A major limitation of TEEs is that attacks involving hardware intervention are generally regarded as out-of-scope. That is, with physical access to a server an attacker can break the guarantees TEEs are designed to provide, for example by using a memory bus interposer.
This means a TEE can only be trusted if we assume that no malicious parties have access to. We must include the hosting provider in the trust model. That is, if we assume the provider is honest and has good security practices to safeguard their servers, then we can assume the TEE upholds its confidentiality and integrity guarantees. The problem is, it is surprisingly hard to be sure that the instance you are communicating with is hosted by a particular provider.
Various techniques have been proposed to provide this ‘proof of cloud’. See our work on Data Center Execution Assurance, and Intel’s Platform Ownership Endorsements. For more discussion on how critical this is for TEE security, see: Mind the Gap - Where TEE Attestations Fall Short and Why Do TEEs Need Proof of Cloud | Flashbots Writings
Google Cloud Platform recently started offering a ‘provenance check’ for TDX.
This is based on Platform Provisioning IDs (PPIDs) which uniquely identify the host platform. These are included in the PCK certificate provided in the TDX quote evidence. Google provides a public ‘confidential host registry’ allowing you to look up a PPID value and check whether it belongs to Google. So, when verifying a TDX quote, you can extract the PPID from the PCK certificate, and with a single GET request establish whether the attestation is from a Google host.
This is a Google-specific solution. Ideally we would prefer Intel POEs which is an approach which any hosting provider can adopt. But the great thing about GCP provenance checks is that they are available to use today, so we have already incorporated it into our attestation verification library.
This means that you will be able to verify an attestation from a Flashbots TEE-based service and know whether it comes from a Google data center or potentially someone’s basement.
See also Google’s documentation of the feature: