.jpg)
Confidential computing has been presented as the great promise to guarantee data sovereignty in cloud environments, especially in Europe, where frameworks like SecNumCloud demand high levels of legal and technical security. However, independent research reveals that the mechanism it relies on —remote attestation— has architectural vulnerabilities that compromise the trust it is supposed to provide. The flaw is not in the hardware, but in the protocol that should cryptographically prove that a server is running a genuine, untampered Trusted Execution Environment (TEE). The relay attacks discovered allow redirecting a client's traffic to a malicious server without the client noticing, since the protocol verifies software integrity but not the physical location of the hardware. This has direct implications for companies that trust public or hybrid cloud solutions to process sensitive data.
For organizations seeking custom applications or critical cloud systems, these weaknesses mean that merely adopting confidential computing is not enough to ensure data confidentiality and control. IT departments must complement these technologies with formal analysis and in-depth audits, something that goes beyond traditional manual reviews. In this scenario, having cybersecurity and pentesting services that incorporate formal verification methods becomes a strategic necessity to detect vulnerabilities that hardware vendors may overlook. Q2BSTUDIO, as a software and technology development company, integrates these practices into its custom software projects, ensuring that trust architectures are not based solely on commercial promises.
The case analyzed by researchers —which affects production implementations such as those of Meta, Edgeless Systems, or the Cocos AI platform— demonstrates that even exhaustive audits conducted by renowned firms may fail to detect this type of flaw if they do not use symbolic analysis tools. The vulnerability, classified with a CVSS score of 7.5, exceeds in severity other known ones like BadRAM. This highlights the importance of adopting a multidisciplinary approach that combines artificial intelligence for detecting anomalous patterns, audited AWS and Azure cloud services, and business intelligence services to monitor workload behavior. Q2BSTUDIO offers Power BI and AI solutions for companies that help visualize and alert on deviations in security posture, as well as AI agents that automate incident response.
The root of the problem lies in the design of the attested TLS protocol, which fails to link the attestation evidence with the encryption key of application data in real time. Researchers conclude that within the current intra-handshake attestation scheme, achieving the necessary security level to prevent relay attacks may be impossible without modifying TLS itself. This forces a rethinking of digital sovereignty strategies: it is not enough to choose a European cloud provider or a chip with a TEE; the attestation channel must be verified as robust. Q2BSTUDIO, with its experience in AWS and Azure cloud services, advises its clients on implementing complementary controls such as post-attestation, client-managed end-to-end encryption, and continuous infrastructure monitoring, minimizing the risk of an attacker exploiting these architectural weaknesses.
