Skip to content

Commit 7ec9590

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #294246 from mingweishih/cvm-guest-attestation-experience
Cvm guest attestation experience
2 parents affda99 + 1f190ac commit 7ec9590

File tree

4 files changed

+175
-0
lines changed

4 files changed

+175
-0
lines changed

‎articles/confidential-computing/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@
4949
href: confidential-vm-faq.yml
5050
- name: Guest attestation for confidential VMs
5151
href: guest-attestation-confidential-vms.md
52+
- name: Guest attestation Design for confidential VMs
53+
href: guest-attestation-confidential-virtual-machines-design.md
5254
- name: About Azure confidential GPUs
5355
href: gpu-options.md
5456
- name: Microsoft Defender for Cloud integration

‎articles/confidential-computing/guest-attestation-confidential-virtual-machines-design.md

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
---
2+
title: Azure Confidential VM guest attestation design detail
3+
description: Learn about the design detail of the guest attestation for Azure confidential virtual machines.
4+
author: mishih
5+
ms.author: mishih
6+
ms.service: azure-virtual-machines
7+
ms.subservice: azure-confidential-computing
8+
ms.topic: conceptual
9+
ms.date: 02/06/2025
10+
ms.custom: template-concept
11+
---
12+
13+
# Confidential VM Guest Attestation Design Detail
14+
15+
This document provides a detailed overview of the [Azure confidential VM Guest Attestation](guest-attestation-confidential-vms.md) design.
16+
17+
## vTPM-Based Design
18+
19+
Azure confidential virtual machines (VMs) utilize a vTPM-based design for the guest attestation. The approach ensures a consistent interface across guest operating systems (Linux and Windows) and hardware platforms (AMD SEV-SNP and Intel TDX).
20+
21+
## Attestation Flow
22+
23+
The guest attestation process involves two main steps: evidence generation and evidence verification. A user requests the Azure confidential VM to generate vTPM evidence and then send the evidence to a trusted party (for example, [Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) for verification.
24+
25+
A relying party, such as [Azure Key Vault Premium](../security/fundamentals/key-management.md) or [Azure Key Vault Managed HSM](/azure/key-vault/managed-hsm/overview), can assess the trustworthiness of the Azure confidential VM based on the verification results. If the VM is deemed trustworthy, the relying party can securely provision secrets to the VM, using mechanisms like [Secure Key Release](concept-skr-attestation.md).
26+
27+
### vTPM Evidence
28+
29+
A vTPM evidence consists of a TPM quote and endorsements used to verify the quote, as outlined in the rest of the section.
30+
- TPM Quote
31+
- A standard TPM quote that is the output of `TPM2_Quote` command defined by TPM 2.0 specification.
32+
- Includes a list of Platform Configuration Registers (PCRs) that captures the measurements of the guest OS (for example, boot process).
33+
- The usage of PCRs conforms to Linux and Windows standards (each having its usage definition).
34+
- Signed by vTPM attestation private key (AK); that is, AK is specified as the signing key in the `TPM2_Quote` command.
35+
36+
- TPM Event Log
37+
- An event log stored in the system that can be used to reproduce PCR values in the TPM quote.
38+
- Refer to [TPM specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG-Guidance-Integrity-Measurements-Event-Log-Processing_v1_r0p118_24feb2022-1.pdf) for more detail.
39+
40+
- vTPM AK Certificate
41+
- Issued by Azure (signed by Azure CA).
42+
