{"id":"https://openalex.org/W7163565616","doi":"https://doi.org/10.48550/arxiv.2606.04549","title":"PS-UIE: Privilege-Separated Integrity Enforcement for User-Space Executable Objects in Confidential VMs","display_name":"PS-UIE: Privilege-Separated Integrity Enforcement for User-Space Executable Objects in Confidential VMs","publication_year":2026,"publication_date":"2026-06-03","ids":{"openalex":"https://openalex.org/W7163565616","doi":"https://doi.org/10.48550/arxiv.2606.04549"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.04549","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04549","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.04549","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104294405","display_name":"Jingkai Mao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mao, Jingkai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137917110","display_name":"Xiaolin Chang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chang, Xiaolin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9747999906539917,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9747999906539917,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.006899999920278788,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.005799999926239252,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.8798999786376953},{"id":"https://openalex.org/keywords/data-integrity","display_name":"Data integrity","score":0.6039999723434448},{"id":"https://openalex.org/keywords/enforcement","display_name":"Enforcement","score":0.5879999995231628},{"id":"https://openalex.org/keywords/verifiable-secret-sharing","display_name":"Verifiable secret sharing","score":0.5067999958992004},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.5047000050544739},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.4706999957561493},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.45570001006126404},{"id":"https://openalex.org/keywords/trusted-computing","display_name":"Trusted Computing","score":0.4408000111579895}],"concepts":[{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.8798999786376953},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7771000266075134},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.6039999723434448},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.5879999995231628},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5257999897003174},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.5067999958992004},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.5047000050544739},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.4706999957561493},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.45570001006126404},{"id":"https://openalex.org/C2776831232","wikidata":"https://www.wikidata.org/wiki/Q966812","display_name":"Trusted Computing","level":2,"score":0.4408000111579895},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.4099999964237213},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.35499998927116394},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.33239999413490295},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.31679999828338623},{"id":"https://openalex.org/C202973057","wikidata":"https://www.wikidata.org/wiki/Q7380130","display_name":"Runtime verification","level":3,"score":0.3107999861240387},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2793999910354614},{"id":"https://openalex.org/C202775310","wikidata":"https://www.wikidata.org/wiki/Q1140366","display_name":"Trusted Platform Module","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.2687999904155731},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.26579999923706055},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2596000134944916},{"id":"https://openalex.org/C2984185122","wikidata":"https://www.wikidata.org/wiki/Q1309431","display_name":"Structural integrity","level":2,"score":0.25040000677108765},{"id":"https://openalex.org/C63540848","wikidata":"https://www.wikidata.org/wiki/Q3140932","display_name":"Fault tolerance","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.04549","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04549","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.04549","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04549","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6251019835472107,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Confidential":[0],"Virtual":[1],"Machines":[2],"(CVMs),":[3],"such":[4,82],"as":[5,83],"AMD":[6,125,198],"SEV-SNP,":[7],"enable":[8],"cloud":[9],"tenants":[10,16],"to":[11,41],"run":[12],"security-sensitive":[13],"workloads,":[14],"but":[15,69],"can":[17,28],"rely":[18],"on":[19,160,196,217],"the":[20,30,42,75,118,140,148,211,218],"execution":[21,101],"of":[22,66,77,120,130,213],"these":[23],"workloads":[24],"only":[25],"when":[26],"they":[27,70],"trust":[29,33,48,62],"CVM.":[31],"This":[32],"requires":[34],"continuous":[35],"integrity":[36,55,76,119,143,169,180,212],"assurance":[37],"from":[38,147],"CVM":[39],"launch":[40,51],"current":[43],"runtime":[44,54,67,191,226],"state,":[45],"including":[46],"initial":[47],"establishment":[49],"at":[50],"and":[52,63,88,134,145,171,174,182,188,204,223],"subsequent":[53],"assurance.":[56],"Existing":[57],"works":[58],"help":[59],"establish":[60],"launch-time":[61],"protect":[64],"parts":[65],"integrity,":[68],"do":[71],"not":[72],"fully":[73],"address":[74],"file-backed":[78],"user-space":[79,121,185,214],"executable":[80,122,186,215],"objects,":[81,92],"main":[84],"executables,":[85],"program":[86],"interpreters,":[87],"dynamically":[89,99],"loaded":[90,96],"shared":[91],"that":[93,208],"may":[94],"be":[95],"or":[97],"mapped":[98],"during":[100],"inside":[102,124],"CVMs.":[103,127],"In":[104],"this":[105,161],"paper,":[106],"we":[107],"propose":[108],"Privilege-Separated":[109],"User-space":[110],"Integrity":[111],"Enforcement":[112],"(PS-UIE),":[113],"an":[114,197],"approach":[115],"for":[116,142,184],"enforcing":[117],"objects":[123,187,216],"SEV-SNP-based":[126],"PS-UIE":[128,163,195,209],"consists":[129],"a":[131,155],"privilege-separated":[132],"architecture":[133,138],"three":[135],"mechanisms.":[136,176],"The":[137,201],"separates":[139],"authority":[141],"measurement":[144,181],"enforcement":[146,183],"measured":[149],"targets":[150],"by":[151],"placing":[152],"it":[153],"in":[154],"higher-privileged":[156],"protected":[157],"domain.":[158],"Built":[159],"architecture,":[162],"provides":[164,224],"policy":[165],"lifecycle":[166],"management,":[167],"execution-time":[168],"enforcement,":[170],"evidence":[172,227],"export":[173],"verification":[175],"It":[177],"enables":[178],"policy-controlled":[179],"generates":[189],"verifiable":[190,225],"evidence.":[192],"We":[193],"implement":[194],"SEV-SNP":[199],"platform.":[200],"security":[202],"analysis":[203],"performance":[205],"evaluation":[206],"show":[207],"enforces":[210],"covered":[219],"execute-permission":[220],"grant":[221],"paths":[222],"while":[228],"incurring":[229],"acceptable":[230],"overhead.":[231]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-05T00:00:00"}