Confidential computing leverages VM-based Trusted Execution Environments (TEEs) to protect workloads without modification. However, dynamic workloads, where applications execute atop a Process VM (PVM) such as Python, remain inadequately addressed. Existing solutions, such as Confidential Containers (CoCo), restrict attestation to the first execution layer and deploy workloads using generic micro-VM images, producing identical TEE evidence irrespective of the actual application. This enables an adversary to hijack and reuse an attested environment to run unintended or malicious applications. We propose HIEST, a hierarchical attestation mechanism that chains the execution stack, from the Trusted Computing Base (TCB) through the PVM to the application and beyond. Execution is allowed only after successful verification by a trusted remote Key Broker Service (KBS). HIEST is runtime-agnostic, supports user-defined constraints, assumes no specific certificate standard or cryptographic algorithm, and extends naturally to additional layers such as data input. Our reference implementation requires no direct PVM modifications and leverages mature components like Kata Containers. Evaluation across multiple use cases demonstrates that HIEST mitigates reuse attacks, adding a fixed 12–15 ms of overhead that is negligible as workload durations grows in our setup.

Our objective is to protect the code, data, and keys of applications against all users with access to the computer systems. In some domains (e.g., healthcare domain), this must be guaranteed, even if the application is not entirely correct. To simplify the adoption of confidential computing, SCONE transforms cloud-native applications into confidential cloud-native applications running on vanilla Kubernetes clusters. The applications can run on Intel SGX, Intel TDX, and AMD SEV. In the near future, SCONE will also support confidential GPUs. The confidentiality, integrity, and consistency of an application's data and keys are guaranteed by always keeping the data encrypted, i.e., at rest, in transit, and in use. This enables us to add a protection layer around applications to prevent data loss caused be bugs and backdoors in the application code.

Open source dependencies are the leading source of vulnerabilities in applications and are often exploited in software supply chain attacks. Efforts to assess vulnerabilities are employed during DevSecOps pipelines in order to keep a system compliant with security regimes. However, current strategies for continuous compliance are limited to preventing issues before deployment, and thus do not address changes in dynamic aspects such as newfound vulnerabilities, let alone how to respond to such incidents. In this work, we leverage zero-trust to enable continuous, post-deployment vulnerability compliance assessment, isolating workloads that fail to meet a minimum security posture. This approach balances exploitation prevention with application availability - a fundamental trade-off for critical use cases. The solution is built on top of SPIRE, a robust open-source identity provider based on workload attestation, and implements a custom plugin that responds to compliance violations driven by dynamic aspects exposed by OWASP's Dependency Track, an open-source tool for monitoring software components and their dependencies for vulnerabilities. To enhance flexibility in the security-availability trade-off, we introduce a grace period mechanism, enabling organizations to defer enforcement of newly identified vulnerabilities based on workload criticality, thus supporting availability for non-critical workloads without compromising long-term security. Finally, we evaluate the performance impact of this approach on a SPIRE environment, showing that the added resource usage reliably remains within the recommended 16 GiB of RAM and 4 vCPUs to run Dependency Track in production. We also show that the plugin adds less than 6 seconds of latency to the attestation process, which is insignificant given its default frequency of twice per hour. Moreover, the results confirm that the approach successfully prevents vulnerability exploitation by prioritizing security, while enabling controlled flexibility in less critical contexts.

Large Language Models (LLMs) have rapidly proliferated, driving widespread adoption of AI applications. Most deployments rely on centralized infrastructures such as Microsoft Azure, Google Cloud, or AWS, requiring users to share sensitive data and training or fine-tuning code. This dependence raises significant security and privacy concerns, as cloud providers must be trusted to ensure confidentiality and integrity. Trusted Execution Environments (TEEs) e.g., Intel SGX/TDX, AMD SEV-SNP, and ARM CCA have been introduced to mitigate these risks. More recently, NVIDIA has developed GPU TEEs (e.g., H100/H200), yet comprehensive evaluations of end-to-end workflows that integrate CPU and GPU TEEs remain limited. Critical aspects, including performance overhead, remote attestation, and security guarantees for AI/LLM applications, have not been sufficiently studied. This paper addresses this gap by presenting an end-to-end workflow that combines CPU and GPU TEEs. We propose mechanisms to ensure confidentiality and integrity at both the VM level (via Intel TDX and AMD SEV-SNP) and the application level, highlighting vulnerabilities such as Kubernetes administrators' ability to access confidential VM contents. Finally, we evaluate the performance overhead of our system using industry benchmarks, focusing on configurations that integrate Intel TDX with NVIDIA H200 GPUs.

