Confidential computing protects data in use within Trusted Execution Environments (TEEs), but current TEEs provide little support for secure communication between components. As a result, pipelines of independently developed and deployed TEEs must trust one another to avoid the leakage of sensitive information they exchange -- a fragile assumption that is unrealistic for modern cloud workloads. We present Mica, a confidential computing architecture that decouples confidentiality from trust. Mica provides tenants with explicit mechanisms to define, restrict, and attest all communication paths between components, ensuring that sensitive data cannot leak through shared resources or interactions. We implement Mica on Arm CCA using existing primitives, requiring only modest changes to the trusted computing base. Our extension adds a policy language to control and attest communication paths among Realms and with the untrusted world via shared protected and unprotected memory and control transfers. Our evaluation shows that Mica supports realistic cloud pipelines with only a small increase to the trusted computing base while providing strong, attestable confidentiality guarantees.

翻译：机密计算通过可信执行环境（TEE）保护使用中的数据，但现有TEE对组件间的安全通信支持有限。因此，由独立开发部署的TEE构成的流水线必须相互信任，以避免交换的敏感信息泄露——这一脆弱假设对现代云工作负载并不现实。本文提出Mica，一种将机密性与信任解耦的机密计算架构。Mica为租户提供明确的机制来定义、限制和验证所有组件间的通信路径，确保敏感数据不会通过共享资源或交互行为泄露。我们在Arm CCA上利用现有原语实现了Mica，仅需对可信计算基进行适度修改。我们的扩展增加了策略语言，通过共享的受保护/未受保护内存及控制转移，来管控并验证领域之间以及与不可信世界间的通信路径。评估表明，Mica能以可信计算基的微小增量为代价支持实际云流水线，同时提供强可验证的机密性保证。