  Hypertext Transfer Protocol Secure (HTTPS) protocol has become an integral
part of modern Internet technology. Currently, it is the primary protocol for
commercialized web applications. It can provide a fast, secure connection with
a certain level of privacy and integrity, and it has become a basic assumption
on most web services on the Internet. However, HTTPS alone cannot provide
security assurances on request data in computing, so the computing environment
remains uncertain of risks and vulnerabilities. A hardware-based trusted
execution environment (TEE) such as Intel Software Guard Extension (Intel SGX)
or Intel Trust Domain Extensions (Intel TDX) provides in-memory encryption to
help protect runtime computation to reduce risks of illegal leaking or
modifying private information. (Note that we use SGX as an example for
illustration in the following texts.) The central concept of SGX enables
computation inside an enclave, a protected environment that encrypts the codes
and data pertaining to a security-sensitive computation. In addition, SGX
provides security assurances via remote attestation to the web client to
verify, including TCB identity, vendor identity, and verification identity.
Here, we propose an HTTP protocol extension, called HTTPS Attestable (HTTPA),
by including a remote attestation process onto the HTTPS protocol to address
the privacy and security concerns on the web and the access of trust over the
Internet. With HTTPA, we can provide security assurances for verification to
establish trustworthiness with web services and ensure the integrity of request
handling for web users. We expect that remote attestation will become a new
trend adopted to reduce the security risks of web services. We propose the
HTTPA protocol to unify the web attestation and accessing Internet services in
a standard and efficient way.
