remote attestation
In plain wordsA way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it.
A protocol by which a device or trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with. proves to a remote verifier what code and configuration it is running. The hardware measures (hashes) the software as it loads and signs the measurements with a key rooted in the manufacturer; the verifier checks the signature chain and compares the measurements with expected values before releasing secrets or data. In AI systems, attestation lets users confirm that an inference service runs audited code before sending sensitive inputs, lets developers release model-weight decryption keys only to approved environments, and is central to proposals for hardware-enabled compute governance, in which chips could prove where and how they are used. It proves what was loaded, not that the code is free of bugs.
The client refused to send any data until remote attestation confirmed the enclave was running the published build.
Origin
Developed in the trusted-computing movement around 2000: the Trusted Computing Platform Alliance (formed 1999, later the Trusted Computing Group) specified the Trusted Platform Module, whose signed measurements enabled attestation. Enclave attestation came with Intel SGX (2015) and confidential-VM technologies.
Related
- trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with.
- confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine.
- compute governancecompute governance, n.: Using control over the computer chips and data centers that AI depends on — who can buy them, where they go, how they are used — as a way to oversee powerful AI.
- model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model.
Sources
- Coker, G. et al. (2011). Principles of Remote Attestation. International Journal of Information Security 10(2).
Mentioned in
confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine., trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with.