Narrowing the Gap between TEEs Threat Model and Deployment Strategies

2025-06-17

AI Summary

Current CVM threat models exhibit a critical disconnect from real-world deployments: their remote attestation mechanisms are not bound to specific cloud providers, preventing users from verifying whether trusted execution environments (TEEs) operate on physically trusted infrastructure. Consequently, physical attack risks remain unquantifiable, and end-to-end security guarantees cannot be established. This paper identifies and systematically analyzes this fundamental flaw for the first time. We propose a cross-vendor verifiable attestation extension framework grounded in the Protected Platform Identifier (PPID), which abstracts and standardizes attestation workflows and interfaces to anchor trust at the physical layer. Our portable verification framework supports major TEE platforms—including Intel TDX and AMD SEV-SNP—significantly enhancing the assessability of physical attack risks and deployment trustworthiness for external users. It further enables decentralized attestation and facilitates secure cross-cloud workload migration.

Technology Category

• Application Domains: Security
• Computer Vision: Low Level & Physics-based Vision
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Security and Privacy: Privacy-enhancing technologies
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures

Abstract

Confidential Virtual Machines (CVMs) provide isolation guarantees for data in use, but their threat model does not include physical level protection and side-channel attacks. Therefore, current deployments rely on trusted cloud providers to host the CVMs' underlying infrastructure. However, TEE attestations do not provide information about the operator hosting a CVM. Without knowing whether a Trusted Execution Environment (TEE) runs within a provider's infrastructure, a user cannot accurately assess the risks of physical attacks. We observe a misalignment in the threat model where the workloads are protected against other tenants but do not offer end-to-end security assurances to external users without relying on cloud providers. The attestation should be extended to bind the CVM with the provider. A possible solution can rely on the Protected Platform Identifier (PPID), a unique CPU identifier. However, the implementation details of various TEE manufacturers, attestation flows, and providers vary. This makes verification of attestations, ease of migration, and building applications without relying on a trusted party challenging, highlighting a key limitation that must be addressed for the adoption of CVMs. We discuss two points focusing on hardening and extensions of TEEs' attestation.

Problem

• CVMs lack physical level protection and side-channel attack defenses
• TEE attestations fail to verify the hosting provider's trustworthiness
• Diverse TEE implementations complicate attestation verification and migration

Innovation

• Extends TEE attestation to bind CVM with provider
• Uses Protected Platform Identifier for verification
• Hardens TEE attestation against physical attacks