Virtual Secure Enclave Remote Attestation via Trusted Bootloader
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in creating trusted execution environments (TEEs) using virtualization techniques lies in remote attestation, which requires software components and operations that necessitate a hardware Root of Trust, complicating the process and making it difficult to establish trust in the attestation mechanism, especially when the underlying platform can be compromised.
Innovation Solution
A system architecture that provides a virtualization-based TEE using a virtual secure enclave device, which leverages hardware VM encryption mechanisms like AMD SEV and Intel MKTME, and hardware TEE mechanisms like Intel SGX, to create and manage TEEs, while offering a unified interface through a universal API, simplifying SDK integration and enabling migration across different hardware platforms, and incorporating a trusted bootstrap appliance for remote attestation to establish trust.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization techniques are used to create TEEs, then hardware encrypted VMs can be provided comparable to secure memory enclaves, but remote attestation becomes challenging due to software components requiring hardware Root of Trust
Solution Approach 1:
A virtualization-based TEE creation mechanism is introduced as an intermediary layer between hardware encrypted VMs and remote attestation requirements. This mechanism includes a hardware-backed root of trust that generates attestation keys and signs attestation reports, mediating the trust relationship without requiring direct hardware access to software components.
Solution Approach 2:
The TEE creation process is segmented into distinct stages: hardware initialization, key generation, VM creation, and attestation. Each stage has specific software components with defined interfaces, allowing remote attestation to verify each segment independently through measured boot and attestation reports.
2Reliability
If hardware Root of Trust is required for remote attestation in TEE creation, then security is improved, but the process becomes complicated and difficult to establish trust
Solution Approach 1:
The virtualization-based TEE creation mechanism acts as a trusted intermediary that simplifies the attestation process. It provides standardized interfaces for key generation, attestation report generation, and verification, making the complex hardware Root of Trust operations manageable through consistent software abstractions.
Solution Approach 2:
The mechanism is designed to work with multiple hardware platforms and virtualization technologies, providing universal attestation capabilities. The same software components can perform key generation, VM creation, and attestation across different hardware architectures, reducing complexity through standardized interfaces.
3Reliability
If hardware encrypted VMs are used to remove hypervisor from chain of trust, then security is improved, but remote attestation for TEE creation becomes challenging
Solution Approach 1:
The virtualization-based TEE creation mechanism serves as a mediator between hardware encrypted VMs and remote attestation requirements. It provides standardized interfaces for attestation operations, making it easier to verify VM integrity without compromising the security benefits of hypervisor removal.
Solution Approach 2:
The mechanism implements feedback loops where attestation reports are generated and verified, providing continuous confirmation of VM integrity. This feedback mechanism simplifies remote attestation by providing clear verification signals about the trustworthiness of the TEE creation process.
Data Source
AI summary
System and method for performing a remote attestation for creation of a trusted execution environment (TEE) using a virtual secure enclave device running in a virtualized environment utilizes a trusted bootloader appliance in a TEE virtual computing instance, which is created in response to a request for a TEE from a software process running in the system. The trusted bootloader appliance manages the provisioning of a TEE in the TEE virtual computing instance for the software process. The remote attestation includes performing a first stage attestation on the trusted bootloader appliance by a hardware platform of the computer system and performing a second stage attestation on the provisioned TEE by the trusted bootloader appliance.