{"id":"https://openalex.org/W4405182712","doi":"https://doi.org/10.1145/3658644.3670352","title":"Crossing Shifted Moats: Replacing Old Bridges with New Tunnels to Confidential Containers","display_name":"Crossing Shifted Moats: Replacing Old Bridges with New Tunnels to Confidential Containers","publication_year":2024,"publication_date":"2024-12-02","ids":{"openalex":"https://openalex.org/W4405182712","doi":"https://doi.org/10.1145/3658644.3670352"},"language":"en","primary_location":{"id":"doi:10.1145/3658644.3670352","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670352","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670352","source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670352","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019332399","display_name":"Enriquillo Valdez","orcid":"https://orcid.org/0009-0004-4674-3384"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Enriquillo Valdez","raw_affiliation_strings":["IBM Research, Yorktown Heights, New York, USA"],"raw_orcid":"https://orcid.org/0009-0004-4674-3384","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, New York, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049447247","display_name":"Salman Ahmed","orcid":"https://orcid.org/0000-0003-0290-5367"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Salman Ahmed","raw_affiliation_strings":["IBM Research, Yorktown Heights, New York, USA"],"raw_orcid":"https://orcid.org/0000-0003-0290-5367","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, New York, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057478629","display_name":"Zhongshu Gu","orcid":"https://orcid.org/0000-0001-9624-2669"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhongshu Gu","raw_affiliation_strings":["IBM Research, Yorktown Heights, New York, USA"],"raw_orcid":"https://orcid.org/0000-0001-9624-2669","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, New York, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115061052","display_name":"Christophe de Dinechin","orcid":"https://orcid.org/0009-0005-0397-6281"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Christophe de Dinechin","raw_affiliation_strings":["Red Hat, Valbonne, France"],"raw_orcid":"https://orcid.org/0009-0005-0397-6281","affiliations":[{"raw_affiliation_string":"Red Hat, Valbonne, France","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101556378","display_name":"Pau-Chen Cheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pau-Chen Cheng","raw_affiliation_strings":["IBM Research, Yorktown Heights, New York, USA"],"raw_orcid":"https://orcid.org/0009-0001-8234-2260","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, New York, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071982602","display_name":"Hani Jamjoom","orcid":"https://orcid.org/0000-0001-6143-1064"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hani Jamjoom","raw_affiliation_strings":["IBM Research, Yorktown Heights, New York, USA"],"raw_orcid":"https://orcid.org/0000-0001-6143-1064","affiliations":[{"raw_affiliation_string":"IBM Research, Yorktown Heights, New York, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1390","last_page":"1404"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7281908392906189},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.7250579595565796},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.7062873840332031},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6627459526062012},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5927828550338745},{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.562436580657959},{"id":"https://openalex.org/keywords/interface","display_name":"Interface (matter)","score":0.5047100782394409},{"id":"https://openalex.org/keywords/container","display_name":"Container (type theory)","score":0.4898204505443573},{"id":"https://openalex.org/keywords/controller","display_name":"Controller (irrigation)","score":0.42890581488609314},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3773060441017151},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3077544569969177},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.13352274894714355}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7281908392906189},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.7250579595565796},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.7062873840332031},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6627459526062012},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5927828550338745},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.562436580657959},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.5047100782394409},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.4898204505443573},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.42890581488609314},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3773060441017151},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3077544569969177},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.13352274894714355},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C129307140","wikidata":"https://www.wikidata.org/wiki/Q6795880","display_name":"Maximum