Confidential, Attestable, and Efficient Inter-CVM Communication with Arm CCA
|
Sina Abdollahi, Amir Al Sadi, Marios Kogias, David Kotz, and Hamed Haddadi.
Confidential, Attestable, and Efficient Inter-CVM Communication with Arm CCA.
Technical Report number 2512.01594, arXiv, December 2025.
doi:10.48550/arXiv.2512.01594.
©Copyright the authors.
Abstract:
Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries such as the hypervisor. While they provide strong isolation guarantees, existing CVM architectures lack first-class mechanisms for inter-CVM data sharing due to their disjoint memory model, making inter-CVM data exchange a performance bottleneck in compartmentalized or collaborative multi-CVM systems. Under this model, a CVM's accessible memory is either shared with the hypervisor or protected from both the hypervisor and all other CVMs. This design simplifies reasoning about memory ownership; however, it fundamentally precludes plaintext data sharing between CVMs because all inter-CVM communication must pass through hypervisor-accessible memory, requiring costly encryption and decryption to preserve confidentiality and integrity. In this paper, we introduce CAEC, a system that enables protected memory sharing between CVMs. CAEC builds on Arm Confidential Compute Architecture (CCA) and extends its firmware to support Confidential Shared Memory (CSM), a memory region securely shared between multiple CVMs while remaining inaccessible to the hypervisor and all non-participating CVMs. CAEC's design is fully compatible with CCA hardware and introduces only a modest increase (4%) in CCA firmware code size. CAEC delivers substantial performance benefits across a range of workloads. For instance, inter-CVM communication over CAEC achieves up to 209x reduction in CPU cycles compared to encryption-based mechanisms over hypervisor-accessible shared memory. By combining high performance, strong isolation guarantees, and attestable sharing semantics, CAEC provides a practical and scalable foundation for the next generation of trusted multi-CVM services across both edge and cloud environments.
Citable with [BibTeX]: \cite{abdollahi:caec-tr} Projects: [splice] Keywords: [agents] [authentication] [privacy] [security] Available from the publisher: [DOI] [page] Available from the author:
[bib]
[pdf]
|
|