Session attestation secures tls connections without changing applications
Session Attestation for Unmodified TLS Services in Confidential Virtual Machines
Cryptography and Security
Summary
Confidential virtual machines help protect sensitive data but making sure network connections inside them are secure usually means changing apps or encryption methods. The authors developed SessionLatch, which lets you verify secure connections without changing the apps, TLS libraries, or certificates. It does this by observing a special key the server creates, then checking it in a way that doesn’t need secret info. This approach fits into the operating system and keeps the normal data flow of the connection, making it simpler to add extra security.
What this means in practice
- •For cloud service operators: Add network session verification to confidential virtual machines without modifying existing TLS services.
- •For enterprise security teams: Enhance internal server communication security using session attestation without redesigning applications or TLS setups.
Authors
Qi Gu, Sheng Ma
Abstract
Confidential virtual machines simplify the migration of existing services into trusted execution environments, yet attesting their network connections often requires changing applications, TLS implementations, or certificates. We present SessionLatch, which provides session attestation while preserving all three. The key insight is that a trusted observation of the server's locally generated ephemeral public key, combined with standard TLS key confirmation, establishes the TEE endpoint guarantee without accessing TLS secrets. This moves attestation integration to the operating system: a temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification. The resulting connection retains enterprise service authentication and the native TLS data path, with no additional payload encryption. Mutual attestation uses the same construction and overlaps evidence generation at both endpoints. We implement Linux andWindowsintegrationandevaluaterealHygonCSVattestation. SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments. These results show that session attestation can strengthen existing confidential services without making a permanent proxy part of their data path.