Standard-Based Remote Attestation: The Veraison Project

Given the trend towards softwarized and distributed infrastructures, there is an increasing need to demonstrate the integrity of their components as a basis to evaluate their trustworthiness. To this aim, evidence about the current state of a component must be generated and provided to an external party that verifies it. This is a complex task because various architectures and proof types exist, and each scenario requires a custom strategy for verification. The current solutions are developed for specific contexts, resulting in a lack of standardisation and interoperability. Veraison is a standard-based open-source software that aims to address this issue enhancing consistency when developing an attestation framework. Based on the RATS architecture proposed by IETF, it reduces the effort necessary by offering a set of components easily adaptable to different use cases. This paper analyzes Veraison and compares it to existing integrity verification systems, to suggest possible applications and further developments.