Abstract:

Confidential Computing provides a securely isolated execution environment for model inference, but it uses the entire VM as the basic isolation unit, resulting in vulnerability to lateral movement in multi-tenant and multi-service environments. A compromised VM component can expose other modules to security risks. To address this, we proposed a fine-grained confidential computing framework for model inference. It leveraged AMD SEV-SNP to establish a trusted environment, implemented hardware-level security boundaries within confidential VMs, and integrated the NestedSGX mechanism to achieve intra-VM fine-grained isolation. Additionally, we explored a multi-enclave fine-grained isolation framework based on application partitioning. Through evaluation on multi-enclave applications, we tested the framework’s security benefits and performance overhead in different scenarios. In terms of security benefits, the multi-enclave fine-grained isolation framework can substantially reduce the trusted computing base and minimize the impact of failures on applications. In terms of performance, the overhead is within 16% for large-scale cross-domain transfers. This work provides a practical approach for building fine-grained trusted execution frameworks in VM-level confidential environments and derives actionable strategies for multi-enclave partitioning.

Key words: confidential computing, model inference, AMD SEV-SNP, trusted execution environment