Session Attestation for Unmodified TLS Services in Confidential Virtual Machines
SessionLatch adds session attestation to unmodified TLS services in confidential VMs, cutting short-upload latency 63.1% versus TNG on Hygon CSV.
SessionLatch provides session attestation for confidential virtual machines without modifying applications, TLS implementations, or certificates. It relies on trusted observation of the server's locally generated ephemeral public key combined with standard TLS key confirmation, moving attestation integration to the operating system via a temporary latch that overlaps evidence exchange with the TLS handshake. Implemented with Linux and Windows integrations and evaluated on real Hygon CSV attestation, it reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments, while preserving enterprise service authentication and the native TLS data path, and supports mutual attestation.
- Session attestation without app, TLS, or certificate changes
- Overlaps evidence exchange with TLS handshake via temporary latch
- 63.1% lower short-upload latency than TNG on Hygon CSV
- Supports mutual attestation between both endpoints
- Avoids permanent proxies in the data path
Full article166 words · extracted from arxiv.org · click to collapse
Confidential virtual machines simplify the migration of existing services into trusted execution environments, yet attesting their network connections often requires changing applications, TLS implementations, or certificates. We present SessionLatch, which provides session attestation while preserving all three. The key insight is that a trusted observation of the server's locally generated ephemeral public key, combined with standard TLS key confirmation, establishes the TEE endpoint guarantee without accessing TLS secrets. This moves attestation integration to the operating system: a temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification. The resulting connection retains enterprise service authentication and the native TLS data path, with no additional payload encryption. Mutual attestation uses the same construction and overlaps evidence generation at both endpoints. We implement Linux andWindowsintegrationandevaluaterealHygonCSVattestation. SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments. These results show that session attestation can strengthen existing confidential services without making a permanent proxy part of their data path.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.09668