Hello, good morning everyone. I hope you are enjoying the talks excellent presentation
on ARM CCN stuff. So, I am going to continue the chain of talks and my name is Yogesh
Ashpande I work in architecture and technology group in ARM Cambridge and today I am going
to talk about challenges of remote attestation for confidential computing workloads. What are
the challenges one faces? So, as one can see that a CC system is often a complex system
where there is multiple root of trust like one CPU is there which is connected to one
or more GPUs and you can see the model training happens this is a kind of a becoming
an industry kind of a trend to do model training like that and effectively then what what
what it means for attestation effectively in attestor is a collection of attestors where you have
multiple components like multiple root of trust combined together to form a composite attestor
actually. And so, every and basically every individual component has its attestor remote attestation
so, when one needs to assess the trustworthiness of the entire composition one needs to take
individual component attestation and then join the pieces together to evaluate the overall
trustworthiness of the complete attestor. So, in fact within the CPU itself as we discussed just
by the few presenters in the past within the CPU itself there is a workload which runs on a
confidential computing hardware platform. So, effectively if you see the within the CPU itself
it is kind of a layered attester where an attesting environment collects claims about a target
environment which acts as an attesting environment for a workload and collects the claims for
it. So, effectively it is a layered attester meaning you have one layer on top there is another
layer and so, it is again a composition is a kind of a layered composition within the CPU itself.
So, what does this brings into picture? So, what is the impact? So, when we when we talk of
composite attestation it poses many questions. What questions every aspect of attestation is
been touched like when you talk about evidence how the evidence can be constructed for a composite
attestor? How does the supply chain endorsements for individual components be collected together
or how the verifier can make a unified view of the supply chain endorsements coming from different
parts because different components are coming from different vendors and what is the impact
on attestation verifiers is a single verifier enough to do the appraisal of the attester if maybe
not maybe maybe not and if not then how does the attestation results coming from individual
verifiers be collated together joined together so that the lying downstream lying party have a
consistent view of the overall trustworthiness of the composite attestant.
So, we look at each of these individual aspects of the rats and then try to analyze what is the
impact. So, we will start systematically from the attester side attestor produces evidence
and what are the challenges like multiple component evidence is combined to form a composite
evidence and the format and claims can be very different you may have something produced by
in CBO or somebody something produced in some other JSON maybe and then the nature of claims
itself may be different and then you need to join them together to produce an evidence and who
knows I mean there may or may not be a single authority to take the ownership of the complete
evidence then how do you then in such case how do you protect the integrity of the complete
evidence. So, these are the certain set of challenges and in certain systems there may be
requirement that certain amount of certain types of workloads may not be allowed to run on certain
set of hardware platform. So, the platin there should be some kind of a policy and then who owns
that appraisal policy. So, these are the kind of questions or the challenges which are posed
when you try to join different components and create a coherent attestation architecture.
So, that is our architecture does talk a bit about some of the solutions. So, let us look into
that one of the possible solutions is maybe we need a lead verifier on the platform or on the on the
device in the composite device use case the lead verifier job may be simply to collect
component attestor evidences and then join them together it may have its own evidence like
it may have its own target environment or attesting may or may not be it may just collect
evidence push it to the verifier or it may just have a role of an integrator where it takes its ownership
it signs it and sends it evidence sends the composite evidence to the verifier. So, so this is
one possible way of doing it but of course, there are multiple topologies and multiple ways.
