Attestation and Confidential Computing – a technical introduction

Introduction

This article introduces the important topic of attestation as it relates to Confidential Computing. Super Protocol is a provider of services that use Confidential Computing and a strong proponent of the importance of attestation: all of Super Protocol's services employ attestation to provide users and other stakeholders with strong cryptographic assurances around the security of various aspects of the services. This article, first in a series of three, looks at some of the key features of attestation - and why it matters! - as an introduction to a second article, Advanced use cases for Confidential Computing – a Technical Introduction, which details use cases for advanced attestation mechanisms, and the third article, How Super Protocol Uses Attestation, which examines how Super Protocol's solution uses various techniques to allow simple and efficient security for all its stakeholders.

Why attestation matters

Super Protocol provides a platform to allow applications to be run using Confidential Computing. This means that the applications - and the data that they are processing - are protected from external attacks and interference, even by the person who owns the hardware on which they're running. It does this by running them within Trusted Execution Environments (TEEs), which give hardware-based isolation, provided at the chip level by Super Protocol's partners such as Intel and Nvidia. You can think of a TEE as a silicon-protected box in which applications run, and whose RAM is isolated from the rest of the system and the outside world.

Let's say, however, that you want to run an application on somebody else's system, whether that's an individual or a Cloud Service Provider. How might setting up such an arrangement happen? Let's model it, with me as the system provider, and you as the consumer. Remember - you don't trust me to run the application without interfering with it (which is why you want to use a TEE in the first place!).

See the problem? If you don't trust me to run my application without interference (you may not even trust me to look at my application), then how can you trust that I've set up the TEE as requested?

Introducing attestation

Luckily, there's a solution to this problem, which is called remote attestation, or just attestation for short. Attestation is used to describe a variety of processes within computing, but has a very special meaning within Confidential Computing.

Providing what is known as an attestation verification service (AVS) can be a complex undertaking as it must itself be both as secure as possible and often highly available, and while it is possible run an AVS as the consumer of TEE services, an increasing number of organisations are offering AVS as a third party service.

Trusting the silicon vendor

What attestation provides

It is important to note, however, that attestation does more than just provide the person or entity that is executing the application with integrity and confidentiality assurances, but that the attestation verification can be used in a number of other ways.

Uniqueness and identity

The first and most obvious is that cryptographically signed data can provide evidence of uniqueness. Assuming that it is possible to inject unique data into the initial measurement - such as a nonce or a randomly generated string from within the TEE - then the uniqueness of that instance of a workload can be checked and assured. This leads to the ability to assert a second property, which is identity. While not sufficient on its own, uniqueness allows the binding of an identity to a workload instance, which means that inputs and outputs from that workload can be associated with a particular identity.

Attestation measurement as a certificate

Once you have a cryptographically signed blob of data with assurances of uniqueness and the identity, you basically have something that can be used as a certificate. This opens up a whole new set of possible ways of thinking about how the workload, its other properties and how they can be used.

There are certain complexities associated with this arrangement which all revolve around the importance of verifying every single workload/TEE instance. If each attestation measurement goes to a centralized certificate authority, the time overhead on its own is likely to be significant for a deployment that includes multiple TEEs such as a distributed application with microservices. This is an issue that we have addressed at Super Protocol, and which is addressed in the second article in this series, Advanced use cases for Confidential Computing – a Technical Introduction.

Using certificates with Confidential Computing

Once you start to think about using attestation verification outputs as certificates, it quickly becomes clear that there are multiple uses that can be made of them.

Certificates for transport security

The most obvious of these uses cases - the most common use for certificates - is for communication. We are used to having certificates accepted for website access when we use browsers, and TLS already has a version which supports remote attestation, known as RA-TLS.

Non-transport uses for certificates

There are, of course, many other uses for certificates, and these apply equally - if not more - to certificates based on attestation verifications. Probably the most important in this context is the use of certificates for assurance around provenance. Where we were typically concerned about the confidentiality of our transport communications, in this case, we are much more interested in assurances around integrity.

This leads us to an astonishing property: because a certificate based on an attestation verification can give us assurances about both the integrity of the data and the application in the TEE, we can make very strong assertions that the results of a calculation or application came from a particular application and set of data. This has huge implications for very many collaborative applications, but possibly most importantly for AI/ML use cases. When we look at AI, the ability to tie the provenance of an inference model - and the answers it gives to questions - to the initial data sets and training model suddenly changes the way we think about how much we can trust what we are using. We will look at this use case - among others - in the second article in this series, Advanced use cases for Confidential Computing – a Technical Introduction.

Summary

Super Protocol's services revolve around Confidential Computing, and make the most of attestation, a process which, as we have seen in this article, can provide great benefits to users and consumers of the technology.