# RA-WEBs: Remote Attestation for WEB services

arXiv: https://arxiv.org/abs/2411.01340 · HTML: https://mlsanity.com/paper/2411.01340/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Nov 2024.

## Built on by (most cited first, 1 of 1)

- [AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs](https://mlsanity.com/paper/2603.14283/) (2026)

## Abstract (arXiv)

Data theft and leakage, caused by external adversaries and insiders, demonstrate the need for protecting user data. Trusted Execution Environments (TEEs) offer a promising solution by creating secure environments that protect data and code from such threats. The rise of confidential computing on cloud platforms facilitates the deployment of TEE-enabled server applications, which are expected to be widely adopted in web services such as privacy-preserving LLM inference and secure data logging. One key feature is Remote Attestation (RA), which enables integrity verification of a TEE. However, textitcompatibility issues with RA verification arise as no browsers natively support this feature, making prior solutions cumbersome and risky. To address these challenges, we propose textttRA-WEBs (Remote Attestation for Web services), a novel RA protocol designed for high compatibility with the current web ecosystem. textttRA-WEBs leverages established web mechanisms for immediate deployability, enabling RA verification on existing browsers. We conduct a comprehensive security analysis, demonstrating textttRA-WEBs's resilience against various threats. Our contributions include the textttRA-WEBs proposal, a proof-of-concept implementation, an in-depth security analysis, and publicly available code for reproducible research.