CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V

Moritz Waser; Paul Gollob; Martin Unterguggenberger; Stefan Mangard

doi:10.1145/3779208.3807479

CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V

Institute of Information Security (7050)

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Abstract

Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches.
In this work, we present CAGE-V, a novel confidential computing architecture that supports lightweight enclave-based isolation for individual cloud workers running inside confidential VMs. We achieve this lightweight isolation through the use of tagged memory that allows to associate metadata, e.g., Domain Identifiers, with pages. Moreover, the guest enclaves support fast context switches within the confidential VM, as TLB entries are tagged with the Domain Identifiers, eliminating context switch overheads from TLB flushes. We implement a CAGE-V prototype, consisting of a hardware extension for the CORE-V CVA6 processor and a small security monitor, and evaluate our design in terms of system performance, demonstrating a minor performance impact.

Original language	English
Title of host publication	Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26),
Publisher	Association for Computing Machinery (ACM)
Pages	577-590
Number of pages	14
ISBN (Electronic)	979-8-4007-2356-8
DOIs	https://doi.org/10.1145/3779208.3807479
Publication status	Published - 4 Jun 2026
Event	ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2026 - hybrid, Bangalore, India Duration: 1 Jun 2026 → 5 Jun 2026

Publication series

Name	ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security

Conference

Conference	ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2026
Abbreviated title	ASIA CCS 2026
Country/Territory	India
City	Bangalore
Period	1/06/26 → 5/06/26

Keywords

Secure Virtualization
Guest Enclaves
RISC-V
Confidential Computing

ASJC Scopus subject areas

Computational Theory and Mathematics
Computer Networks and Communications
Computer Science Applications

Fields of Expertise

Information, Communication & Computing

Access to Document

10.1145/3779208.3807479Licence: CC BY 4.0

camera-readyAccepted author manuscript, 542 KBLicence: CC BY 4.0

Cite this

Waser, M., Gollob, P., Unterguggenberger, M., & Mangard, S. (2026). CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V. In Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26), (pp. 577-590). (ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security). Association for Computing Machinery (ACM). https://doi.org/10.1145/3779208.3807479

CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V. / Waser, Moritz ; Gollob, Paul ; Unterguggenberger, Martin et al.
Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26), . Association for Computing Machinery (ACM), 2026. p. 577-590 (ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security).

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Waser, M , Gollob, P , Unterguggenberger, M & Mangard, S 2026, CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V. in Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26), . ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security, Association for Computing Machinery (ACM), pp. 577-590, ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2026, Bangalore, India, 1/06/26. https://doi.org/10.1145/3779208.3807479

Waser M , Gollob P , Unterguggenberger M , Mangard S. CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V. In Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26), . Association for Computing Machinery (ACM). 2026. p. 577-590. (ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security). doi: 10.1145/3779208.3807479

Waser, Moritz ; Gollob, Paul ; Unterguggenberger, Martin et al. / CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V. Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26), . Association for Computing Machinery (ACM), 2026. pp. 577-590 (ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security).

@inproceedings{ece834fdca82493aa5b4ccbfccd5fcb5,

title = "CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V",

abstract = "Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches. In this work, we present CAGE-V, a novel confidential computing architecture that supports lightweight enclave-based isolation for individual cloud workers running inside confidential VMs. We achieve this lightweight isolation through the use of tagged memory that allows to associate metadata, e.g., Domain Identifiers, with pages. Moreover, the guest enclaves support fast context switches within the confidential VM, as TLB entries are tagged with the Domain Identifiers, eliminating context switch overheads from TLB flushes. We implement a CAGE-V prototype, consisting of a hardware extension for the CORE-V CVA6 processor and a small security monitor, and evaluate our design in terms of system performance, demonstrating a minor performance impact.",

keywords = "Secure Virtualization, Guest Enclaves, RISC-V, Confidential Computing",

author = "Moritz Waser and Paul Gollob and Martin Unterguggenberger and Stefan Mangard",

year = "2026",

month = jun,

day = "4",

doi = "10.1145/3779208.3807479",

language = "English",

series = "ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery (ACM)",

pages = "577--590",

booktitle = "Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS {\textquoteright}26),",

address = "United States",

note = "ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2026, ASIA CCS 2026 ; Conference date: 01-06-2026 Through 05-06-2026",

}

TY - GEN

T1 - CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V

AU - Waser, Moritz

AU - Gollob, Paul

AU - Unterguggenberger, Martin

AU - Mangard, Stefan

PY - 2026/6/4

Y1 - 2026/6/4

N2 - Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches. In this work, we present CAGE-V, a novel confidential computing architecture that supports lightweight enclave-based isolation for individual cloud workers running inside confidential VMs. We achieve this lightweight isolation through the use of tagged memory that allows to associate metadata, e.g., Domain Identifiers, with pages. Moreover, the guest enclaves support fast context switches within the confidential VM, as TLB entries are tagged with the Domain Identifiers, eliminating context switch overheads from TLB flushes. We implement a CAGE-V prototype, consisting of a hardware extension for the CORE-V CVA6 processor and a small security monitor, and evaluate our design in terms of system performance, demonstrating a minor performance impact.

AB - Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches. In this work, we present CAGE-V, a novel confidential computing architecture that supports lightweight enclave-based isolation for individual cloud workers running inside confidential VMs. We achieve this lightweight isolation through the use of tagged memory that allows to associate metadata, e.g., Domain Identifiers, with pages. Moreover, the guest enclaves support fast context switches within the confidential VM, as TLB entries are tagged with the Domain Identifiers, eliminating context switch overheads from TLB flushes. We implement a CAGE-V prototype, consisting of a hardware extension for the CORE-V CVA6 processor and a small security monitor, and evaluate our design in terms of system performance, demonstrating a minor performance impact.

KW - Secure Virtualization

KW - Guest Enclaves

KW - RISC-V

KW - Confidential Computing

UR - https://www.scopus.com/pages/publications/105042435846

U2 - 10.1145/3779208.3807479

DO - 10.1145/3779208.3807479

M3 - Conference paper

T3 - ASIA CCS 2026 - Proceedings of the 21st ACM ASIA Conference on Computer and Communications Security

SP - 577

EP - 590

BT - Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIA CCS ’26),

PB - Association for Computing Machinery (ACM)

T2 - ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2026

Y2 - 1 June 2026 through 5 June 2026

ER -

CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Fields of Expertise

Access to Document

Other files and links

Fingerprint

EU - Rigoletto - Risc-V Generation of high performance automative procesors and computing platforms

RESIST - Enabling Secure RISC-V Architectures Through Efficient Software Integrity and Isolation Technologies