Skip to content

Commit 18712e1

Browse files
mingweishihmingweishih
committed
Guest attestation experience for CVMs
Signed-off-by: Ming-Wei Shih <[email protected]>
1 parent bf8ced8 commit 18712e1

File tree

3 files changed

+168
-0
lines changed

3 files changed

+168
-0
lines changed

‎articles/confidential-computing/guest-attestation-confidential-vms-design.md

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
---
2+
title: Confidential VM guest attestation design detail
3+
description: Learn about the design detail of the guest attestation for Azure confidential virtual machines.
4+
author: mishih
5+
ms.author: mishih
6+
ms.service: virtual-machines
7+
ms.subservice: confidential-computing
8+
ms.topic: conceptual
9+
ms.date: 05/21/2024
10+
ms.custom: template-concept
11+
---
12+
13+
# Confidential VM Guest Attestation Design Detail
14+
15+
This document provides a detailed overview of the [Azure confidential VM Guest Attestation](guest-attestation-confidential-vms.md) design.
16+
17+
## vTPM-Based Design
18+
19+
Azure confidential VMs utilize a vTPM-based design for the guest attestation. The approach ensures a consistent interface across guest operating systems (Linux and Windows) and hardware platforms (AMD SEV-SNP and Intel TDX).
20+
21+
## Attestation Flow
22+
23+
The guest attestation process involves two main steps: evidence generation and evidence verification. The Azure confidential VM generates vTPM evidence, which is then verified by a trusted party (e.g., [Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)).
24+
25+
A relaying party, such as [Azure Key Vault Premium](../security/fundamentals/key-management.md) or [Azure Key Vault Managed HSM](../key-vault/managed-hsm/overview.md), can assess the trustworthiness of the Azure confidential VM based on the verification results. If the VM is deemed trustworthy, the relying party can securely provision secrets to the VM, using mechanisms like [Secure Key Release](concept-skr-attestation.md).
26+
27+
### vTPM Evidence
28+
29+
A vTPM evidence consists of a TPM quote and endorsements used to verify the quote, as outlined below:
30+
- TPM Quote
31+
- A standard TPM quote that is generated by `TPM2_Quote` command defined by TPM 2.0 specification.
32+
- Includes a list of Platform Configuration Registers (PCRs) that captures the measurements of the guest OS (e.g., boot process).
33+
- The usage of PCRs conforms to Linux and Windows standards (each having its usage definition).
34+
- The quote is signed by vTPM attestation private key (AK); i.e., AK is specified as the signing key in the `TPM2_Quote` command.
35+
36+
- TPM Event Log
37+
- An event log stored in the system that can be used to reproduce PCR values in the TPM quote.
38+
- Refer to [TPM specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG-Guidance-Integrity-Measurements-Event-Log-Processing_v1_r0p118_24feb2022-1.pdf) for more detail.
39+
40+
- vTPM AK Certificate
41+
- Issued by Azure (signed by Azure CA).
42+
- Backed by hardware (the vTPM attestation public key, AK public, is captured in the hardware report).
43+
44+
- Hardware Report
45+
- Generated and signed by the hardware, capturing the AK public, the measurement of Microsoft-built guest paravisor (where the vTPM is hosted), and the hardware information (learn more in [Confidential VMs on Azure](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/confidential-vms-on-azure/ba-p/3836282)).
