Attesting NVIDIA GPUs in a confidential computing environment
summary
Hopper GPUs include a hardware GPU Security Enclave that measures firmware, driver microcode, PCIe firewalls and MIG isolation, signs evidence with an x509 endorsement chain, and returns SPDM measurements verified against signed Reference Integrity Manifests (RIMs). NVIDIA supplies an attestation SDK, local open‑source verifier, OCSP revocation service and plans a remote verifier plus an attestation brokerage SDK to combine multi‑GPU attestations; sessions use AES‑GCM and RIM‑based appraisal so keys and data release only after verified appraisal.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:27Agenda
- 1:03Why is attestation important
- 3:25Technical terms
- 4:14GPU Security Enclave
- 6:59Reference Manifests
- 8:16Appraisal Policy
- 9:35Relying Party
- 10:44attestation sequence
- 13:55attestation time domain
- 15:28measurement groups
- 20:32attestation services
related talks
18mNVIDIA Confidential Computing Attestation for Next-Generation AI
23mSAGE: Software-based Attestation for GPU Execution
20mBuilding Trusted AI Factories with NVIDIA Accelerated Confidential Computing
44mGPU-less, Trust-less, Limit-less: Reimagining the Confidential AI Cloud
20mTrusted Hardware for AI Workloads: Extending Confidential...
42mSponsored Session: Confidential Computing - New Capabilities for New Workloads
36mSecurity for AI and Multi-Party Collaboration with Confidential Computing (Oh, and...- 42mSponsored Session: Confidential Computing - New Capabilities for New Workloads