Hardware-Assisted Static and Runtime Attestation for Cloud Deployments

This article is devoted to the problems of static and runtime integrity for cloud deployments. Existing remote attestation solutions for cloud infrastructure do not cover static and dynamic attestation as a whole. They evaluate either the static or dynamic part, not considering the rest. We address this gap by proposing a runtime attestation process based on hardware CET technology, as an enhancement to static attestation enabled by SGX. We show how hardware-assisted protection for control-flow-related attacks can enhance virtual deployment security with minimal tradeoff. Our solution does not significantly increase the processing time. Moreover, a processing time can even be reduced when this mechanism is used as a default protection method against control-flow related attacks.