Nitride

Learn more about the Nitride Attestation framework and how to leverage the vHSM CLI as attestation agent

Nitride Attestation Framework

Attestation protocols can vary depending on the security processor, the CSPs implementation and the desired statement of security. However, the core principle remains the same: establishing a chain of trust that allows entities to verify the authenticity and trustworthiness of a platform.

Nitride attestation protocol flow

The Nitride attestation works as follows:

• The compute provider registers the security processor with the CPU vendor's CA (1).

• As part of the boot process the vHSM agent is loaded. The vHSM agent is an attestation shim, enabling to interact with the security processor and other trusted devices (e.g., PSP, vTPMs, HSMs) and meta services (e.g. CSP meta APIs) to create the attestation report (see below).

• The agent connects to nitride (2) and executes a remote attestation (3-4): it receives a challenge from nitride and generates for this challenge the attestation report. The report comprises measurements of the integrity of the TCB, optionally of the enclave code base along some identity information of the platform. The report is signed by an attestation key which is either linked to the security processor or the cloud service provider, and rooted in the PKI of the CPU manufacturer.

• Nitride issues an auth token granting access to third-party services, such as key management. See use case attested secret provisioning.