Distributed streaming platforms such as Pravega, Kafka, and Pulsar are widely used for high-throughput, low-latency data processing. As these platforms increasingly handle sensitive data, ensuring data confidentiality and integrity becomes critical. Trusted Execution Environments (TEEs) offer secure computations that can be used on client-side processing, but their impact on performance must be carefully assessed. This study evaluates the write latency of Pravega clients running in TEEs compared to those in standard (non-secured) environments. We found that under typical workloads, TEE-based clients experience approximately 50% higher latency due to the overhead of secure executions. However, when data rates exceed 976 MB/s, the Pravega broker reaches its throughput limit, causing latency to spike for standard clients. In contrast, TEE-based clients exhibit more stable latency under these high-throughput conditions. These findings can be helpful for data architects, as systems highlight a trade-off: while latency may increase, the impact could be acceptable in certain scenarios given the enhanced security benefits.

Modern software systems are executed on a runtime stack with layers (virtualization, storage, trusted execution, etc.) each incurring an execution and/or monetary cost, which may be mitigated by finding suitable parameter configurations. While specialized parameter tuners exist, they are tied to a particular domain or use case, fixed in type and number of optimization goals, or focused on a specific layer or technology. These limitations pose significant adoption hurdles for specialized and innovative ventures (SIVs) that address a variety of domains and use cases, operate under strict cost-performance constraints requiring tradeoffs, and rely on self-hosted servers with custom technology stacks while having little data or expertise to set up and operate specialized tuners. In this paper, we present Groot - a general-purpose configuration tuner designed to a) be explicitly agnostic of a particular domain or use case, b) balance multiple potentially competing optimization goals, c) support different custom technology setups, and d) make minimal assumptions about parameter types, ranges, or suitable values. Our evaluation on both real-world use cases and benchmarks shows that Groot reliably improves performance and reduces resource consumption in scenarios representative for SIVs.

Although confidential virtual machines (CVMs) offer strong isolation in untrusted cloud environments, their attestation mechanisms are restricted to static boot-time measurements. This means they cannot capture the detailed post-boot state necessary for real-world deployments. Modern workloads demand context-specific trust decisions that vary across verifiers, operational stages and workloads, like software supply chains or cloud-native workload deployments. In this paper, we present a flexible policy-driven attestation and configuration architecture that enables verifier-specific evidence generation across different stages of a CVM's lifecycle, without requiring changes to the guest OS or container workflows as previous approaches. Our system uses eBPF and Linux Security Module hooks to capture in-guest signals under dynamic policies, allowing flexible and context-aware attestation of runtime properties or post-boot configuration state. We demonstrate its utility in two use cases: (i) attesting confidential build pipelines with cryptographically linked Software Bill of Materials and artifacts, and (ii) enabling verifiable post-boot contextualization for multi-tenant CVMs. Built on AMD SEV-SNP, our prototype achieves low overhead and seamless integration, offering a practical trust layer that advances attestation for secure software supply chains and dynamic cloud workloads.

Zusammenfassung Das folgende Kapitel bietet einen Einblick in Sicherheitsmechanismen des Cloud-Computings, insbesondere im Hinblick auf den Schutz sensibler Daten und die sichere Ausführung von Anwendungen wie z. B. Korrekturverfahren. Beleuchtet wird das Thema Confidential Computing, um zu zeigen, wie Daten und Programme in unsicheren Umgebungen kryptografisch geschützt werden können. Im Fokus stehen Lösungen wie Intel-SGX und das SCONE-Framework. Leser erhalten wertvolle Einblicke, wie sie mit modernen Methoden die Datensouveränität wahren und Anwendungen (z. B. die Berechnung von Temperaturmodellen) auch auf externen Servern absichern können.

Most applications will exhibit vulnerabilities that impact their availability, integrity, or confidentiality during their life cycle. Nevertheless, the leading cause for such vulnerabilities is not the application itself but its dependencies. Continuous compliance processes often perform vulnerability assessment in order to prevent compliance breaches during a CI/CD pipeline. However, current proposals do not extend beyond the pipeline, and thus do not take into account incident response when dynamic aspects change, such as newfound vulnerabilities. In this work, we leverage zero-trust to continuously assess vulnerability compliance and isolate workloads that do not conform to a minimum vulnerability posture. This isolation presents a trade-off between exploitation prevention and availability, which is useful for critical use cases. Our approach builds on top of SPIRE, a robust selective identity provider, and integrates response to compliance violation caused by dynamic aspects, monitored by Dependency Track. We show the approach adds no significant latency and does not hinder operational or development efforts.

