Title: RA-WEBs: Remote Attestation for WEB services Show Chinese title

Title: RA-WEBs：Web服务的远程认证

Abstract: Data theft and leakage, caused by external adversaries and insiders, demonstrate the need for protecting user data. Trusted Execution Environments (TEEs) offer a promising solution by creating secure environments that protect data and code from such threats. The rise of confidential computing on cloud platforms facilitates the deployment of TEE-enabled server applications, which are expected to be widely adopted in web services such as privacy-preserving LLM inference and secure data logging. One key feature is Remote Attestation (RA), which enables integrity verification of a TEE. However, $\textit{compatibility}$ issues with RA verification arise as no browsers natively support this feature, making prior solutions cumbersome and risky. To address these challenges, we propose $\texttt{RA-WEBs}$ ($\textbf{R}$emote $\textbf{A}$ttestation for $\textbf{Web}$ $\textbf{s}$ervices), a novel RA protocol designed for high compatibility with the current web ecosystem. $\texttt{RA-WEBs}$ leverages established web mechanisms for immediate deployability, enabling RA verification on existing browsers. We conduct a comprehensive security analysis, demonstrating $\texttt{RA-WEBs}$'s resilience against various threats. Our contributions include the $\texttt{RA-WEBs}$ proposal, a proof-of-concept implementation, an in-depth security analysis, and publicly available code for reproducible research. Show Chinese abstract

Abstract: 数据盗窃和泄露，由外部对手和内部人员引起，表明需要保护用户数据。 可信执行环境 (TEEs) 通过创建安全环境来保护数据和代码免受这些威胁，提供了一个有前景的解决方案。 云平台上机密计算的兴起促进了启用 TEE 的服务器应用程序的部署，这些应用预计将在隐私保护 LLM 推理和安全数据记录等网络服务中被广泛采用。 一个关键特性是远程认证 (RA)，它能够验证 TEE 的完整性。 然而，$\textit{compatibility}$与 RA 验证相关的问题出现，因为没有浏览器原生支持此功能，使得先前的解决方案复杂且存在风险。 为了解决这些挑战，我们提出了 $\texttt{RA-WEBs}$ ($\textbf{R}$emote $\textbf{A}$ttestation for $\textbf{Web}$ $\textbf{s}$ervices)，一种专为与当前网络生态系统高度兼容而设计的新型 RA 协议。 $\texttt{RA-WEBs}$利用已建立的网络机制以实现立即部署，使现有浏览器能够进行 RA 验证。 我们进行了一项全面的安全分析，证明$\texttt{RA-WEBs}$对各种威胁具有韧性。 我们的贡献包括$\texttt{RA-WEBs}$的提议，一个概念验证实现，深入的安全分析以及可用于可重复研究的公开代码。