This topic describes how instances that support trusted computing work and explains the basic concepts of trusted computing technology.
What is trusted computing?
Trusted computing is a core feature that provides a high level of security for a tenant's cloud computing environment. It uses a virtual Trusted Platform Module (vTPM) at the virtualization layer as the Root of Trust to build a trust chain that covers the system boot process and user-specified applications. It also implements a remote attestation mechanism to provide end-to-end assurance during both the boot and runtime phases. By adding trusted validation to systems and applications, you can reduce the risk of attacks from unknown or tampered system software.
Instance families that support trusted computing
Compute-optimized instance family with high clock speeds hfc9i
General-purpose instance family with high clock speeds hfg9i
Memory-optimized instance family with high clock speeds hfr9i
Compute-optimized instance family with high clock speeds hfc8i
General-purpose instance family with high clock speeds hfg8i
Memory-optimized instance family with high clock speeds hfr8i
Instances in the g7t, c7t, and r7t families support SGX confidential computing. When you create these instances in the ECS console, the Alibaba Cloud SGX runtime is automatically installed. For more information, see Set up an SGX confidential computing environment.
How it works
Trusted computing provides verifiable integrity for your ECS instances to ensure they are not compromised by boot-level or kernel-level malware or rootkits. Trusted instances use Unified Extensible Firmware Interface (UEFI) secure firmware, a virtual Trusted Platform Module (vTPM) or virtual Trusted Cryptography Module (vTCM), and remote attestation services to measure and verify instance boot integrity, ensuring secure and trusted operation.
Hardware TPM/TCM Root of Trust
The core of trusted computing is the Trusted Platform Module (TPM) or Trusted Cryptography Module (TCM) security chip. The International Organization for Standardization (ISO) has defined an international standard for TPM (ISO 11889), and China has defined a national cryptographic standard for TCM (GM/T 0012-2020). The advantages of using a TPM or TCM chip as the Root of Trust include the following:
A TPM or TCM chip processes instructions using its internal firmware and logic circuits. It does not depend on the operating system and is not affected by external software vulnerabilities.
TPM and TCM chips provide strong physical tamper-proofing.
Trusted instances integrate trusted security chips, such as TPM or TCM chips, with compatible boot firmware and system software. This enables servers to build a trust chain.
Firmware security
Alibaba Cloud provides comprehensive security update capabilities for server firmware. During firmware updates, signature verification ensures that only authorized firmware is applied. This prevents attacks on the cloud infrastructure that use malicious firmware.
Virtual Trusted Platform Module vTPM/vTCM
A vTPM or vTCM is a virtualized security module that extends the Root of Trust from the hardware TPM or TCM to individual instances. A vTPM or vTCM fully complies with trusted computing standards, such as TPM 2.0 and TCM 2.0. When enabled, this feature creates a virtual Root of Trust within an ECS instance and implements a boot trust chain and remote attestation mechanism. When an instance is created, baseline integrity data is generated. This baseline is compared with subsequent boot measurements to detect changes. The attestation result, which indicates whether the instance is trusted, is displayed in the Security Center console.
UEFI secure firmware
Trusted instances use UEFI-compliant secure boot firmware to start the system. During the OS boot process, the UEFI firmware measures the integrity of system firmware, bootloaders, and kernel modules to establish a system boot trust chain.
Boot measurement
Measurements occur in a hierarchical order. Each component that is loaded measures the next component in the boot sequence. A successful measurement confirms that the trust chain is extended correctly.
Each time an instance boots, trusted components compute a hash value for each module in the boot chain as the module is loaded, from the underlying server hardware to the guest OS. These hash values are stored in the Root of Trust to form a trust chain. By measuring and verifying each module, the system ensures that no changes have occurred since the last boot.
Integrity verification
Integrity verification helps you understand the trusted status of your instance and make informed decisions.
During the first boot, trusted components create an initial set of measurements (hashes) as the integrity baseline and store it securely. During each subsequent boot, the same measurements are taken again. The trusted client performs remote attestation with the trusted service backend, reporting the latest measurements. The service then compares these measurements with the baseline to verify the integrity of the instance and determine whether it is running in the expected trusted state.
Integrity verification relies on boot measurements. This process compares the most recent boot measurements with the stored integrity baseline. If the measurements match, the verification passes, which means the instance is trusted. If they do not match, the verification fails, which means the instance is not trusted.
If the failure is expected, for example, after you perform a system update on the ECS instance, you can add the trusted event to a whitelist to update the integrity baseline. Future verifications will use this new baseline. For more information, see Handle trusted anomalies.
If the failure is unexpected, you should investigate the cause using the trusted event details to prevent the instance from running in an untrusted environment.