More Granular, Less Trust: Enforcing Intra-Process Isolation with Arm CCA in an Untrusted Management Environment

CCAegis is an intra-process isolation system for Arm’s Confidential Compute Architecture (CCA). It uses the Granule Protection Table (GPT) to confine sensitive data and code inside security-sensitive applications, protecting them from both intra-process adversaries and an untrusted OS while keeping the Trusted Computing Base (TCB) limited to the Secure Monitor. A bespoke LLVM pass automatically performs static points-to/taint analysis to locate functions that touch secrets (e.g., crypto keys) and injects permission-switching at call/return boundaries.

./scripts/prerequisites.sh

./scripts/linux_build.sh

For subsequent compilation options, press 'Enter' to choose the default.

./scripts/atf_build.sh

./scripts/bootfvp.sh