OPS-33 Confidential Computing - Remote Attestation

If the cloud service comprises capabilities for confidential computing, the cloud service provider offers remote attestation functionalities for data in-use protection.

Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.

Remote attestation functionalities comprise an interface that allows the customer to verify the integrity of the remote attestation.

Supplementary information

The attestation interface allows customers to securely retrieve attestation evidence from the confidential computing environment. Verification of this evidence may be performed by the customer or by trusted third-party services.

The cloud service provider clearly defines, documents and communicates the available attestation levels.

Supplementary information

Remote attestation can be performed at different locations and with different trust levels:

1. Cloud service customers retrieve evidence from TEEs and perform verification in an environment fully trusted by them. This scenario is generally assumed to provide a very strong attestation;

2. Cloud service providers retrieve evidence from TEEs, perform verification in verification services they control and provide verification results and evidence to the cloud service customer. Cloud service customers verify the attestation evidence in an environment fully trusted by them. This scenario is generally assumed to provide a very strong attestation;

3. Cloud service customers retrieve evidence from TEEs and send it to an evidence verification service they trust. This scenario is generally assumed to provide a strong attestation; and

4. Cloud service providers retrieve evidence from TEEs, send it to a verification service in their control and only return verification result to cloud service customers. This scenario is generally assumed to provide a weak attestation.

The information is part of the guidelines and recommendations for the secure use of the cloud service provided (cf. PSS-01).