CCxTrust: Confidential Computing Platform Based on TEE and TPM Collaborative Trust

Ketong Shang,Jiangnan Lin,Yu Qin,Muyan Shen,Hongzhan Ma,Wei Feng,Dengguo Feng

2024-12-05

Abstract:Confidential Computing has emerged to address data security challenges in cloud-centric deployments by protecting data in use through hardware-level isolation. However, reliance on a single hardware root of trust (RoT) limits user confidence in cloud platforms, especially for high-performance AI services, where end-to-end protection of sensitive models and data is critical. Furthermore, the lack of interoperability and a unified trust model in multi-cloud environments prevents the establishment of a cross-platform, cross-cloud chain of trust, creating a significant trust gap for users with high privacy requirements. To address the challenges mentioned above, this paper proposes CCxTrust (Confidential Computing with Trust), a confidential computing platform leveraging collaborative roots of trust from TEE and TPM. CCxTrust combines the black-box RoT embedded in the CPU-TEE with the flexible white-box RoT of TPM to establish a collaborative trust framework. The platform implements independent Roots of Trust for Measurement (RTM) for TEE and TPM, and a collaborative Root of Trust for Report (RTR) for composite attestation. The Root of Trust for Storage (RTS) is solely supported by TPM. We also present the design and implementation of a confidential TPM supporting multiple modes for secure use within confidential virtual machines. Additionally, we propose a composite attestation protocol integrating TEE and TPM to enhance security and attestation efficiency, which is proven secure under the PCL protocol security model. We implemented a prototype of CCxTrust on a confidential computing server with AMD SEV-SNP and TPM chips, requiring minimal modifications to the TPM and guest Linux kernel. The composite attestation efficiency improved by 24% without significant overhead, while Confidential TPM performance showed a 16.47% reduction compared to standard TPM.

Cryptography and Security

What problem does this paper attempt to address?

### What problems does this paper attempt to solve?

This paper aims to solve the existing trust and security challenges in the current cloud - computing environment, especially in multi - cloud environments and scenarios with high privacy requirements. Specifically, the paper proposes solutions to the following key issues:

1. **Limitations of a single Hardware Root of Trust (RoT)**:
- Current confidential computing platforms rely on a single hardware root of trust, such as the Trusted Execution Environment (TEE) in the CPU, which limits users' trust in cloud platforms. Especially in high - performance AI services, end - to - end protection of sensitive models and data is crucial.

2. **Trust interoperability issues across platforms and cross - cloud environments**:
- In multi - cloud environments, due to the lack of a unified trust model and interoperability, it is difficult to establish a cross - platform trust chain, resulting in complexity and potential security risks for users when migrating or deploying applications between different cloud services.

3. **Insufficient user control over the trust system**:
- Existing CVM solutions mainly rely on the root of trust provided by cloud service providers or hardware manufacturers. Users cannot directly participate in or verify the establishment of the trust system, resulting in limited user control over data security, especially in scenarios requiring high privacy and security.

4. **The technological gap between TEE and TPM**:
- There are significant differences between TEE and TPM in security roles and technological implementation. How to make them work together is a challenge. For example, TEE provides a highly secure isolated environment but restricts the use of certain functions, such as IOMMU, which makes it complicated to integrate the hardware TPM into the confidential virtual machine.

5. **Ensuring the security of confidential virtual machines in processing sensitive data**:
- In confidential computing, ensuring the integrity and confidentiality of sensitive data processed by virtual machines is a key task. Although TEE ensures data security through memory encryption, its isolation technology is not sufficient to fully protect the workload. Therefore, dynamic integrity measurement and remote authentication are required to enhance security.

To solve the above problems, the paper proposes the **CCxTrust** platform. This platform is based on the collaborative trust mechanism of TEE and TPM and constructs a multi - root trust system to improve the trustworthiness and security of the confidential computing platform. Specific measures include:

- **Collaborative Roots of Trust (RoT)**: Combine the advantages of TEE and TPM to establish a user - controlled trust framework.
- **Confidential TPM (CTPM)**: Design and support multiple - mode TPM operations to provide flexible security guarantees.
- **Composite Attestation Protocol**: Integrate static and dynamic trust chains and utilize the advantages of TPM and TEE to ensure the security of the runtime environment.

Through these innovations, CCxTrust aims to bridge the existing trust gap, increase users' trust in cloud platforms, and support the secure application deployment in multi - cloud environments.