Acurast Secures $11 Million to Transform Smartphones into Confidential Compute Nodes

Summary:
Acurast, a decentralized confidential computing project utilizing smartphones, has raised $11 million in funding. The company aims to leverage billions of smartphones for cost-efficient and verifiable computing. With a plan to launch its mainnet soon, Acurast is focused on creating a secure and scalable network without reliance on traditional data centers.

Key Takeaways

Acurast has raised $11 million from notable investors, including Gavin Wood and Michael van de Poppe.
The project plans to launch its mainnet on November 17 while introducing its native token, ACU.
Acurast enables confidential computing by ensuring smartphone security and hardware verification.
Nearly 150,000 smartphones have already joined the Acurast network, processing over 494 million transactions.
Security vulnerabilities remain a concern, particularly with operating systems like iOS and Android.

Acurast raises $11M to turn smartphones into confidential compute nodes

Acurast's Mission in Confidential Computing

Acurast is pioneering a decentralized project that aims to use smartphones as confidential compute nodes. The initiative has successfully raised $11 million in funding, as announced recently. The investors include Ethereum co-founder Gavin Wood, MN Capital founder Michael van de Poppe, and GlueNet founder Ogle. Acurast plans to launch its mainnet on November 17, with the corresponding release of its native token, called ACU.

Founder Alessandro De Carli emphasized that “billions of smartphones are the most battle-tested hardware on earth.” Acurast intends to cut down costs by utilizing these devices for “verifiable, confidential computing.” According to network explorer data, around 150,000 phones have already connected to the Acurast network, completing over 494 million transactions and enabling approximately 94,200 services. De Carli claims, “We remove the gatekeepers, reduce costs, and provide secure, trustless computation to anyone, anywhere, all without a data center.”

Acurast network data. Source: Acurast

The Mechanics of Confidential Computing

Acurast facilitates confidential computing by ensuring that users with access to smartphones that run the node software cannot access the data being processed. This is achieved through a robust setup that ensures the smartphone owner cannot tamper with the software, thereby safeguarding user data.

To verify security, developers have put in place measures to confirm that the smartphone is using manufacturer-approved software, thus maintaining security integrity. This level of assurance is similar to what banking app developers have attempted for years. However, communities using custom firmware, like Graphene OS, have found ways to bypass these checks. De Carli asserts that these issues do not apply to Acurast’s application.

According to De Carli, the Acurast processor application communicates hardware-backed key pairs with key attestation to the Acurast protocol. If the keys do not match those provided by the smartphone manufacturer, “the Acurast processor cannot receive a valid attestation and cannot participate in the network.” This guarantees that only verified hardware can join, while unapproved environments are excluded due to the lack of signed attestations, preventing potential tampering with data or the execution environment.

Decentralized compute networks will democratize global AI access

Security Concerns and Potential Limitations

Despite these security measures, risks remain. If a manufacturer-endorsed smartphone operating system—such as iOS or Android—is compromised by malware or a knowledgeable user, the security assumptions may falter.

De Carli downplays the likelihood of such exploitation, stating, “If you find an exploit, you could qualify for a multimillion-dollar bounty, and the exploit would be promptly addressed,” referring to Google’s bug bounty program as an example. Nonetheless, vulnerabilities have been discovered in the past, including a significant attack on Samsung’s TrustZone Operating System, which was reported in 2022 and allowed for key extraction and abuse of attestation.

Ultimately, while Acurast's approach aims to enhance security through rigorous measures, the potential for vulnerabilities always exists in any technology reliant on widely used operating systems.

AES-GCM IV-reuse attack. Source: USENIX

Conclusion

As Acurast prepares for its mainnet launch, it represents an intriguing development within the realms of decentralized computing and confidential data processing. With significant funding and a promising model, Acurast aims to democratize access to secure computing while acknowledging the security challenges that come with utilizing consumer hardware.