Wallet: Confidential Serverless Computing
summary
Wallet implements nested confidential execution inside CVMs with a tiny trusted monitor, a decoupled guest OS, LibOS-based zygote images and fork-style copy-on-write trustlets to run many functions per CVM. The prototype extends Coconut SVSM, uses Gramine as LibOS and bundles CPython. Results report 4.3× smaller TCB, 15–93% latency improvement end-to-end, up to 907× function density, and 27× reduction in inter-function communication with function chaining sped up 16.7–30.2×.
AI-written summary · about
chapters (16)
- 0:00Serverless computing intro
- 1:00Security challenges
- 2:03What are confidential virtual machines
- 3:05Limitations of CVMs for serverless workloads
- 5:57Wallet architecture
- 7:41Secure function isolation
- 8:45Reduce TCB and boot time
- 9:49Overcoming consolidation limits
- 10:52Inter-function communication
- 11:55Serverless request processing
- 12:56Wallet prototype details
- 13:36Performance evaluation setup
- 14:19Wallet performance results
- 15:21Function chaining latency
- 16:02Copy-on-write effectiveness
- 16:46Summary and open source
related talks
17mServerless Functions Made Confidential and Efficient with Split Containers
45mSecuring Confidential VMs with COCONUT-SVSM
25mOne Size Fits None: Lightweight Workload-Specialized Confidential Containers
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
12mThe Power of Confidential Computing: Exploring Open Source Projects
41mConfidential Computing, from host to workload
42mSponsored Session: Confidential Computing - New Capabilities for New Workloads
50mConfidential Containers: Why, How, and Where Are We?