Skip to content

Commit 51e8770

Browse files
authored
Updating attestation concepts title and typos
1 parent 489d1d1 commit 51e8770

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

articles/container-instances/confidential-containers-attestation-concepts.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ services: container-instances
99
ms.date: 04/20/2023
1010
---
1111

12-
# What is attestation?
12+
# Attestation in Confidential containers on Azure Container Instances
1313

1414
Attestation is an essential part of confidential computing and appears in the definition by the Confidential Computing Consortium “Confidential Computing is the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment."
1515

@@ -21,9 +21,9 @@ In Confidential Containers on ACI you can use an attestation token to verify tha
2121
- Is running on an Azure compliant utility VM.
2222
- Is enforcing the expected confidential computing enforcement policy (cce) that was generated using [tooling](https://github.com/Azure/azure-cli-extensions/blob/main/src/confcom/azext_confcom/README.md).
2323

24-
## Full attestation in confidential containers on Azure Container Instances
24+
## Full attestation
2525

26-
Expanding upon this concept of attestation. Full attestation captures all the components that are part of the Trusted Execution Environment that is remotely verifiable. To achieve full attestation, in Confidential Containers, we have introduced the notion of a cce policy, which defines a set of rules, which is enforced in the utility VM. The security policy is encoded in the attestation report as an SHA-256 digest stored in the HostData attribute, as provided to the PSP by the host operating system during the VM boot-up. This means that the security policy enforced by the utility VM is immutable throughout the lifetime of the utility VM.
26+
Expanding upon this concept of attestation. Full attestation captures all the components that are part of the Trusted Execution Environment that is remotely verifiable. To achieve full attestation, in Confidential Containers, we have introduced the notion of a cce policy, which defines a set of rules, which is enforced in the utility VM. The security policy is encoded in the attestation report as an SHA-256 digest stored in the HostData attribute, as provided to the AMD SEV-SNP hardware by the host operating system during the VM boot-up. This means that the security policy enforced by the utility VM is immutable throughout the lifetime of the utility VM.
2727

2828
The exhaustive list of attributes that are part of the SEV-SNP attestation can be found [here](https://www.amd.com/system/files/TechDocs/56860.pdf).
2929

0 commit comments

Comments
 (0)