Understanding Trust
Relationships in Cloud-Based
Confidential Computing
Gianluca Scopelliti, Christoph Baumann, Jan Tobias Mühlberg
7th Workshop on System Software for Trusted Execution (SysTEX’24)
gianluca.scopelliti@ericsson.com

Confidential Computing (CC)
Untrusted infrastructure2024-07-08 | Page 2 of 32

Confidential Computing (CC)
Untrusted infrastructure

Hardware isolation:code and data are isolated
from the rest of the system2024-07-08 | Page 3 of 32

Confidential Computing (CC)
Untrusted infrastructure

Remote Attestation:evidence of hardware andsoftware configuration

2024-07-08 | Page 4 of 32

CC threat model from different perspectives

2024-07-08 | Page 5 of 32

CC threat model from different perspectives

2024-07-08 | Page 5 of 32

CC threat model from different perspectives

2024-07-08 | Page 5 of 32

CC threat model from different perspectives

2024-07-08 | Page 5 of 32

CC threat model from different perspectives

2024-07-08 | Page 5 of 32

CC technologies
App Enclave

Focus of this talkConfidential VM (CVM)
App

Guest OS

Guest OS

Hypervisor

Hypervisor

HardwareHardwareProcess-based TEEsVM-based TEEs

Intel SGXAMD SEV-SNP, Intel TDX, ARM CCA

2024-07-08 | Page 6 of 32

Why CVMs are becoming so popular?
● “Easy” to use● “Lift-and-shift”● Cloud-native (e.g., Kata)● Performance benefits

Where is the catch? ☺

CVMAppGuest OS

Hypervisor

Hardware2024-07-08 | Page 7 of 32

When using CVMs in the cloud,
how is trust established?

2024-07-08 | Page 8 of 32

CVM boot process
Unmeasured
CVM Memory2024-07-08 | Page 9 of 32

Measured by TEE

CVM boot process
Unmeasured
CVM Memory

FirmwareOVMF2024-07-08 | Page 10 of 32

Measured by TEE

CVM boot process
Unmeasured
CVM Memory

Measured by TEE

initramfs
initramfs

Execute /init script

KernelLinuxload kernel & initramfs

Firmware
OVMF

2024-07-08 | Page 11 of 32

Possibly via abootloader (e.g., GRUB)

CVM boot process
Unmeasured

Measured by TEE

CVM Memory

Root FSOS / applications(mapped rootfs)

Mount & chroot
Execute /sbin/init script

initramfs
initramfs

Execute /init script

KernelLinuxload kernel & initramfs

Firmware
OVMF

2024-07-08 | Page 12 of 32

CVM boot process
Unmeasured

Measured by TEE

CVM Memory

Root FSOS / applications(mapped rootfs)

Mount & chroot
Execute /sbin/init script

initramfs
initramfs

KernelLinuxload kernel & initramfs

Firmware
OVMF

2024-07-08 | Page 13 of 32⚠️ The TEE only
measures the initial code!
Execute /init script

CVM Attestation
AL0: No attestation

Unmeasured

Measured
CVM Memory

OS / applications(mapped rootfs)

initramfs

KernelFirmware2024-07-08 | Page 14 of 32

Attested

CVM Attestation
Unmeasured

AL1: Attested TEE isolation

Measured
CVM Memory

OS / applications(mapped rootfs)

initramfs

KernelFirmware2024-07-08 | Page 15 of 32

Freshness info (e.g., nonce)
included in the report

Attested

CVM Attestation
AL2: Measured firmware

Unmeasured

Measured
CVM Memory

OS / applications(mapped rootfs)

initramfs

KernelFirmware2024-07-08 | Page 16 of 32

Attested

CVM Attestation
Extending the measurements to the kernel
CVM Memory

CVM Memory

OS / applications(mapped rootfs)

OS / applications(mapped rootfs)
initramfs

initramfs
Measure & verify

KernelKernel
MeasureFirmwareFirmware

1a43b599f2a1

Direct Linux Boot
with modified OVMF [1]2024-07-08 | Page 17 of 32

vTPM

Virtual TPM (vTPM) [2][1] Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021
[2] Narayanan et al. “Remote attestation of confidential VMs using ephemeral vTPMs”, ACSAC’23

