.png){kind=icon}
.png){kind=icon}
Return
Securing Outsourced Computing With Trusted Execution Environments: A Case Study on China Secure Virtualization
.png){kind=icon}
PRE
AI
DOI：10.1109/TNSE.2025.3624091.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
There are potential risks of sensitive data leakage and tampering during transmission and processing in the untrusted outsourced computing environment. As a hardware-based security isolation technology, Trusted Execution Environments (TEEs) offer a novel solution to address such issues. Within TEEs, China Secure Virtualization (CSV) is a forefront Confidential Virtual Machine (CVM) technology in China. CVMs leverage hardware-enhanced isolation between different users in a cluster to preserve privacy in outsourced computing scenarios. However, in the practice of outsourced computing, CSV still has two major vulnerabilities. One is CSV's inability to resist malicious code executed within it, since malicious code can pose a threat to the security of the entire system. The other is that the hardware cannot verify the identity of the entity represented by the third-party application running with the system. As a result, secure channels cannot be directly established between users and applications. To address these vulnerabilities, we design an outsourced confidential computing system based on the Chinese-produced TEE —CSV. By modifying the virtual machine's boot process and refactoring the application's runtime file system with OverlayFS, our system can isolate malicious applications. Furthermore, we combine CSV's hardware security features and embedded certificate information to design an environment-identity binding authentication protocol. This protocol facilitates the establishment of a secure communication channel. Additionally, our system supports the hardware-enhanced acceleration of Chinese State Cryptography Algorithms. Extensive evaluations of functionalities and performance overhead on CSV demonstrate that our system maintains excellent performance while ensuring security under real-world workloads.
Keywords:
TEE
confidential computing
privacy preservation
Journal
I
IF:
7.9
Papers:
2.5K
Citations:
10.0K