So, I would like to highlight what is the work done in the IT efforts working group in
standards body around this and the equivalent implementation in the open source project
so the concise message wrapper is going to be an RFC in like six months time it is in the queue
now and basically it is protocol to how do you collect different type of rat's messages into
a collection and send it over and it could be it could be any rat's message but particularly
we are talking about evidence. So, it is potentially we have seen it is it is powerful use in
combining component evidences and collecting them together to send it to a RF2 verifier and entity
attestation token is already an RFC where you can collect individual component evidence using
each submods and then recently we have started defining different types of attester classes
and that is the taxonomy of composite attester that is very much work in progress in the rat's
working group not yet adopted but we are having regular meetings on that and the eat profile for
device attestation that is something very interesting because when you try to attach
trusted device like GPU into when you want want to connect it into a confidential VM how do you
how does one assess the overall trustworthiness so it gives a profile to produce evidence
for collecting measurements from the trusted device so and of course all this is implemented in
pretty much some of this is completely implemented in variation and some of them in existing
work in progress so the entity attestation token and CMW is pretty mature state in
variation but the bottom to the reds demon is a kind of an agent that sits on the attester
and collects evidence there is a reference implementation in project variation and eat base
device assignment work has been just started so look forward to that as well so now we have
focused on evidence and how do you can collect the evidence let us move on to the endorsements and
reference values so the challenge again is here the same the different reference values are provided
by different vendors they may have different formats for conveying that and then there is no standard
mechanism to query that that kind of endorsements uniformly from across different vendors so
this ecosystem is currently fragmented that brings its own challenges because many supply chain
providers across different hardware as I mentioned needs how does the verify you make sense of
that kind of complexity so and the if when different vendors produce reference values endorsements
in a different format in a different way to query them it is simply a barrier for scaling you
you can't simply scale this kind of a solution so so how do we address this problem so
in our team this is one a few of our colleagues working in different in the rats community
have came together and tried to address this problem by concise selector for endorsement and
reference value that's a draft which is already been adopted in the rats working group so it provides
a uniform way to query endorsements from different suppliers and provides a response in a unified
rash fashion so that the fragmentation in the ecosystem can be harmonized and a consistent way
of producing the endorsements and reference values as well as fetching them in a uniform fashion
is established basically it is based on the root standard called concise reference integrity manifest
so the data model and information model is the data model is very much coming from that and
has been adopted in rat working group the concise reference integrity model and it is pretty much
adopted by most of the vendors whether it is AMD Intel Nvidia and it is been very much going to
be the case for OCP which is one of the data center projects and data centers standards so on the
left is some of the features I won't go too much details about this because I have short amount of
time but I am happy to discuss offline anyone who has any questions on the right is the equivalent
implementation in the open source project version where we have a goalang course of library which
provides which collects evidences in different formats but provides to a verifier in a consistent
format and there is a query response unified API which is defined and there is a rest implementation
of that library now we focus our we discussed about reference values and endorsements values
we discussed about the tester let us know our focus to the verification well when there are as we
see when the composite tester has multiple components a single verifier may not have all the necessary
tools equipments or may not have the necessary expertise to verify everything so it might need to
delegate its work to multiple verifiers produced by their individual vendors so effectively that
may be the case and when there is a case like that you need multi verifier ecosystem then
because as I mentioned there could be lack of knowledge for single entity to stand up and build
that verifier or it could be simply complexities or cost the one single one single entity may not
have all the necessary resources to build the complete complex attestation verification mechanism
so it might need help of their individual vendors to produce and start their attestation
verification service but when there are multiple attestation verification service how do they
coordinate with each other to produce a coherent attestation results for the entire composite
attestation so we have a few of the some of the topological models of interaction between the
and so this is one of the model known as hierarchical model where you get a composite
evidence or combined evidence to a lead verifier who just who just break down the evidence
and send it to the individual component verifiers so you can see that the composite evidence
has been broken down into and component evidences and those are sent to the attestation verifiers
and then you get a attestation results which are partial attestation results from these
they are joined together and returned to the attestor or reliant party based on whatever
model we have and then there is equivalent model known as cascade model where the whole chain is
passed to sequence of verifiers which then individually assesses its own components and then
returns the aggregated attestation results back to the sequence back and the aggregated
attestation results are returned back to the attestor or the reliant party and of course you can combine
