Opening the I/O gates with confidential containers
summary
Describes a TEE‑I/O framework that authenticates and encrypts PCIe devices so they can be directly assigned into confidential VMs and Kubernetes pods. It uses SPDM session key exchange, PCIe IDE encryption for link integrity and confidentiality, and TDISP/TDI assignments to lock virtual functions; a trusted device manager in-guest pulls device certificates and measurements, verifies them via the attestation agent, then hands a locked VF into the pod. Reports a working prototype integrated with the Kubernetes device plugin and upcoming CDI; some specs remain under standardization.
AI-written summary · about
chapters (6)
- 0:00Introduction to trusted I/O
- 2:08Threat model for trusted I/O
- 4:35Requirements for trusted I/O
- 5:59Introducing the TEIO framework
- 8:45How TEIO framework works
- 13:19Implementing TEIO in confidential containers
related talks
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment
41mIntroducing IO Devices into Trusted Execution Environments
31mSecure IO
30mDevice Attestation in Hardware TEE based Confidential Computing
38mConfidential Containers Explained
28mConfidential Devices (TEE I/O): A series of modest proposals
29mConfidential Containers: The Next Era of Cloud Data Security
30mTrust No One: Secure Storage With Confidential Containers