Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The Two-Way Confidential Virtual Machine (2cVM) introduces a two-layer architecture that combines a hardware trusted execution environment with an intra-workload isolation layer to enable secure collaborative computation among mutually distrustful parties. This approach addresses the limitations of existing cryptographic methods, which are often impractical due to high computational costs, by ensuring mutual isolation between co-resident workloads while maintaining control over sensitive data and proprietary code. Evaluation results demonstrate that 2cVM achieves efficient performance with minimal overhead, making it a viable solution for privacy-preserving collaborative tasks in real-world applications.
Mutual isolation in collaborative computing can now be achieved with minimal performance overhead, revolutionizing how sensitive data is processed across untrusted environments.
Collaborative computation across organizations is often constrained by the need to process sensitive data and proprietary code without exposing them to untrusted infrastructure or participants. Cryptographic approaches such as fully homomorphic encryption and secure multi-party computation provide strong confidentiality but remain impractical for general workloads due to their extreme computational cost. We present the Two-Way Confidential Virtual Machine (2cVM), a two-layer architecture that pairs a hardware trusted execution environment with an intra-workload isolation layer. Unlike regular Confidential Virtual Machines, 2cVM enforces mutual isolation between co-resident workloads, ensuring that participants retain control over their data and code. All computation in 2cVM is governed by a Commitment Manifest that enumerates participants, component composition, permitted data channels, and authorized outputs; the manifest is locked to the VM and incorporated into attestation evidence, making the policy immutable and independently verifiable throughout the VM's lifetime. A proof-of-concept realization combines AMD SEV-SNP for hardware protection with the WebAssembly Component Model for fine-grained sandboxing of participant code. Evaluation on commodity hardware across four benchmark classes shows that the two isolation layers do not accumulate linearly: once a workload executes inside the WebAssembly sandbox, the marginal cost of enabling hardware memory protection is small. Overhead is workload-dependent, governed primarily by memory access pattern, ranging from negligible for sequential workloads to approximately 2x for irregular, pointer-chasing access patterns. These results indicate that 2cVM provides a practical and verifiable foundation for privacy-preserving collaborative computation.