企业日益依赖基于云的应用程序来处理高度敏感的数据 artifact。尽管云采用提高了敏捷性和可扩展性，但也引入了新的安全挑战，例如扩展的攻击面、凭证泄露后更广的攻击半径，以及在用户、服务和工作流之间维持严格访问控制的挑战。这些挑战尤其突出于处理特权数据并执行安全关键分析的应用程序中，其中传统信任边界和临时安全措施不足。本文提出了 Lockbox；一种专为在严格的企业安全和治理要求下安全处理敏感云工作负载而设计的零信任架构。Lockbox 在整个应用程序生命周期中应用显式的信任验证、强隔离、最少特权访问和基于策略的执行，从用户认证和文档摄入到分析执行和结果存储。系统集成了现代云安全原语，包括基于角色的访问控制、集中式密钥管理、传输中和静止时的加密，以及受控集成云基于数据处理服务，确保敏感 artifact 保持受保护并仅对授权用户可用。我们讨论了 Lockbox 在处理高度敏感的网络安全报告中的使用，并展示了该架构如何使组织能够安全地采用高级能力，包括 AI 辅助处理，而不会削弱其安全态势。
英文摘要：
Enterprises increasingly rely on cloud-based applications to process highly sensitive data artifacts. Although cloud adoption improves agility and scalability, it also introduces new security challenges such as expanded attack surfaces, a wider radius of attack from credential compromise, and challenges maintaining strict access controls across users, services, and workflows. These challenges are especially acute for applications that handle privileged data and execute security-critical analysis, where traditional trust boundaries and ad hoc safeguards are insufficient. This paper presents Lockbox; a Zero Trust architecture designed for secure processing of sensitive cloud workloads under strict enterprise security and governance requirements. Lockbox applies explicit trust verification, strong isolation, least-privilege access, and policy-driven enforcement throughout the entire application lifecycle, from user authentication and document ingestion to analysis execution and result storage. The system incorporates modern cloud security primitives including; role-based access control, centralized key management, encryption in transit and at rest, and controlled integration with cloud-based data processing services, ensuring that sensitive artifacts remain protected and accessible only to authorized users. We discuss the usage of Lockbox in processing highly sensitive cybersecurity reports and demonstrate how this architecture enables organizations to safely adopt advanced capabilities, including AI-assisted processing, without weakening their security posture.
Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments
School of Computer Science and Technology, Xidian University（西安电子科技大学计算机科学与技术学院）；Shaanxi Key Laboratory of Network and System Security（陕西省网络与系统安全重点实验室）；Alibaba Cloud（阿里云）
More Granular, Less Trust: Enforcing Intra-Process Isolation with Arm CCA in an Untrusted Management Environment
Huazhong University of Science and Technology（华中科技大学）；JinYinHu Laboratory（金银湖实验室）；George Mason University（乔治梅森大学）；Peking University（北京大学）；DAMO Academy, Alibaba Group（阿里巴巴集团达摩院）
