already see that this is not enough uh that we need to uh that we need to run stuff continuously and sometimes for days we can see uh we can see this like as a like glimpse into the future how cloud code works. s22 00:03:11.519 --> 00:03:19.920 So like just few months ago it was like more like request response stuff like change this, change that and now it can works for like hours for us. s23 00:03:19.920 --> 00:03:24.560 We think the same will happen to all your like personal agents anyway. s24 00:03:24.560 --> 00:03:33.519 So uh because of this we built uh a stateful runtime with persistent memory um that we still don't have access to. s25 00:03:33.519 --> 00:03:35.760 Uh it can connect to different tools. s26 00:03:35.760 --> 00:03:45.360 It can connect to any like third party services if we if we program it to um and we don't require the user device to be online. s27 00:03:45.360 --> 00:03:51.519 So it's fully autonomous but at the same time it's fully controlled by the user. s28 00:03:51.519 --> 00:04:01.599 Um so encryption system is built um uh on few on four like core ideas that we need to follow. s29 00:04:01.599 --> 00:04:05.680 First of all the key leaves and manage it only on customer device. s30 00:04:05.680 --> 00:04:08.879 So it's users iPhone or Android device itself. s31 00:04:08.879 --> 00:04:11.760 We don't have the key ourselves. s32 00:04:11.760 --> 00:04:13.439 We don't persist it anywhere. s33 00:04:13.439 --> 00:04:20.400 So keys is is um is stored only on the customer phone. s34 00:04:20.400 --> 00:04:21.600 Everything is encrypted. s35 00:04:21.600 --> 00:04:23.759 We don't have any opt out there. s36 00:04:23.759 --> 00:04:26.000 No way to disable it. s37 00:04:26.000 --> 00:04:28.160 There no way to bypass it. s38 00:04:28.160 --> 00:04:44.720 Uh at the same time we uh to protect ourselves from um like internal threats uh we do fully transparent and audit uh of our all our workloads and we on top of that we try to minimize s39 00:04:44.720 --> 00:04:51.600 the dependencies on the uh on what we can trust really. s40 00:04:51.600 --> 00:05:02.560 Um so uh any security system if you do end to end encryption or any kind of encryption there is a huge problem is key management. s41 00:05:02.560 --> 00:05:06.960 So the first step is like I want to tell you how we manage the key. s42 00:05:06.960 --> 00:05:14.560 So we start with the uh the key as I mentioned before starts on the phone and it leaves persisted on the phone. s43 00:05:14.560 --> 00:05:30.800 Then the phone connects to our back end and runs very sophisticated attestation uh pipeline uh that verifies both integrity and that the specific workload is inside of public uh transparency log. s44 00:05:30.800 --> 00:05:39.120 We use six store for our transparency log and anyone can go there and try to look and verify that this workload is genuine. s45 00:05:39.120 --> 00:05:46.720 uh the the method is too complicated to include in this uh talk but we will publish details uh at some point. s46 00:05:46.720 --> 00:06:00.479 Uh once the uh once uh at the station was finished we the the client shares with the our main front end back end and back end then replicates this key with uh the similar nodes s47 00:06:00.479 --> 00:06:12.080 uh that runs within our confidation compute because we can't leave the unencrypted data out of our perimeter uh all our we run our own inference too. s48 00:06:12.080 --> 00:06:19.039 So this puts us a little bit uh more complicated task uh than typical AI company. s49 00:06:19.039 --> 00:06:31.280 We run like all kind of models, all kind of inference uh uh software and uh so um yeah and we don't replicate code to this inference node. s50 00:06:31.280 --> 00:06:35.919 We like replicate only on specific ones limiting the scope of what we can do. s51 00:06:35.919 --> 00:06:45.120 And on top of that we introduced everywhere where we have the keys in the memory uh uh the forced expiration of seven days. s52 