CAEC: Confidential, Attestable, and Efficient Inter-CVM Communication with Arm CCA
Sina Abdollahi, Amir Al Sadi, David Kotz, Marios Kogias, Hamed Haddadi

TL;DR
CAEC introduces a secure, efficient memory sharing mechanism for Confidential Virtual Machines on Arm CCA, significantly improving inter-CVM communication performance while maintaining strong isolation.
Contribution
It extends Arm CCA firmware to support Confidential Shared Memory, enabling high-performance, attestable inter-CVM data sharing with minimal firmware size increase.
Findings
Achieves up to 209x reduction in CPU cycles for inter-CVM communication.
Supports secure shared memory accessible only to participating CVMs.
Compatible with existing CCA hardware with 6% firmware size increase.
Abstract
Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries such as the hypervisor. While they provide strong isolation guarantees, existing CVM architectures lack first-class mechanisms for inter-CVM data sharing due to their disjoint memory model, making inter-CVM data exchange a performance bottleneck in compartmentalized or collaborative multi-CVM systems. Under this model, a CVM's accessible memory is either shared with the hypervisor or protected from both the hypervisor and all other CVMs. This design simplifies reasoning about memory ownership; however, it fundamentally precludes plaintext data sharing between CVMs because all inter-CVM communication must pass through hypervisor-accessible memory, requiring costly encryption and decryption to preserve confidentiality and integrity. In this paper, we introduce CAEC, a…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