- Backed by hardware (the vTPM attestation public key, AK public, is captured in the hardware report).
43+
44+
- Hardware Report
45+
- Generated and signed by the hardware.
46+
- Capture the following information
47+
- AK public
48+
- The measurement of Microsoft-built guest paravisor where the vTPM runs
49+
- Learn more in [Confidential VMs on Azure](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/confidential-vms-on-azure/ba-p/3836282)).
50+
- Hardware information
51+
- Refer to AMD SEV-SNP and Intel TDX specifications for more detail.
52+
53+
- Hardware Vendor Certificate Chain
54+
- Issued by hardware vendor (AMD and Intel) to certify the signature of the hardware report.
55+
- AMD SEV-SNP: Versioned Chip Endorsement Key (VCEK) Certificates
56+
- Intel TDX: Provisioning Certificate Key (PCK) Certificates
57+
58+
### What are being covered by a vTPM Evidence?
59+
60+
| Component | Covered by |
61+
| :--- | :--- |
62+
| Guest OS | TPM Quote (PCRs) |
63+
| UEFI | Hardware Report |
64+
| Guest Paravisor (including vTPM) | Hardware Report |
65+
66+
### How is vTPM Evidence verified?
67+
68+
The verifier ([Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) verified the vTPM evidence based on the trusted chain, as shown in the following figure. Successful verification implies that the attested Azure confidential VM is trustworthy and protected by the hardware.
69+
70+
![Figure of vTPM-based Evidence Trust Chain](media/guest-attestation-confidential-vms-design/azure-cvm-trusted-chain.png)
71+
72+
## Developer's Reference
73+
74+
This section provides a reference to the vTPM-based guest attestation design used by Azure confidential VM.
75+
76+
### Azure-Reserved TPM NV Indexes
77+
78+
| Name | NV Index | Size (bytes) | Description |
79+
| :--- | :--- | :--- | :--- |
80+
| Attestation Report | 0x01400001 | 2600 | Azure-defined format with the hardware report embedded. |
81+
| Report Data | 0x01400002 | 64 | The report data to be included in the Runtime Data. |
82+
| vTPM AK Cert | 0x01C101D0 | 4096 | The certificate used to verify the TPM Quote signed by the vTPM AK. |
83+
| vTPM AK | 0x81000003 | Depending on the key type | The key used to sign the TPM Quote. |
84+
85+
Refer to [Azure Confidential VMs attestation guidance & FAQ](https://github.com/Azure/confidential-computing-cvm-guest-attestation/blob/main/cvm-guest-attestation.md) for sample TPM commands.
86+
87+
### Attestation Report Format
88+
89+
#### Attestation Report
90+
91+
| Name | Offset (bytes) | Size (bytes) | Description |
92+
| :--- | :--- | :--- | :--- |
93+
| Header | 0 | 32 | The report header (not endorsed by the hardware report). |
94+
| Report Payload | 32 | 1184 | The hardware report. |
95+
| Runtime Data | 1216 | variable length | The runtime data includes claims endorsed by the hardware report. |
96+
97+
98+
#### Header
99+
100+
| Name | Offset (bytes) | Size (bytes) | Description |
101+
| :--- | :--- | :--- | :--- |
102+
| Signature | 0 | 4 | Embedded signature. Expected: 0x414c4348 (`HCLA`). |
103+
| Version | 4 | 4 | Format version. Expected: 2.
104+
| Report Size | 8 | 4 | Size of the Report Payload. Expected: 1184 (AMD SEV-SNP), 1024 (Intel TDX). |
105+
| Request Type | 12 | 4 | Azure-specific usage of the attestation report. Expected: 2. |
106+
| Status | 16 | 4 | Reserved. |
107+
| Reserved | 20 | 12 | Reserved. |
108+
109+
#### Report Payload
110+
111+
The report generated by the hardware (AMD SEV-SNP or Intel TDX). The report_data field of the report captures the hash of the Runtime Claims in the Runtime Data. Refer to specifications from hardware vendors for more detail.
112+
113+
#### Runtime Data
114+
115+
