Proving Attributes About Confidential Compute Services with Validation and Endorsement Services

We propose validation and endorsement services (VES), an abstract architecture for establishing trust in confidential compute services (CCS), such as confidential AI applications, that address two main challenges in current remote attestation frameworks. First, we form a hierarchy of VESes, enabling in-band validation of CCS workload attributes, which delegates trust to the VESes. Upon validation, VESes efficiently store endorsements for future lookups about a CCS. Second, VESes facilitate the dynamic discovery of verified CCSes that meet specified attributes. Our abstraction ultimately aims to enhance the flexibility and trustworthiness of confidential compute deployments.