00:06:45.120 --> 00:06:55.600 Uh we picked the seven days because we think it's like how much realistically the time horizon horizon for the like something useful can be done for the user. s53 00:06:55.600 --> 00:07:06.880 uh 24 hours will be too low because you can like not open your phone for like 24 hours something will be missed and like so we pick like about seven days. s54 00:07:07.120 --> 00:07:19.759 Um then we need you know we need to ship some something to the production and then the the biggest question like how we can uh well not ship something that will compromise anything. s55 00:07:19.759 --> 00:07:29.199 Our goal was to uh build a system that no one inside of uh Amazon will be able to ship anything unnoticed. s56 00:07:29.199 --> 00:07:35.919 Obviously the software has bugs have problems but we shouldn't be well being able to ship anything. s57 00:07:35.919 --> 00:07:40.720 So we solve this by two uh two tire system essentially. s58 00:07:40.720 --> 00:08:03.360 So there is a dedicated team inside of organization inside of uh Amazon and maybe maybe not even one I would say uh that um manages the privacy part of this the transparency log our team when we ship the software we can influence them we can't control them and we hardcode their in their signing keys inside of our s59 00:08:03.360 --> 00:08:16.720 client apps and our back ends so we can't really uh um uh we as the team we can do this and like it's very very hard and very high level s60 00:08:16.720 --> 00:08:36.640 uh um employees need to sign off to any kind of change so it's like at the big company like Amazon it's virtually impossible really um and uh and we do this in two parts because it's this process too slow so we split it in two parts so like the first one is to build the base s61 00:08:36.640 --> 00:08:48.959 image which we put some kind of base software for uh that is needed for our own team like the tools that measure the boot, measure the manifest, measure workloads and data that we need to s62 00:08:48.959 --> 00:08:50.480 uh put to the node. s63 00:08:50.480 --> 00:08:58.320 Um and um and then when we want to deploy we do the process the same similar time. s64 00:08:58.320 --> 00:09:18.000 uh we got the base image and then we deploy the uh to transparency log specific manifest that anyone and uh this setup helps us to be able to security audit companies and inside outside to anyone to well we're not doing this public but like we two like very s65 00:09:18.000 --> 00:09:31.040 um high-profile audit companies we work with them all the time um we can provide any image any any data that was deployed ever so we can like trace any possible s66 00:09:31.040 --> 00:09:48.399 uh weak spots uh if we like deploy something wrong uh which we do not um then after selfverification of VM it's uh issues a certificate that embeds all encryption pro uh all transparency proofs attestation documents into certificate itself s67 00:09:48.399 --> 00:09:58.160 we are using private CA because you can't do this in public certificates because it will populate the public uh transparency log so we had to use the private on s68 00:09:58.160 --> 00:10:07.600 um we probably will introduce the uh extra proxy that will do a normal TLS with attestation with like lighter mode. s69 00:10:07.600 --> 00:10:10.640 Uh but we don't have this yet. s70 00:10:10.640 --> 00:10:14.320 Um yeah, that's essentially what we built. s71 00:10:14.320 --> 00:10:16.160 Thank you. s72 00:10:16.160 --> 00:10:17.017 Any questions? s73 00:10:17.017 --> 00:10:19.017 [applause] s74 00:10:22.000 --> 00:10:24.399 Any questions? s75 00:10:25.839 --> 00:10:59.200 Another going inside as far as Can you repeat? s76 00:10:59.200 --> 00:10:59.440 Yeah. s77 00:10:59.440 --> 00:11:01.440 Sorry. s78 00:11:07.440 --> 00:11:15.360 Were there things that had to change your own existing? s79 00:11:15.360 --> 00:11:18.320 Oh, what changed with like when we joined Amazon? s80 00:11:18.320 --> 00:11:20.320 Yeah. s81 00:11:21.120 --> 00:11:32.000 Well, the the big change is that we uh before like you run on Amazon and Amazon gives you pre like guarantees as a customer that they can see your data. s82 00:11:32.000 --> 00:11:41.040 But once you inside this changes a lot because you Amazon like so that's why you need like to provide more protection on top of this. s83 00:11:41.040 --> 00:11:44.880 So we need to protect from our internal threats too. s84 00:11:44.880 --> 00:11:46.640 Uh so that's was a big change. s85 00:11:46.640 --> 00:11:53.519 So um before that it was um just kind of easier I would say to configure everything. s86 00:11:53.519 --> 00:11:59.200 Um not sure I can tell much honestly. s87 00:12:05.440 --> 00:12:07.360 Yes, it's just normal EC2 instances. s88 00:12:07.360 --> 00:12:09.360 Yeah. s89 00:12:09.920 --> 00:12:10.480 Yeah. s90 00:12:10.480 --> 00:12:10.720 Yeah. s91 00:12:10.720 --> 00:12:13.760 We almost we not using like Yeah. s92 00:12:13.760 --> 00:12:15.519 Almost everything we build from scratch. s93 00:12:15.519 --> 00:12:24.560 Well, um we tried to use like the existing stuff like that is more like common like popular software. s94 00:12:24.560 --> 00:12:29.120 We built uh try we try to minimize amount of code that we produce. s95 00:12:29.120 --> 00:12:35.200 So it's I I calculated before this talk it's just like about 20k lines on memory safe language. s96 00:12:35.200 --> 00:12:46.480 So it was very small scope that we were able to audit and verify that all this kind of stuff and most of this code is just verifying at the station really and everything else can be like reused and like very s97 00:12:46.480 --> 00:13:01.760 we like you know it's very trustworthy I would say software so we didn't try to don't invent uh um yeah we don't try to invent like when when I was a telegram like we reintroduced like build our own crypto s98 00:13:01.760 --> 00:13:05.120 and that was like questionable way of doing stuff. s99 00:13:05.120 --> 00:13:08.560 So, I try not to do the same at Amazon, obviously. s100 00:13:08.560 --> 00:13:11.200 Yeah, that's what we do. s101 00:13:11.200 --> 00:13:13.120 Any other questions for Steve s102 00:13:13.120 --> 00:13:15.680 up in the back? s103 00:13:26.800 --> 00:14:11.279 Just think about Well, I I just prefer them not to put to the computers uh to personal one. s104 00:14:11.279 --> 00:14:18.399 Uh so we we did several experiments how to tame them, not to do bad things. s105 00:14:18.399 --> 00:14:24.480 H say I think nothing works except like sandboxing and just not giving them a way to hurt themselves. s106 00:14:24.480 --> 00:14:38.000 It's like you know our brains they can't stop the heart at will right so otherwise you know they will be we have much more problems so I think the same we shouldn't give them away to do any harm s107 00:14:38.000 --> 00:14:49.120 that's the only way honestly and um yeah and put something in between if they want to change something unfort yeah s108 00:14:50.240 --> 00:15:00.079 uh I surprised they're not representing this uh right like they're screaming so much about security but they didn't came to this one. s109 00:15:00.079 --> 00:15:05.120 Uh uh I'm not I tried open claw. s110 00:15:05.120 --> 00:15:11.839 It's like it was once they started to try to tighten this down it became much less use useful. s111 00:15:11.839 --> 00:15:15.839 Um so I think their approach is not really that good. s112 00:15:15.839 --> 00:15:28.000 So I would love to have wild agent that's that's our goal too but we try to just deploy the sandboxer for specific agent and it will just they just can't do much of the stuff. s113 00:15:28.000 --> 00:15:31.360 Everything else fails unfortunately. s114 00:15:31.920 --> 00:15:32.639 Cool. s115 00:15:32.639 --> 00:15:33.120 All right. s116 00:15:33.120 --> 00:15:35.279 Well, thank you so much, Steve, for the presentation. s117 00:15:35.279 --> 00:15:37.600 That was amazing.