Session Attestation for Unmodified TLS Services in Confidential Virtual Machines

Abstract

Confidential cloud services aim to protect sensitive requests from the infrastructure that executes them. However, running a service inside a trusted execution environment does not ensure that users'plaintext appears only within the protected environment. We formulate Endpoint-Substitution Relay (ESR), a common attack outcome in which an adversary receives plaintext at a client-accepted endpoint while relaying requests to the legitimate service to preserve correct behavior. We present TLSLatch, a transparent session-attestation mechanism for services running in confidential virtual machines. TLSLatch attests the protected origin of the server's ephemeral TLS 1.3 key share and gates outbound traffic until verification succeeds. It requires no changes to applications, TLS libraries, certificates, or application protocols, and adds no extra payload-encryption layer. We implement TLSLatch with a hardware-backed Hygon CSV CVM server and clients on Linux, Windows, and macOS. Across these platforms, TLSLatch reduces completion time for 1KB requests by 56.9%--65.5% compared with nested TNG, and for 64MB requests by 43.8%--82.4% compared with CMaaS using application-key reuse. These results show that transparent session attestation can preserve existing TLS stacks while adding low-overhead endpoint binding to confidential cloud services.