A WASM Runtime for FaaS Protected by TEE
summary
Proposal to run a single WebAssembly runtime inside hardware TEEs to fix cross‑platform enclave fragmentation by shipping tiny WASM bytecode instead of multiple encrypted container images, demonstrating encrypted WASM binaries, snapshot booting for subsecond cold starts, and integration with FaaS platforms. Shows a working stack using WasmEdge (plus evaluations of Wasmer and WAMR), deployment into VM‑level TEEs like Intel TDX, and end‑to‑end function hosting on Spin, with claimed smaller images and faster cold starts.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:33Confidential Computation
- 3:59TEE was built for confidential computing
- 5:52Different TEES are different
- 7:44Virtualization for TEE client Architecture
- 8:43TEE containers and Kubernetes
- 9:49Working model for TEE containers
- 10:48Cloud native TEE
- 11:30Inclavare Project
- 13:47Still Not Perfect
- 16:18WASM Runtime in TEE
- 16:58WASM Runtime Architecture
- 17:40WASM Runtime Fast Boot
- 19:39Knative Functions IN TEE
- 23:17WASM Cloud in TEE
related talks
08mLightning Talk: Build trusted cloud apps with Wasm: WebAssembly Micro Runtime is ready
36mBringing honest computing to the WASM world
30mProtecting Wasm Workloads with Confidential Computing and TEE...
05mThe Super Fast TAG Runtime Wasm Review
55mUsing WebAssembly to run, extend, and secure your .NET application
38mWebAssembly beyond the browser
45mWebAssembly on the server
53mUsing WebAssembly to run, extend, and secure your .NET application