storage access analysis

This work addresses performance degradation in online data-intensive applications, which often stems from workload fluctuations and resource contention but remains elusive to conventional thread-state analysis due to complex cross-thread dependencies. The authors propose an application-agnostic diagnostic approach that leverages eBPF to collect 16 fine-grained metrics across six kernel subsystems—scheduling, VFS, networking, futex, multiplexed I/O, and block device I/O—and integrates a selective thread-tracing algorithm to precisely trace from entry-point threads to bottlenecked resources. By jointly modeling thread dynamics and resource interaction patterns, the method uniquely captures the propagation pathways of performance degradation. It enables low-overhead diagnosis of CPU, disk, lock, and external service contention across diverse workloads while uncovering internal application bottlenecks.

TEE containers face systemic security risks—including information leakage, rollback attacks, denial-of-service (DoS), and Iago attacks—due to ambiguously defined trust boundaries and isolation failures. This paper introduces the first automated boundary identification framework that jointly leverages static and dynamic analysis to reverse-engineer and formally verify isolation policies of mainstream TEE containers (e.g., SCONE, Gramine). Our analysis uncovers critical trust boundary misalignments in multiple production-deployed containers, empirically reproduces four classes of high-severity attacks, and quantifies their exploitability and impact scope. The work establishes a reusable trust boundary modeling paradigm and provides concrete hardening guidelines for TEE middleware design. By enabling rigorous, artifact-based boundary validation, it advances trusted execution environments from opaque “black-box” encapsulation toward verifiable, architecture-aware isolation.

Shared state profoundly influences the performance and fault tolerance of stream processing, service-oriented, and continual learning systems, yet existing approaches often treat access control, hardware-aware execution, memory management, and long-term evolution in isolation. This work reframes state management as a runtime control problem and introduces a contract-driven blueprint centered on state objects, control planes, coupling paths, evaluation boundaries, and pending contracts. Building upon this foundation, we develop a unified analytical framework encompassing state-access scheduling, state-aware execution, and state evolution reuse. Through systematic scheduling, runtime control, and cross-layer coupling analysis, our approach identifies critical anti-patterns and advances a perturbation-aware evaluation paradigm, thereby establishing both theoretical foundations and practical design guidelines for state control in distributed systems.

Trusted Execution Environments (TEEs) such as SGX and TrustZone retain non-volatile state across power cycles, rendering them vulnerable to covert rollback attacks that compromise Byzantine fault-tolerant (BFT) system recovery. Method: We propose a rollback-resilient reliable read-write register construction. First, we introduce a unified fault model capturing crash, Byzantine, and rollback faults in TEEs. Second, we derive tight bounds on register fault tolerance for both static and dynamic settings, proving that (n geq 3f + 1) is necessary and sufficient for static fault tolerance. Third, we design a dynamic state reconstruction algorithm that requires no trusted monotonic counter, enabling the first provably correct emulation of reliable registers in TEEs. Contribution/Results: Our work provides formal correctness guarantees and practical building blocks for fault-tolerant systems operating under real-world hardware constraints—specifically, those imposed by TEEs’ non-volatile storage semantics and rollback vulnerabilities.

This work identifies and systematically constructs Write+Sync, a novel pure-software write-based covert channel exploiting timing discrepancies between OS memory-disk synchronization mechanisms and software write buffering—operating without hardware dependencies and evading existing defenses. It introduces the first high-speed write channel explicitly designed for software caches, proposing single- and multi-file page collaborative modulation strategies alongside multi-granularity channel encoding. A system-level implementation is realized on Linux and macOS. Experiments demonstrate an average throughput of 2.036 Kb/s (peak: 14.762 Kb/s) on Linux with 0% bit error rate (BER), and 10.211 Kb/s (peak: 253.022 Kb/s) on macOS with only 0.004% BER. The channel enables practical attacks, including website fingerprinting and performance degradation, thereby validating its real-world exploitability and threat impact.