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and address these dependency vulnerabilities. The use of Software Composition Analysis (SCA) tools does greatly help here as they provide a deep insight on what dependencies are used in a project, enhancing the security and integrity in the software supply chain. In order to learn how wide spread vulnerabilities are and how quickly they are being fixed, we conducted a study on over 1k open-source software projects with about 50k releases comprising several languages such as Java, Python, Rust, Go, Ruby, PHP, and JavaScript. Our objective is to investigate the severity, persistence, and distribution of these vulnerabilities, as well as their correlation with project metrics such as team and contributors size, activity and release cycles. In order to perform such analysis, we crawled over 1k projects from github including their version history ranging from 2013 to 2023 using VODA, our SCA tool. Using our approach, we can provide information such as library versions, dependency depth, and known vulnerabilities, and how they evolved over the software development cycle. Being larger and more diverse than datasets used in earlier works and studies, ours provides better insights and generalizability of the gained results. The data collected answers several research questions about the dependency depth and the average time a vulnerability persists. Among other findings, we observed that for most programming languages, vulnerable dependencies are transitive, and a critical vulnerability persists in average for over a year before being fixed. The results furthermore emphasize the importance of managing dependencies, performing timely updates, and suggests types of vulnerabilities that can be fixed faster.

During the past few years, we have witnessed various efforts to provide confidentiality and integrity for applications running in untrusted environments such as public clouds. In most of these approaches, hardware extensions such as Intel SGX, TDX, AMD SEV, etc., are leveraged to provide encryption and integrity protection on process or VM level. Although all of these approaches increase the trust in the application at runtime, an often overlooked aspect is the integrity and confidentiality protection at build time, which is equally important as maliciously injected code during compilation can compromise the entire application and system.In this paper, we present Tical, a practical framework for trusted compilation that provides integrity protection and confidentiality in build pipelines from source code to the final executable. Our approach harnesses TEEs as runtime protection but enriches TEEs with file system shielding and an immutable audit log with version history to provide accountability. This way, we can ensure that the compiler chain can only access trusted files and intermediate output, such as object files produced by trusted processes. Our evaluation using micro- and macro-benchmarks shows that Tical can protect the confidentiality and integrity of whole CI/CD pipelines with an acceptable performance overhead.

Trusted execution environments (TEEs) protect the integrity and confidentiality of running code and its associated data. Nevertheless, TEEs' integrity protection does not extend to the state saved on disk. Furthermore, modern cloud-native applications heavily rely on orchestration (e.g., through systems such as Kubernetes) and, thus, have their services frequently restarted. During restarts, attackers can revert the state of confidential services to a previous version that may aid their malicious intent. This paper presents CRISP, a rollback protection mechanism that uses an existing runtime for Intel SGX and transparently prevents rollback. Our approach can constrain the attack window to a fixed and short period or give developers the tools to avoid the vulnerability window altogether. Finally, experiments show that applying CRISP in a critical stateful cloud-native application may incur a resource increase but only a minor performance penalty.

In this work, we introduce VMCaaS (Virtual Monotonic Counters as a Service) —a TEE-based security infrastructure platform for untrusted environments to support rollback attack-resistant applications while providing better reliability properties than existing systems of its class. Our architecture allows us to provide hardware-backed monotonic counters to applications independently from the availability of a specific physical node, i.e., no application becomes unavailable due to a failure in a particular node. This capability gives orchestration mechanisms freedom to optimize resource allocation, and, most importantly, it provides client applications with a more robust reliability model capable of tolerating multiple node failures with minimal to no downtime. We demonstrate that this approach can also withstand availability-critical orchestration routines, such as rollouts, with the same availability guarantees. Our evaluation shows that the increased cost in throughput and latency, is tolerable compared to an equivalent non-crash tolerant setup.

As artificial intelligence (AI) systems influence ever more high-stake decision-making processes, such as university applicant screening or medical diagnoses, ensuring the trustworthiness of these systems and their decisions is crucial. This paper presents a significant step towards achieving trustworthy AI decisions by introducing a novel framework for enhancing traceability and accountability by construction. Our approach encompasses the entire decision-making pathway-from the raw datasets used to train the AI system, through the algorithms and programs employed, to the involved parties and the final decisions made. At the core of our methodology is the Decision Bill of Materials (DBOM), which meticulously documents all elements contributing to a decision while ensuring accountability and traceability through cryptographic signatures. Furthermore, we leverage results from logic programming to enable systematic reasoning about the processes and decision documented in a DBOM. This allows us to verify that the system meets specific certification standards and that individual decisions can be qualified as trustworthy. This framework not only advances the construction of reliable AI systems but also aligns technological developments with ethical imperatives and regulatory expectations.

