Session Attestation for Unmodified TLS Services in Confidential Virtual Machines
SessionLatch adds session attestation to unmodified TLS services in confidential VMs, cutting short-upload latency 63.1% versus TNG on Hygon CSV.
SessionLatch provides session attestation for confidential virtual machines without modifying applications, TLS implementations, or certificates. It relies on trusted observation of the server's locally generated ephemeral public key combined with standard TLS key confirmation, moving attestation integration to the operating system via a temporary latch that overlaps evidence exchange with the TLS handshake. Implemented with Linux and Windows integrations and evaluated on real Hygon CSV attestation, it reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments, while preserving enterprise service authentication and the native TLS data path, and supports mutual attestation.
- Session attestation without app, TLS, or certificate changes
- Overlaps evidence exchange with TLS handshake via temporary latch
- 63.1% lower short-upload latency than TNG on Hygon CSV
- Supports mutual attestation between both endpoints
- Avoids permanent proxies in the data path
From the original article
1 min read at arxiv.orgConfidential virtual machines simplify the migration of existing services into trusted execution environments, yet attesting their network connections often requires changing applications, TLS implementations, or certificates. We present SessionLatch, which provides session attestation while preserving all three.
By Qi Gu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.