End-to-end device attestation

A non-transitory machine-readable storage medium including instructions, wherein the instructions, when executed by a processing circuitry of a computing system, cause the processing circuitry to perform attestation operations to:

• obtain layered attestation evidence regarding a state of a hardware device capable to perform compute operations on behalf of the computing system, wherein the layered attestation evidence includes attesting evidence from a first hardware layer of the hardware device that is dependent on attesting evidence from a second hardware layer of the hardware device;
• obtain endorsement information to be used to evaluate the layered attestation evidence, the endorsement information obtained from a manifest and relating to a third party verification of the state of the hardware device;
• determine an appraisal policy to be used to evaluate the layered attestation evidence, the appraisal policy obtained from an expected device definition;
• validate attestation of the state of the hardware device by applying the appraisal policy and the endorsement information to evaluate the layered attestation evidence;
• and
• perform compute operations with the hardware device, in response to the attestation of the state of the hardware device.

A method, comprising a plurality of operations executed with a processor and memory of a computing system, to perform attestation operations comprising:

• obtaining layered attestation evidence regarding a state of a hardware device capable to perform compute operations on behalf of the computing system, wherein the layered attestation evidence includes attesting evidence from a first hardware layer of the hardware device that is dependent on attesting evidence from a second hardware layer of the hardware device;
• obtaining endorsement information to be used to evaluate the layered attestation evidence, the endorsement information obtained from a manifest and relating to a third party verification of the state of the hardware device;
• determining an appraisal policy to be used to evaluate the layered attestation evidence, the appraisal policy obtained from an expected device definition;
• validating attestation of the state of the hardware device by applying the appraisal policy and the endorsement information to evaluate the layered attestation evidence;
• and
• performing compute operations with the hardware device, in response to the attestation of the state of the hardware device.

An apparatus to perform attestation operations, comprising:

• means for identifying layered attestation evidence regarding a state of a hardware device capable to perform compute operations on behalf of the apparatus, wherein the layered attestation evidence includes attesting evidence from a first hardware layer of the hardware device that is dependent on attesting evidence from a second hardware layer of the hardware device;
• means for identifying endorsement information to be used to evaluate the layered attestation evidence, the endorsement information obtained from a manifest and relating to a third party verification of the state of the hardware device;
• means for determining an appraisal policy to be used to evaluate the layered attestation evidence, the appraisal policy obtained from an expected device definition;
• means for validating attestation of the state of the hardware device by applying the appraisal policy and the endorsement information to evaluate the layered attestation evidence;
• and
• means for causing compute operations to be performed with the hardware device, in response to the attestation of the state of the hardware device.