Certifying software-based systems is a time-consuming and expensive task that requires much manual human effort. We introduce Online Certification, a partly automated version of the certification process, where participants provide the necessary information dynamically. All information is cryptographically signed to ensure integrity and authorization, and a system of certificates allows for fine-grained delegation of competencies. The requirements for certification, as well as the information needed to fulfill them, are represented in a subset of first-order logic. Consequently, validation is performed using automated logic reasoning. Compared to existing approaches, Online Certification enhances flexibility and agility. In cases where automatic generation of certification data is not possible, human certification processes can be integrated.

For trusted execution environments (TEEs), remote attestation permits establishing trust in software executed on a remote host. It requires that the measurement of a remote TEE is both complete and fresh: We need to measure all aspects that might determine the behavior of an application, and this measurement has to be reasonably fresh. Performing measurements only at the start of a TEE simplifies the attestation but enables "reuse" attacks of enclaves. We demonstrate how to perform such reuse attacks for different TEE frameworks. We also show how to address this issue by enforcing freshness -- through the concept of a singleton enclave -- and completeness of the measurements. Completeness of measurements is not trivial since the secrets provisioned to an enclave and the content of the filesystem can both affect the behavior of the software, i.e., can be used to mount reuse attacks. We present mechanisms to include measurements of these two components in the remote attestation. Our evaluation based on real-world applications shows that our approach incurs only negligible overhead ranging from 1.03% to 13.2%.

Speculative vulnerabilities such as Spectre and Meltdown expose speculative execution state that can be exploited to leak information across security domains via side-channels. Such vulnerabilities often stay undetected for a long time as we lack the tools for systematic testing of CPUs to find them. In this paper, we propose an approach to automatically detect microarchitectural information leakage in commercial black-box CPUs. We build on speculation contracts, which we employ to specify the permitted side effects of program execution on the CPU's microarchitectural state. We propose a Model-based Relational Testing (MRT) technique to empirically assess the CPU compliance with these specifications. We implement MRT in a testing framework called Revizor, and showcase its effectiveness on real Intel x86 CPUs. Revizor automatically detects violations of a rich set of contracts, or indicates their absence. A highlight of our findings is that Revizor managed to automatically surface Spectre, MDS, and LVI, as well as several previously unknown variants.

We aim to provide trusted time measurement mechanisms to applications and cloud infrastructure deployed in environments that could harbor potential adversaries, including the hardware infrastructure provider. Despite Trusted Execution Environments (TEEs) providing multiple security functionalities, timestamps from the Operating System are not covered. Nevertheless, some services require time for validating permissions or ordering events. To address that need, we introduce Triad, a trusted timestamp dispatcher of time readings. The solution provides trusted timestamps enforced by mutually supportive enclave-based clock servers that create a continuous trusted timeline. We leverage enclave properties such as forced exits and CPU-based counters to mitigate attacks on the server's timestamp counters. Triad produces trusted, confidential, monotonically-increasing timestamps with bounded error and desirable, non-trivial properties. Our implementation relies on Intel SGX and SCONE, allowing transparent usage. We evaluate Triad's error and behavior in multiple dimensions.

Confidential computing alleviates the concerns of distrustful customers by removing the cloud provider from their trusted computing base and resolves their disincentive to migrate their workloads to the cloud. This is facilitated by new hardware extensions, like AMD's SEV Secure Nested Paging (SEV-SNP), which can run a whole virtual machine with confidentiality and integrity protection against a potentially malicious hypervisor owned by an untrusted cloud provider. However, the assurance of such protection to either the service providers deploying sensitive workloads or the end-users passing sensitive data to services requires sending proof to the interested parties. Service providers can retrieve such proof by performing remote attestation while end-users have typically no means to acquire this proof or validate its correctness and therefore have to rely on the trustworthiness of the service providers. In this paper, we present Revelio, an approach that features two main contributions: i) it allows confidential virtual machine (VM)-based workloads to be designed and deployed in a way that disallows any tampering even by the service providers and ii) it empowers users to easily validate their integrity. In particular, we focus on web-facing workloads, protect them leveraging SEV-SNP, and enable end-users to remotely attest them seamlessly each time a new web session is established. To highlight the benefits of Revelio, we discuss how a standalone stateful VM that hosts an open-source collaboration office suite can be secured and present a replicated protocol proxy that enables commodity users to securely access the Internet Computer, a decentralized blockchain infrastructure.