Device Attestation in Hardware TEE based Confidential Computing

## Confidential Computing Context

Arjun Nakajima and Joel present device attestation for hardware TEE-based confidential computing, a prerequisite for TEE I/O (assigning devices to trusted VMs like Intel TDX). Direct device assignment is not yet available for hardware TEE VMs, making attestation the critical first step.

## TDISP Architecture

The talk introduces the Trusted Device Interface Security Protocol (TDISP). Key entities include the TSM (TEE Security Manager) in the platform trust boundary and the DSM (Device Security Manager) on each device, communicating over a secure channel.

## Two Attestation Challenges

First, the TEE must verify device identity via X.509 certificate chains and firmware measurements (SVM) against policy manifests. Second, it must validate dynamic interface configuration—capabilities, MMIO mappings, and other VMM-assigned settings attackers could spoof.

## Data Protection Models

For TEE I/O use cases, standard PCR-based identity streams protect DMA paths; for TEE device models, bounce-buffer encryption uses negotiated keys. The speakers position attestation as foundational plumbing before confidential VMs can safely use physical devices.