SPLICE

CAEC enables protected, plaintext memory sharing between Confidential Virtual Machines (CVMs), addressing a fundamental issue in how CVMs communicate today. CVMs are increasingly used to veil sensitive information from “snooping” hypervisors, but their disjoint memory model creates a performance bottleneck. A CVM’s memory is either shared with the hypervisor or isolated from everyone, including other CVMs. As a result, any data exchanged between CVMs must pass through hypervisor-accessible memory, forcing expensive encryption and decryption on every inter-CVM transfer just to preserve confidentiality and integrity.

CAEC removes this bottleneck. Building on Arm’s Confidential Compute Architecture (CCA), CAEC extends the firmware to introduce Confidential Shared Memory (CSM), a memory region that multiple CVMs can access directly while remaining inaccessible to the hypervisor (and to any CVM not part of the sharing group). This gives collaborating CVMs a fast, protected channel for exchanging data without ever exposing plaintext to untrusted parties.

To learn more, read the paper. To receive notification of SPLICE news, subscribe to this blog!