CVM Attestation
AL3: Measured Kernel

Unmeasured

Measured
CVM Memory

OS / applications(mapped rootfs)

initramfs

KernelFirmware2024-07-08 | Page 18 of 32

Attested

CVM Attestation
Protecting the root filesystem

Root FS +hash treeCVM Memory

CVM Memory

OS / applications(mapped rootfs)

OS / applications(mapped rootfs)

initramfs

KernelEncrypted Root FS

initramfs

Verify rootfs integrity

Kernelffd9c3

FirmwareFirmware1a43b5
99f2a1

Integrity protection
with dm-verity [3]2024-07-08 | Page 19 of 32

Authenticated encryption
with dm-crypt [4][3] https://docs.kernel.org/admin-guide/device-mapper/verity.html[4] https://docs.kernel.org/admin-guide/device-mapper/dm-crypt.html

Unlock encrypted rootfs

CVM Attestation
AL4: Fully measured bootUnmeasured

Measured
CVM Memory

OS / applications(mapped rootfs)

initramfs

KernelFirmware2024-07-08 | Page 20 of 32

AttestedDeploying CVMs on public clouds
Running CVMs on demand● CSP controls the boot process● Lack of customization options (e.g., using custom firmware)● Attestation is partially or fully managed by the CSP

2024-07-08 | Page 21 of 32

CSP architectures

Measured by TEE

CVM

OS & apps
KernelFirmwareHypervisor
vTPM
HardwarevTPM in hypervisor layer
GCP, AWS
2024-07-08 | Page 22 of 32

MeasureCSP architectures

Measured by TEE

CVM

CVM

OS & apps

OS & apps

KernelKernelFirmwareHypervisor
vTPM

Runs at higher privilege
Measurelevel (VMPL)

FirmwareParavisor (+ vTPM)
Hypervisor

HardwareHardwarevTPM in hypervisor layer

vTPM inside CVM

GCP, AWS

Azure

2024-07-08 | Page 23 of 32

MeasureCloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS
TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL

2024-07-08 | Page 24 of 32

Verifiability with trust

Azure

GCP

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS

Verifiability with trust

Azure

TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL

2024-07-08 | Page 25 of 32

AL that can be reached on
the CSP infrastructure

GCP

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS

Verifiability with trust

Azure

TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL

2024-07-08 | Page 26 of 32

AL that can be reachedwithout trusting the CSP

GCP

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS

Verifiability with trustAzure

GCP

TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL

2024-07-08 | Page 27 of 32

Can only get a “static”
attestation reportCloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS

Verifiability with trust

Azure

TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL* https://github.com/aws/uefi
2024-07-08 | Page 28 of 32

Open-source,
reproducible builds*

GCP

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS

Verifiability with trust

Azure

GCP

TEE
FirmwareKernelRoot FSNominal AL
Trustworthy AL

2024-07-08 | Page 29 of 32

Kernel measurements madeby CSP-managed vTPM

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

AWS
TEE
FirmwareKernelRoot FS
Nominal AL
Trustworthy AL

2024-07-08 | Page 30 of 32

Verifiability with trust

Azure

GCP

Cloud landscape
AMD SEV-SNP offerings on 26 March 2024
Verifiability without trust

Verifiability with trust

AWS

Azure

GCP

Nominal AL

444

Trustworthy AL

201TEE
FirmwareKernelRoot FS

2024-07-08 | Page 31 of 32

Understanding Trust Relationships inCloud-Based Confidential Computing• Attesting the full CVM boot chain is challenging• Just verifying the attestation report is not enough• Today, trust in the CSP is still required• Trust relationships need to be properly clarified• Gap between TEE threat model and current offerings• Lots of work still to be done, but we’re moving in the right direction

Gianluca Scopelliti, Christoph Baumann, Jan Tobias Mühlberg
7th Workshop on System Software for Trusted Execution (SysTEX’24)
gianluca.scopelliti@ericsson.com

Nested virtualization on Azure● Allows running a CVM from a normal VM (“CVM-in-VM”)● Customer has full control over the nested hypervisor and the boot process● Trustworthy AL4 possible!

● Today, still in preview and only usable in AKS with Confidential Containers

2024-07-08 | Page 33 of 32