Remote Attestation

The remote attestation feature of the CCA Kit aims to prove that cVMs and the confidential computing platform are trustworthy.

• Whether cVMs are running in a real confidential computing environment
• Whether cVM parameters or code has been tampered with

The remote attestation feature of the CCA Kit leverages measured boot and the remote verification protocol.

• Trusted boot starts the confidential computing platform and cVMs by following the "measurement before execution" principle. An unforgeable measurement report is generated to verify the security of the initial system status.
• The verification protocol verifies the identities and initial system states of both cVMs and the confidential computing platform based on the measurement reports.

The remote attestation framework verifies the identities and initial system states of both the cVM and the confidential computing platform, based on their measurement reports. Connection to cVMs may be in either of the following scenarios:

• cVMs connect to the remote attestation client at cVM startup. Based on the remote attestation status, you can determine whether to proceed with the cVM startup.
• cVMs connect to the remote attestation client at cVM runtime. Based on the remote attestation status, you can determine whether to establish the secure communication channel.

Figure 1 illustrates the overall workflow of remote attestation during cVM startup.

Figure 1 Remote attestation process

During measurement initiation:

1. The user sends a cVM creation request to the host Linux, along with the cVM configuration information, kernel image, temporary file system, and device tree information.
2. The cVM Management Service sends the creation command through the QEMU/KVM.
3. The RMM creates the cVM and measures the creation process.
4. After the cVM is started, it runs the RATS-TLS Server in the temporary file system and waits for communication.
5. During the RATS-TLS server initialization phase, the attester of the CCA Kit requests a measurement report from the RMM through the RSI.
6. The host Linux returns the IP address of the CCA Kit cVM to the user's local machine.