An Introduction to Attesting Hitlessly Updatable Systems#

Matt King (NVIDIA)

• Why: A sharp conceptual contribution to the PM's identity/attestation interest: hitless firmware updates break the standard attestation model, because the platform can change between evidence production and relying-party use.
• What: An analysis of what attestation must become for platforms that update firmware while tenant workloads run: conventional measurements of the TCB that has run are insufficient; the relying party must also assess whether future updates could compromise the properties it depends on (from abstract only).
• How: Combine three evidence classes — current TCB measurements, the history of prior updates, and the policy governing future updates — so a relying party can make an informed decision about a system that changes while it runs.
• Where applicable: General technique for any attested platform doing hitless updates (switches, NICs, BMCs, accelerators); an introductory/conceptual talk, but it defines the problem shape the DMTF/OCP attestation work will have to address. Pairs with the SPDM provisioning talk below.