Verbond
Build, deploy and audit applications with externally verifiable bounds on data flow.
Verbond is a system designed to verify and protect data while it is processed by services outside of the data owner’s control.
Before transmitting any sensitive data to a Verbond node, a Verbond client verifies both the code that will process the data and the policy governing where the data may move.
The tenant, the party who is providing the data processing code, is entirely untrusted in the Verbond architecture.
Conventional services offer a policy document and implement data protection measures in ways that users can’t inspect. The trust assumption is the service owner’s competence and good faith, and it’s unfalsifiable from the outside.
Verbond narrows that assumption to hardware, cryptographic primitives, and the client’s own verification rules.
How Verbond works
Two artefacts reach the client before any sensitive data leaves it.
1) Attestation: Hardware-based measurements of the OS image and service code that booted. Measurements are signed with a key sealed to that measured state, unusable if the machine is booted with anything else. The client compares these measurements against release identities published by verbond’s team and by the tenant. Substituted code produces different measurements, and the client will abort.
2) Contract: A contract contains machine readable rules that describe operations as data-flow graphs. These graphs identify the tenant code that will process the client’s data, the third parties that this code is permitted to reach, and what measures Verbond will enforce to prevent data leakage.
A verifier computes, from the graph alone, every origin that can reach each edge, and rejects any contract admitting a path from the client’s data to a third party without a sanctioned declassifier.
This is decidable without running the operation or seeing the service code, which is what lets the client refuse before transmitting any sensitive data.
The attestation proves that this same graph is enforced by Verbond’s runtime. This runtime confines execution to the graph, so that data moves only along declared edges.
Sessions are end-to-end encrypted to the single verified node; operators, network, and tenant see ciphertext. Session keys are ephemeral and erased at completion, so compromise of a node doesn’t expose completed sessions.
Trust and Scope
Trusted: hardware roots of trust, cryptographic primitives, the client.
Not trusted: the hardware operator (physical attacks and side channels excepted), the network, the tenant, the tenant’s task code, any supporting infrastructure.
Tenant correctness is explicitly out of scope: While a verbond runtime will guarantee the identity of the party that published the tenant code and contract, it can’t guarantee anything about the correctness of that code.
Verbond is designed to ensure that whatever x input you provide to a tenant’s plus_one(x) operation can’t be transmitted or stored without it being reflected in the contract. Verbond can’t ensure plus_one(1) == 2.
Status
- Design documents: coming soon
- Verbond OS Image: under development
- Verbond CLI: under development
- Verbond Audit: early design stages
Want to know when we launch? Currently development is tracked at my personal site, willem.dev, if you want to remain in the loop, sign up to the newsletter there.
If you are interested in becoming a design partner and getting early access, reach out to me directly at w@willem.dev.
Background
- Compliance as a runtime problem
- Prove to anyone what code is running on your server
- OpenPCC, inspired by Apple’s PCC.
- OpenPCC Whitepaper.
About the team
Verbond is a project by attested.systems, which currently consist of me, Willem Schots and a handful of contributors who aren’t ready to be named yet.
I’ve spent the 20 months building confidential computing infrastructure, with significant contributions to OpenPCC. Before that I have 15+ years of experience in developer tooling, general web development and e-commerce.
What does verbond mean?
Verbond: a noun of Dutch and Afrikaans origin.
It refers to a formal agreement, a binding union, or a mutually agreed-upon bond between individuals, groups, or nations.
Additionally, in English it could be a pun for verify-bond.