Duet: Combining a Trustworthy Controller with a Confidential Computing Environment

Traditionally, sensitive data is protected with encryption in transit and at rest. Confidential Computing by means of hardware-based Trusted Execution Environments (TEEs) enables organizations to protect their data also in use, such that the owner of a TEE application can ensure its integrity via remote attestation. Process-based TEEs (e.g., Intel SGX) allow the integrity check to be performed by other users besides the owner, but require re-architecting the application and lack support for specialized hardware (e.g., GPUs). In contrast, virtual machine (VM)-based TEEs can run entire operating systems confidentially, with access to specialized hardware and ease of use without modifications to applications, but only offer an attestation based on the initial state of the VM. In this paper, we propose duet, combining the advantages of process-based and VM-based TEEs; thus, simultaneously providing runtime integrity, ease of use and flexibility. In duet, a process-based TEE application implements a trustworthy controller that acts as the agent of the application owner to deploy and maintain a confidentiality-offering service on a Confidential VM (CVM). As such, any administrative operations conducted on the CVM are performed only by the trustworthy controller. By combining the runtime attestation of the controller application and its logs of the administrative CVM operations, third-party users can have more confidence on the CVM's (and the service's) integrity. At the same time, application owners can benefit from specialized hardware supported by the CVM, the ease of use when deploying applications and the flexibility it offers in terms of runtime maintenance.