46+
- Refer to AMD SEV-SNP and Intel TDX specifications for more detail.
47+
48+
- Hardware Vendor Certificate Chain
49+
- Issued by hardware vendor (AMD and Intel) to certify the signature of the hardware report.
50+
- AMD SEV-SNP: Versioned Chip Endorsement Key (VCEK) Certificates
51+
- Intel TDX: Provisioning Certificate Key (PCK) Certificates
52+
53+
### What are being covered by a vTPM Evidence?
54+
55+
| Component | Covered by |
56+
| :--- | :--- |
57+
| Guest OS | TPM Quote (PCRs) |
58+
| UEFI | Hardware Report |
59+
| Guest Paravisor (including vTPM) | Hardware Report |
60+
61+
### How is vTPM Evidence verified?
62+
63+
The verifier ([Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) verified the vTPM evidence based on the trusted chain, as shown in the figure below. Successful verification implies that the attested Azure confidential VM is trustworthy and protected by the hardware.
64+
65+
![Figure of vTPM-based Evidence Trust Chain](media/guest-attestation-confidential-vms-design/azure-cvm-trusted-chain.png)
66+
67+
## Developer's Reference
68+
69+
This section provides a reference to the vTPM-based guest attestation design used by Azure confidential VM.
70+
71+
### Azure-Reserved TPM NV Indexes
72+
73+
| Name | NV Index | Size (bytes) | Description |
74+
| :--- | :--- | :--- | :--- |
75+
| Attestation Report | 0x01400001 | 2600 | Azure-defined format with the hardware report embedded. |
76+
| Report Data | 0x01400002 | 64 | The report data to be included in the Runtime Data. |
77+
| vTPM AK Cert | 0x01C101D0 | 4096 | The certificate used to verify the TPM Quote signed by the vTPM AK. |
78+
| vTPM AK | 0x81000003 | Depending on the key type | The key used to sign the TPM Quote. |
79+
80+
Refer to [Azure Confidential VMs attestation guidance & FAQ](https://github.com/Azure/confidential-computing-cvm-guest-attestation/blob/main/cvm-guest-attestation.md) for sample TPM commands.
81+
82+
### Attestation Report Format
83+
84+
#### Attestation Report
85+
86+
| Name | Offset (bytes) | Size (bytes) | Description |
87+
| :--- | :--- | :--- | :--- |
88+
| Header | 0 | 32 | The report header (not endorsed by the hardware report). |
89+
| Report Payload | 32 | 1184 | The hardware report. |
90+
| Runtime Data | 1216 | variable length | The runtime data includes claims endorsed by the hardware report. |
91+
92+
93+
#### Header
94+
95+
| Name | Offset (bytes) | Size (bytes) | Description |
96+
| :--- | :--- | :--- | :--- |
97+
| Signature | 0 | 4 | Embedded signature. Expected: 0x414c4348 (`HCLA`). |
98+
| Version | 4 | 4 | Format version. Expected: 2.
99+
| Report Size | 8 | 4 | Size of the Report Payload. Expected: 1184 (AMD SEV-SNP), 1024 (Intel TDX). |
100+
| Request Type | 12 | 4 | Azure-specific usage of the attestation report. Expected: 2. |
101+
| Status | 16 | 4 | Reserved. |
102+
| Reserved | 20 | 12 | Reserved. |
103+
104+
#### Report Payload
105+
106+
The report generated by the hardware (AMD SEV-SNP or Intel TDX). The report_data field of the report captures the hash of the Runtime Claims in the Runtime Data. Refer to specifications from hardware vendors for more detail.
107+
108+
#### Runtime Data
109+
110+
| Name | Offset (bytes) | Size (bytes) | Description | Measured |
111+
| :--- | :--- | :--- | :--- | :--- |
112+
| Data Size | 0 | 4 | The size of Runtime Claims. | No |
113+
| Version | 4 | 4 | Format version. Expected: 1. | No |