This work addresses critical security vulnerabilities in Trusted Execution Environment (TEE) applications—such as data leakage and code injection—caused by improper partitioning, for which automated repair mechanisms have been lacking. The paper introduces TEERepair, the first framework capable of automatically repairing TEE partitioning errors. It encodes security repair patterns using a domain-specific language (DSL) and leverages large language models (LLMs) to understand the semantics of underlying C code, thereby generating context-aware repair patches and automatically constructing validation test clients. This approach overcomes key challenges including semantic extraction difficulty, absence of development guidelines, and insufficient verification methods. Evaluated on the PartitioningE-Bench benchmark, TEERepair achieves an 87.6% repair success rate and has contributed five pull requests to real-world TEE projects, two of which have already been merged.

This work addresses the fragmentation in existing confidential container systems, which often rely on virtual machines or specific trusted execution environments (TEEs), thereby disrupting unified management with standard OCI runtimes. The paper proposes EBCC, an architecture that treats the rich execution environment (REE) anchor and the TEE-side confidential stage as a unified containerized entity. By introducing a TEE backend adapter to abstract underlying heterogeneity, EBCC enables OCI-compliant lifecycle operations. It is the first framework to seamlessly integrate diverse TEEs—including Keystone, SGX, TDX, and OP-TEE—while avoiding significant expansion of the trusted computing base. Experimental results demonstrate EBCC’s functional correctness and strong concurrency on Keystone, broad cross-TEE portability, and only modest, manageable latency overheads, with additional costs primarily confined to host-side management operations.

This work addresses the performance limitations of the Sui blockchain, which stem from workload contention. Conventional read-write conflict graph approaches overestimate actual serialization dependencies. To remedy this, the authors propose a write-only (W-only) analysis model that introduces the W-only conflict graph as a lower bound on contention. By integrating write-set analysis, union-find-based object clustering, and empirical mainnet data, the study precisely characterizes genuine write serialization events. Findings reveal that excluding read-only dependencies eliminates the hub-and-spoke topology commonly assumed, indicating that parallelism potential has been overestimated by 30–40%. Moreover, 10–50% of transaction value flows through serial paths, exposing significant ordering risk. The results demonstrate that Sui’s contention topology is highly assortative and dominated by dense clusters, fundamentally revising prior understanding of its parallel execution capacity.

This study addresses a critical side-channel vulnerability in cloud environments where containers and virtual machines, despite employing software-based isolation mechanisms, remain susceptible to cross-tenant information leakage through the shared host page cache. The authors systematically evaluate the page cache risks across diverse runtime environments—including Docker, gVisor, Kata, and QEMU/KVM—under shared storage conditions, leveraging unprivileged timing measurements to infer cache residency across isolation boundaries. Their work is the first to demonstrate the pervasive nature of page cache leakage in modern isolation architectures and integrates this attack vector into a unified framework for OS-mediated microarchitectural timing side channels. Experiments confirm that the attack succeeds whenever the I/O path involves shared cacheable file objects, while mitigation strategies such as direct I/O or dedicated block devices significantly suppress the signal. The approach successfully recovers coarse-grained activity patterns from a real-world WordPress+MySQL deployment.

This work addresses key challenges in academic reproducibility—namely insufficient editorial resources, difficulties in handling proprietary data, and inefficient workflows—by systematically introducing trusted execution environments (TEEs) for the first time. The authors propose a cloud-based reproducibility framework built on Intel TDX, wherein researchers execute their code within a TEE and submit cryptographically verifiable attestations of correct execution. Journals can then efficiently validate reproducibility without rerunning the code, ensuring data confidentiality, reducing author burden, and eliminating reliance on volunteer labor or scarce editorial resources. Theoretical analysis demonstrates that the approach is incentive-compatible and cost-effective; empirical evaluation confirms a low per-reproduction cost of only \$1.35–\$1.80, with minimal computational overhead and strong usability.