feat(verifier): add NVIDIA DPU verifier with DICE-based attestation

Add NvidiaDpu TEE variant support to the attestation service verifier.
The verifier validates DICE certificate chains from NVIDIA BlueField DPUs,
including firmware measurements and rshim OOB channel integrity verification.

Signed-off-by: 56ht86hrd5-ai <56ht86hrd5-ai@users.noreply.github.com>

Author: Ying Jiang

Cargo.lock

@@ -79,3 +79,4 @@ zeroize = "1"
 
 [patch.crates-io]
 sev = { git = "https://github.com/virtee/sev", rev = "d487809188c3c92e397bc92e2cb2a85eb982c980" }
+kbs-types = { git = "https://github.com/56ht86hrd5-ai/kbs-types", branch = "feat/add-dpu-tee" }

Cargo.toml

@@ -17,6 +17,7 @@ cca-verifier = ["verifier/cca-verifier"]
 se-verifier = ["verifier/se-verifier"]
 nvidia-verifier = ["verifier/nvidia-verifier"]
 tpm-verifier = ["verifier/tpm-verifier"]
+nvidia-dpu-verifier = ["verifier/nvidia-dpu-verifier"]
 
 rvps-grpc = ["prost", "tonic", "mobc"]
 

attestation-service/Cargo.toml

@@ -12,7 +12,7 @@ Policy input is a JSON object composed from verifier output. In most cases, it f
 
 | Field | Type | Meaning |
 | --- | --- | --- |
-| `<tee-name>` | object | TEE-specific claims (for example: `tdx`, `sgx`, `snp`, `se`, `tpm`, `nvidia`, `hygondcu`, `az-tdx-vtpm`, `az-snp-vtpm`, `sample`, `csv`, `cca`) |
+| `<tee-name>` | object | TEE-specific claims (for example: `tdx`, `sgx`, `snp`, `se`, `tpm`, `nvidia`, `nvidia-dpu`, `hygondcu`, `az-tdx-vtpm`, `az-snp-vtpm`, `sample`, `csv`, `cca`) |
 | `report_data` | string | Hex/base64-encoded report data extracted from evidence (format depends on verifier) |
 | `init_data` | string | Hex/base64-encoded init-data hash extracted from evidence (when supported) |
 | `init_data_claims` | object | Parsed init-data claims (present when init-data is provided and verified) |
@@ -223,6 +223,29 @@ The remote verifier exports the claims that come from NRAS, which are listed [he
 Claims version 3 is used. The `x-nvidia-overall-att-result` from the overall claims is included
 along with the full set of detached claims.
 
+## NVIDIA DPU (nvidia-dpu)
+
+The NVIDIA DPU verifier validates DICE certificate chains from NVIDIA BlueField DPUs.
+It performs ECDSA P-384 signature verification, certificate temporal validity checks,
+firmware measurement extraction, and nonce binding for session freshness.
+
+Claims are produced under the top-level key `nvidia-dpu`. In Rego, use bracket
+syntax: `input["nvidia-dpu"]`.
+
+- `["nvidia-dpu"].passed`: Overall DICE chain verification result (boolean).
+- `["nvidia-dpu"].device_serial`: Device serial number (e.g., BlueField DPU hardware serial).
+- `["nvidia-dpu"].device_class`: Device class identifier (e.g., "bluefield3").
+- `["nvidia-dpu"].firmware_layers_count`: Number of firmware layers in the DICE certificate chain.
+- `["nvidia-dpu"].accumulated_fwid`: Accumulated Firmware ID measurement across all layers (SHA-384, hex-encoded).
+- `["nvidia-dpu"].session_nonce`: DICE Alias certificate session nonce for freshness binding (hex-encoded).
+- `["nvidia-dpu"].alias_timestamp`: Timestamp of Alias certificate issuance (UNIX epoch seconds).
+- `["nvidia-dpu"].failure_reason`: Verification failure reason (null when verification passed).
+- `["nvidia-dpu"].tee_class`: TEE class identifier (always "nvidia-dpu").
+
+Note: FWID comparison against RVPS reference values is deferred to a follow-up PR.
+Currently the verifier extracts and reports firmware measurements but does not
+enforce a specific expected value.
+
 ## AMD SEV-SNP
 
 - `snp.measurement` Launch Digest covering initial guest memory