Departing from "your data is safe with us" model where the cloud infrastructure is trusted, cloud tenants are shifting towards a model in which the cloud provider is not part of the trust domain. Both silicon and cloud vendors are trying to address this shift by introducing confidential computing - an umbrella term that provides mechanisms for protecting the data in-use through encryption below the hardware boundary of the CPU, e.g., Intel Software Guard Extensions (SGX), AMD secure encrypted virtualization (SEV), Intel trust domain extensions (TDX), etc. In this work, we design and implement a virtual trusted platform module (vTPM) that virtualizes the hardware root-of-trust without requiring to trust the cloud provider. To ensure the security of a vTPM in a provider-controlled environment, we leverage unique isolation properties of the SEV-SNP hardware and a novel approach to ephemeral TPM state management. Specifically, we develop a stateless ephemeral vTPM that supports remote attestation without persistent state. This allows us to pair each confidential VM with a private instance of a vTPM that is completely isolated from the provider-controlled environment and other VMs. We built our prototype entirely on open-source components - Qemu, Linux, and Keylime. Though our work is AMD-specific, a similar approach could be used to build remote attestation protocol on other trusted execution environments (TEE).

翻译：从信任云基础设施的“您的数据由我们安全保管”模式出发，云租户正转向一种将云提供商排除在信任域之外的模型。芯片厂商和云提供商均试图通过引入机密计算来应对这一转变——机密计算是一个总括性术语，其通过CPU硬件边界以下的加密技术提供保护使用中数据的机制，例如英特尔软件保护扩展(SGX)、AMD安全加密虚拟化(SEV)、英特尔信任域扩展(TDX)等。在本工作中，我们设计并实现了一种虚拟可信平台模块(vTPM)，该模块可虚拟化硬件信任根，且无需信任云提供商。为确保vTPM在提供商控制环境中的安全性，我们利用了SEV-SNP硬件的独特隔离特性以及一种新颖的瞬态TPM状态管理方法。具体而言，我们开发了一种无状态瞬态vTPM，其支持无需持久化状态的远程证明。这使得我们能够将每个机密虚拟机与一个完全独立于提供商控制环境及其他虚拟机的vTPM私有实例配对。我们完全基于开源组件——Qemu、Linux和Keylime构建了原型。尽管本工作针对AMD平台，但类似方法也可用于在其他可信执行环境(TEE)上构建远程证明协议。