114+
| Report Type | 8 | 4 | The type of hardware report. Expected: 2 (AMD SEV-SNP), 4 (Intel TDX) | No |
115+
| Hash Type | 12 | 4 | The algorithm used to hash the runtime data. The hash value is captured in the report_data field of the hardware report. Expected: 1 (SHA-256), 2 (SHA-384), 3 (SHA-512) | No |
116+
| Runtime Claims | 16 | variable length | The runtime claims in JSON format. | Yes |
117+
118+
#### Runtime Claims
119+
120+
| JSON Field | Description |
121+
| :--- | :--- |
122+
| keys | An array of keys in JWK format. Expected `kid`: `HCLAkPub` (vTPM AK public), `HCLEkPub` (vTPM EK public). |
123+
| vm_configuration | Selective Azure confidential VM configuration. |
124+
| user_data | 64-byte data (HEX string) read from `0x01400002` NV index (Report Data). |
125+
126+
Example
127+
128+
```JSON
129+
{
130+
"keys": [
131+
{
132+
"kid": "HCLAkPub",
133+
"key_ops": [
134+
"sign"
135+
],
136+
"kty": "RSA",
137+
"e": "AQAB",
138+
"n": "rAipdAAArL6V1FNnSQ-39i3VH-a8PuOeVRo2VpecspDWbJNmgHJ4-VGGFEx4sdVbvDC6fyo_VM2ebE-_AKxTmrNVEr-KIZveJMD_vlOqvMvjtllsWwA-vsRfpqiduvQdFcdCvyHzfxBRHYqdmxgKq-3QI-XBbZv9cCMMMPHkNp4mWkyahjQxXVJVwB1egCrJGKSk1bRXlP1dXNG_Pe4-W5O-YEGRKdLIA31G0Yh8VBnrEUCAMjDAuh6fncMkwdMVskI5Ta-kJgGw4GepIj6_smIyYhxg3o8Ik4qPntxj1TrV0bVW2IiNMLHoM67y1ErOir7bv00xqgqouFodI-vM3Q"
139+
},
140+
{
141+
"kid": "HCLEkPub",
142+
"key_ops": [
143+
"encrypt"
144+
],
145+
"kty": "RSA",
146+
"e": "AQAB",
147+
"n": "m3AfPAAA-_HY3M_-x4bQbr0p2nkvAgig1mENl-BColvqq0aKKAqIHr-DFQ9-iB2z7EzhYVon5R7Nc1jzqBsmxahE8uaQfD-sp8bWOtbvy4V9nAqLY4HOwfxlJ99cEOOpxNXfCNesYOk8T0ntG05w7oBRjFw0LMVKS-1S3j5-oMnNnpJoo7rX5hNM8JVpxEuVa1IOf1NmvRey6wjwSHbjUay_IMUTAq1wzpx8wo_hjeY4JMd0Ka1ewLjJDaTQSpSxZI36ujyR6EGho0FBXSKN-9W9DAXkO8-RKuLUrmTXA6ETJRYApMuYGiUDCk1Y5zQTQsyWS6pLjnf2mg2tEntZZw"
148+
}
149+
],
150+
"vm-configuration": {
151+
"root-cert-thumbprint": "",
152+
"console-enabled": true,
153+
"secure-boot": true,
154+
"tpm-enabled": true,
155+
"tpm-persisted": true,
156+
"vmUniqueId": "68dc0ac0-2ed9-4b2a-a03e-4953e416d939"
157+
},
158+
"user-data": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
159+
}
160+
```
161+
162+
## Next Steps
163+
164+
- [Learn more about the guest attestation APIs](guest-attestation-confidential-vms.md)
165+
- [Learn to use a sample application with the guest attestation APIs](guest-attestation-example.md)
166+
- [Learn how to use Microsoft Defender for Cloud integration with confidential VMs with guest attestation installed](guest-attestation-defender-for-cloud.md)
167+
- [Learn about Azure confidential VMs](confidential-vm-overview.md)

‎articles/confidential-computing/guest-attestation-confidential-vms.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,7 @@ You can extract different parts of the JSON web token for the [different API sce
345345

346346
## Next steps
347347

348+
- [Learn more about the guest attestation design](guest-attestation-confidential-vms-design.md)
348349
- [Learn to use a sample application with the guest attestation APIs](guest-attestation-example.md)
349350
- [Learn how to use Microsoft Defender for Cloud integration with confidential VMs with guest attestation installed](guest-attestation-defender-for-cloud.md)
350351
- [Learn about Azure confidential VMs](confidential-vm-overview.md)

‎articles/confidential-computing/media/guest-attestation-confidential-vms-design/azure-cvm-trusted-chain.png

23.1 KB
Loading

0 commit comments

Comments
 (0)