Towards Trust Proof for Secure Confidential Virtual Machines

Jingkai Mao,Haoran Zhu,Junchao Fan,Lin Li,Xiaolin Chang

2024-05-02

Abstract:The Virtual Machine (VM)-based Trusted-Execution-Environment (TEE) technology, like AMD Secure-Encrypted-Virtualization (SEV), enables the establishment of Confidential VMs (CVMs) to protect data privacy. But CVM lacks ways to provide the trust proof of its running state, degrading the user confidence of using CVM. The technology of virtual Trusted Platform Module (vTPM) can be used to generate trust proof for CVM. However, the existing vTPM-based approaches have the weaknesses like lack of a well-defined root-of-trust, lack of vTPM protection, and lack of vTPM's trust proof. These weaknesses prevent the generation of the trust proof of the CVM. This paper proposes an approach to generate the trust proof for AMD SEV-based CVM so as to ensure its security by using a secure vTPM to construct Trusted Complete Chain for the CVM (T3CVM). T3CVM consists of three components: 1) TR-Manager, as the well-defined root-of-trust, helps to build complete trust chains for CVMs; 2) CN-TPMCVM, a special CVM provides secure vTPMs; 3) CN-CDriver, an enhanced TPM driver. Our approach overcomes the weaknesses of existing approaches and enables trusted computing-based applications to run seamlessly in the trusted CVM. We perform a formal security analysis of T3CVM, and implement a prototype system to evaluate its performance.

Cryptography and Security,Software Engineering

What problem does this paper attempt to address?

The problem this paper attempts to address is: how to generate trust proofs for Confidential Virtual Machines (CVM) based on AMD SEV (Secure Encrypted Virtualization) to ensure their security. Although current CVM technology can protect data privacy, it lacks sufficient trust proofs in the running state, leading to low user trust in CVM. Existing methods based on Virtual Trusted Platform Module (vTPM) have some weaknesses, such as the lack of a clear root of trust, lack of protection for vTPM, and lack of trust proofs for vTPM.

To solve these problems, the paper proposes a method (called T3CVM, Trusted Complete Chain for CVM) that generates trust proofs by constructing a complete trust chain for CVM using a secure vTPM. T3CVM consists of three components:

1. **TR-Manager**: Acts as a clear root of trust, helping to build a complete trust chain for CVM.
2. **CN-TPMCVM**: A special CVM that provides a secure vTPM.
3. **CN-CDriver**: An enhanced TPM driver that protects communication between the components of T3CVM.

These components overcome the weaknesses of existing methods, allowing trusted computing-based applications to run seamlessly in a trusted CVM. The paper also conducts a formal security analysis and implements a prototype system to evaluate its performance.