these two models to generate a hybrid model wherein the chain one of the verifier acts as a lead
verifier for the downstream verifiers so the models which I presented is is been in the ITF draft
these draft is very much a work in progress again I reiterate this is not yet adopted in the
Rats working group but there has been a sufficient community interest in this work and we have
having regular design meetings on this if anybody has a kind of topological thing feel free to
reach out most important one I want to highlight here is that according to the standards which I
mentioned here that draft is we have started an open source implementation of this lead verifier
which I mentioned you in the so we have started implementing this lead verifier topology this work
has just recently started so this is a kind of a low level design of a lead verifier where you
from the REST API front end you would get the composite evidence media type from that media type
you determine which parser I need to inject and then parser is been invoked to break down the
individual evidences with their own media types and then you dispatch it to individual clients
so you can then dispatch it to a client which talks to maybe an internal trust authority or a
dispatch it to a client which talks to a Nvidia verifier and then you collect the attestation results
from these verifiers and then join them and send aggregated attestation results to one who is
requested the attestation verification so this is very much a work in progress the lead the link
is all the GitHub issues are there if one is interested to look into the open source implementation
this work is started so I come to the last point of course we talked about a tester we talked
about endorsements we talked about verifier but what about the attestation results
well that is the most important because ultimately is the relying party who is consuming the
who is relying on the trust being given to it the trustworthiness assessed by the verifier
so it needs to be simple but at the same time not just with simplicity it needs to express
the compositional semantics it needs to understand that I am getting a results from these individual
components and this is the coherent attestation result I am looking at so
even though there may be component specific attestation results it should have a coherent view
of the entire attestation results so this work is very important because ultimately the
is the stakeholder is the relying party who is relying on the attestation of such kind of complexity
so fortunately we have been working quite a lot in the standards for addressing this and we have
each attestation results which is an obtained in ITF and which is based on an information model
called attestation results for secure interaction and each attestation results is we have tried
and tested either attestation results to see whether we can do compositional semantics where
each sub-mort of each attestation result each sub-mort can contain component attestation results
and you can just express the topology of results in the outer layer and that way it just suffices
to contain the attestation results but I must say that CMW also the concise message
rapper which I mentioned earlier for the evidence can also be very effectively used for conveying
the attestation results where the compositional semantics itself is in the wrapped inside the
message format itself because you can have a CMW inside the CMW so it naturally helps you
build the attestation results in an hierarchical fashion and on the right again as I have been saying
that whatever we work we do in standards is always backed by the open source implementation
so in project version you would find three libraries one goal angle library for ER and the
rust ER library for rust relying rust based integration of this and then there is a Python
ER to decode results yeah so well what I would say is that we have just kind of the composite
attestation story we we have been recently started this work so it's very much under development
but if anybody has any interesting use case which they would love to discuss on composite
attestation and they want to solve please communicate to us where that's working group
rats at ITF dot org and of course on open source implementation if anyone wants to discuss
anything about the open source implementation or if they have a use case which they want to bring
into this community project you are most welcome so thank you so much yes to Zama
okay I understand I think we have been talking easy you are and we can talk offline but I
wanted to make sure also yeah I have concerns not only for practice perspective I have concerns
there from personal perspective which is top open source yeah so my concern here from host
perspective is Intel ITA is not open source and video verified is not open source
this really breaks down the open source spectrum that or the spectrum that we are trying to
make is that as well as in the post and so sorry I didn't get I didn't get the question like
what is my question is Intel ITA has we don't know what policy they apply that's
resources we don't know what protocol they apply that's resource and video has resource
policy grow source protocol so this breaks down the whole open source ecosystem that we want
to develop so I want you to comment on this proposal specifically from host and perspective
how does this maintain the open source spirit of the host okay so I cannot comment on okay the
question is how does this spirit of open source connect with the closed source vendor solutions
so I cannot comment on any specific vendor so to say why they have open source it or why they
have not open source it and why they have not but it doesn't matter if the interface is if
follow a standardized interface to to their very fire and that can be communicated in a
standards way we can always talk to that get the results and combine it I don't see any issue
with that why why are we no it's all open source I don't get that point everything what we are
doing is open source not this but the policy is except so if you don't know the policies you
cannot claim it to be open source right so that that's for them to implement it's for them to
implement yeah I think this is something we should take off like any other questions
thank you
you