2025/09/15 by Zhou, Shunfan, Hang Yin, Wang, Kevin +1
Computer Science · Social Sciences · #Access Control and Trust #Artificial Intelligence (cs.AI) #Cloud Data Security Solutions #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.2509.11555
openalex publication_date 2025/09/15 · openalex created_date 2025/10/12 · openalex updated_date 2026/07/28
Web3 applications require execution platforms that maintain confidentiality and integrity without relying on centralized trust authorities. While Trusted Execution Environments (TEEs) offer promising capabilities for confidential computing, current implementations face significant limitations when applied to Web3 contexts, particularly in security reliability, censorship resistance, and vendor independence. This paper presents dstack, a comprehensive framework that transforms raw TEE technology into a true Zero Trust platform. We introduce three key innovations: (1) Portable Confidential Containers that enable seamless workload migration across heterogeneous TEE environments while maintaining security guarantees, (2) Decentralized Code Management that leverages smart contracts for transparent governance of TEE applications, and (3) Verifiable Domain Management that ensures secure and verifiable application identity without centralized authorities. These innovations are implemented through three core components: dstack-OS, dstack-KMS, and dstack-Gateway. Together, they demonstrate how to achieve both the performance advantages of VM-level TEE solutions and the trustless guarantees required by Web3 applications. Our evaluation shows that dstack provides comprehensive security guarantees while maintaining practical usability for real-world applications.