  Trying to address the security challenges of a cloud-centric software
deployment paradigm, silicon and cloud vendors are introducing confidential
computing - an umbrella term aimed at providing hardware and software
mechanisms for protecting cloud workloads from the cloud provider and its
software stack. Today, Intel SGX, AMD SEV, Intel TDX, etc., provide a way to
shield cloud applications from the cloud provider through encryption of the
application's memory below the hardware boundary of the CPU, hence requiring
trust only in the CPU vendor. Unfortunately, existing hardware mechanisms do
not automatically enable the guarantee that a protected system was not tampered
with during configuration and boot time. Such a guarantee relies on a hardware
RoT, i.e., an integrity-protected location that can store measurements in a
trustworthy manner, extend them, and authenticate the measurement logs to the
user.
  In this work, we design and implement a virtual TPM that virtualizes the
hardware RoT without requiring trust in the cloud provider. To ensure the
security of a vTPM in a provider-controlled environment, we leverage unique
isolation properties of the SEV-SNP hardware that allows us to execute secure
services as part of the enclave environment protected from the cloud provider.
We further develop a novel approach to vTPM state management where the vTPM
state is not preserved across reboots. Specifically, we develop a stateless
ephemeral vTPM that supports remote attestation without any persistent state on
the host. This allows us to pair each confidential VM with a private instance
of a vTPM completely isolated from the provider-controlled environment and
other VMs. We built our prototype entirely on open-source components. Though
our work is AMD-specific, a similar approach could be used to build remote
attestation protocols on other trusted execution environments.
