virtCCA: Virtualized Arm Confidential Compute Architecture with TrustZone
Xiangyi Xu, Wenhao Wang, Yongzheng Wu, Chenyu Wang, Huifeng Zhu, Haocheng Ma, Zhennan Min, Zixuan Pang, Rui Hou, Yier Jin

TL;DR
virtCCA is a software architecture that enables confidential virtual machines on existing Arm platforms using TrustZone, bridging the gap until hardware-based CCA becomes widely available, with acceptable performance overhead.
Contribution
It introduces virtCCA, a novel architecture that supports virtualized confidential computing on existing Arm hardware using TrustZone, compatible with CCA specifications.
Findings
virtCCA can be implemented on platforms with or without S-EL2 support.
Overhead of virtCCA-SEL2 is less than 29.7% for I/O intensive workloads.
virtCCA-EL3 often outperforms baseline configurations.
Abstract
Arm introduced the Confidential Compute Architecture (CCA) in the upcoming Armv9-A architecture, enabling the support of confidential virtual machines (CVMs) in a separate world called the Realm world, providing protection from untrusted normal world. While CCA offers a promising future for confidential computing, the widespread commercial CCA hardware is not available in the near future. To fill this gap, we present virtCCA, an architecture that facilitates virtualized CCA using TrustZone, a mature hardware feature on existing Arm platforms. Notably, virtCCA can be implemented on platforms equipped with the Secure EL2 (S-EL2) extension from ARMv8.4 onwards, as well as on earlier platforms that lack S-EL2 support. virtCCA provides strong compatibility with the CCA specifications at the API level. We developed the entire CCA software and firmware stack on top of virtCCA, including the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Cloud Data Security Solutions