bubble pressure method","level":3,"score":0.0},{"id":"https://openalex.org/C6557445","wikidata":"https://www.wikidata.org/wiki/Q173113","display_name":"Agronomy","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C157915830","wikidata":"https://www.wikidata.org/wiki/Q2928001","display_name":"Bubble","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3658644.3670352","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670352","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670352","source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3658644.3670352","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670352","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670352","source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405182712.pdf"},"referenced_works_count":14,"referenced_works":["https://openalex.org/W1991563835","https://openalex.org/W2013892605","https://openalex.org/W2049722158","https://openalex.org/W2586202584","https://openalex.org/W2612012086","https://openalex.org/W2621197600","https://openalex.org/W2899822557","https://openalex.org/W2902718458","https://openalex.org/W2985907279","https://openalex.org/W3001001866","https://openalex.org/W3105175523","https://openalex.org/W3159718887","https://openalex.org/W4311165727","https://openalex.org/W4390046745"],"related_works":["https://openalex.org/W4387497383","https://openalex.org/W3183948672","https://openalex.org/W3173606202","https://openalex.org/W3110381201","https://openalex.org/W2948807893","https://openalex.org/W2935909890","https://openalex.org/W2778153218","https://openalex.org/W2758277628","https://openalex.org/W1531601525","https://openalex.org/W2091483479"],"abstract_inverted_index":{"The":[0,46],"Confidential":[1],"Containers":[2,16,42],"(CoCo)":[3],"project,":[4],"as":[5],"an":[6,131],"open-source":[7],"community":[8],"initiative,":[9],"inherits":[10],"the":[11,32,65,70,86,91,136,139,146,184,205],"system":[12,83],"architecture":[13],"of":[14,55,81,102,138,187,207],"Kata":[15,41],"while":[17,158],"integrating":[18],"confidential":[19,44,188,200],"computing":[20,37],"to":[21,69,123],"protect":[22],"cloud-native":[23,177],"container":[24],"workloads.":[25],"However,":[26],"there":[27],"exists":[28],"a":[29,53,61,78,120],"misalignment":[30],"in":[31,58,93],"threat":[33,185],"model":[34,186],"and":[35,43,134,154,180,202],"trusted":[36],"base":[38],"(TCB)":[39],"between":[40],"computing.":[45,189],"shifted":[47],"trust":[48,94],"boundaries":[49],"could":[50],"potentially":[51],"expose":[52],"range":[54],"vulnerabilities,":[56],"particularly":[57],"scenarios":[59],"where":[60],"malicious":[62],"actor":[63],"on":[64,109],"host":[66],"gains":[67],"access":[68],"CoCo's":[71,82,103,125],"unprotected":[72],"control":[73,104,126],"interface.":[74,127],"This":[75,128,171],"paper":[76],"conducts":[77],"thorough":[79],"examination":[80],"architecture,":[84],"exploring":[85],"attack":[87],"surface":[88],"resulting":[89],"from":[90,114,198],"discord":[92],"boundaries.":[95],"We":[96],"have":[97,118],"assessed":[98],"all":[99],"API":[100],"endpoints":[101],"interface,":[105],"categorizing":[106],"them":[107],"based":[108],"their":[110,165],"security":[111],"properties.":[112],"Drawing":[113],"these":[115],"insights,":[116],"we":[117],"developed":[119],"bifurcation":[121],"approach":[122,172],"splitting":[124],"involves":[129],"establishing":[130],"owner-side":[132],"controller":[133,148],"minimizing":[135],"capabilities":[137],"existing":[140],"host-side":[141,147],"controller.":[142],"Under":[143],"this":[144],"framework,":[145],"is":[149],"exclusively":[150],"responsible":[151],"for":[152],"allocating":[153],"recycling":[155],"compute":[156],"resources,":[157],"dedicated":[159],"workload":[160],"owners":[161],"can":[162],"directly":[163],"manage":[164],"containers":[166],"through":[167],"alternative":[168],"secure":[169],"tunnels.":[170],"ensures":[173],"seamless":[174],"integration":[175],"with":[176,183,204],"orchestration":[178],"layers":[179],"aligns":[181],"CoCo":[182],"By":[190],"doing":[191],"so,":[192],"it":[193],"effectively":[194],"prevents":[195],"untrusted":[196],"hosts":[197],"accessing":[199],"data":[201],"interfering":[203],"execution":[206],"workloads":[208],"within":[209],"protected":[210],"domains.":[211]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}