| Name | Offset (bytes) | Size (bytes) | Description | Measured |
116+
| :--- | :--- | :--- | :--- | :--- |
117+
| Data Size | 0 | 4 | The size of Runtime Claims. | No |
118+
| Version | 4 | 4 | Format version. Expected: 1. | No |
119+
| Report Type | 8 | 4 | The type of hardware report. Expected: 2 (AMD SEV-SNP), 4 (Intel TDX) | No |
120+
| Hash Type | 12 | 4 | The algorithm used to hash the runtime data. The hash value is captured in the report_data field of the hardware report. Expected: 1 (SHA-256), 2 (SHA-384), 3 (SHA-512) | No |
121+
| Runtime Claims | 16 | variable length | The runtime claims in JSON format. | Yes |
122+
123+
#### Runtime Claims
124+
125+
| JSON Field | Description |
126+
| :--- | :--- |
127+
| keys | An array of keys in JWK format. Expected `kid`: `HCLAkPub` (vTPM AK public), `HCLEkPub` (vTPM EK public). |
128+
| vm_configuration | Selective Azure confidential VM configuration. |
129+
| user_data | 64-byte data (HEX string) read from `0x01400002` NV index (Report Data). |
130+
131+
Example
132+
133+
```JSON
134+
{
135+
"keys": [
136+
{
137+
"kid": "HCLAkPub",
138+
"key_ops": [
139+
"sign"
140+
],
141+
"kty": "RSA",
142+
"e": "AQAB",
143+
"n": "rAipdAAArL6V1FNnSQ-39i3VH-a8PuOeVRo2VpecspDWbJNmgHJ4-VGGFEx4sdVbvDC6fyo_VM2ebE-_AKxTmrNVEr-KIZveJMD_vlOqvMvjtllsWwA-vsRfpqiduvQdFcdCvyHzfxBRHYqdmxgKq-3QI-XBbZv9cCMMMPHkNp4mWkyahjQxXVJVwB1egCrJGKSk1bRXlP1dXNG_Pe4-W5O-YEGRKdLIA31G0Yh8VBnrEUCAMjDAuh6fncMkwdMVskI5Ta-kJgGw4GepIj6_smIyYhxg3o8Ik4qPntxj1TrV0bVW2IiNMLHoM67y1ErOir7bv00xqgqouFodI-vM3Q"
144+
},
145+
{
146+
"kid": "HCLEkPub",
147+
"key_ops": [
148+
"encrypt"
149+
],
150+
"kty": "RSA",
151+
"e": "AQAB",
152+
"n": "m3AfPAAA-_HY3M_-x4bQbr0p2nkvAgig1mENl-BColvqq0aKKAqIHr-DFQ9-iB2z7EzhYVon5R7Nc1jzqBsmxahE8uaQfD-sp8bWOtbvy4V9nAqLY4HOwfxlJ99cEOOpxNXfCNesYOk8T0ntG05w7oBRjFw0LMVKS-1S3j5-oMnNnpJoo7rX5hNM8JVpxEuVa1IOf1NmvRey6wjwSHbjUay_IMUTAq1wzpx8wo_hjeY4JMd0Ka1ewLjJDaTQSpSxZI36ujyR6EGho0FBXSKN-9W9DAXkO8-RKuLUrmTXA6ETJRYApMuYGiUDCk1Y5zQTQsyWS6pLjnf2mg2tEntZZw"
153+
}
154+
],
155+
"vm-configuration": {
156+
"root-cert-thumbprint": "",
157+
"console-enabled": true,
158+
"secure-boot": true,
159+
"tpm-enabled": true,
160+
"tpm-persisted": true,
161+
"vmUniqueId": "68dc0ac0-2ed9-4b2a-a03e-4953e416d939"
162+
},
163+
"user-data": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
164+
}
165+
```
166+
167+
## Next Steps
168+
169+
- [Learn more about the guest attestation APIs](guest-attestation-confidential-vms.md)
170+
- [Learn to use a sample application with the guest attestation APIs](guest-attestation-example.md)
171+
- [Learn how to use Microsoft Defender for Cloud integration with confidential VMs with guest attestation installed](guest-attestation-defender-for-cloud.md)
172+
- [Learn about Azure confidential VMs](confidential-vm-overview.md)

‎articles/confidential-computing/guest-attestation-confidential-vms.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,7 @@ You can extract different parts of the JSON web token for the [different API sce
345345

346346
## Next steps
347347

348+
- [Learn more about the guest attestation design](guest-attestation-confidential-virtual-machines-design.md)
348349
- [Learn to use a sample application with the guest attestation APIs](guest-attestation-example.md)
349350
- [Learn how to use Microsoft Defender for Cloud integration with confidential VMs with guest attestation installed](guest-attestation-defender-for-cloud.md)
350351
- [Learn about Azure confidential VMs](confidential-vm-overview.md)

‎articles/confidential-computing/media/guest-attestation-confidential-vms-design/azure-cvm-trusted-chain.png

23.1 KB
Loading

0 commit comments

Comments
 (0)