  The Virtual Machine (VM)-based Trusted-Execution-Environment (TEE)
technology, like AMD Secure-Encrypted-Virtualization (SEV), enables the
establishment of Confidential VMs (CVMs) to protect data privacy. But CVM lacks
ways to provide the trust proof of its running state, degrading the user
confidence of using CVM. The technology of virtual Trusted Platform Module
(vTPM) can be used to generate trust proof for CVM. However, the existing
vTPM-based approaches have the weaknesses like lack of a well-defined
root-of-trust, lack of vTPM protection, and lack of vTPM's trust proof. These
weaknesses prevent the generation of the trust proof of the CVM. This paper
proposes an approach to generate the trust proof for AMD SEV-based CVM so as to
ensure its security by using a secure vTPM to construct Trusted Complete Chain
for the CVM (T3CVM). T3CVM consists of three components: 1) TR-Manager, as the
well-defined root-of-trust, helps to build complete trust chains for CVMs; 2)
CN-TPMCVM, a special CVM provides secure vTPMs; 3) CN-CDriver, an enhanced TPM
driver. Our approach overcomes the weaknesses of existing approaches and
enables trusted computing-based applications to run seamlessly in the trusted
CVM. We perform a formal security analysis of T3CVM, and implement a prototype
system to evaluate its performance.
