It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications Article Swipe
YOU?
·
· 2025
· Open Access
·
· DOI: https://doi.org/10.48550/arxiv.2511.13641
Replay and rollback attacks threaten cloud application integrity by reintroducing authentic yet stale data through an untrusted storage interface to compromise application decision-making. Prior security frameworks mitigate these attacks by enforcing forward-only state transitions (state continuity) with hardware-backed mechanisms, but they categorically treat all rollback as malicious and thus preclude legitimate rollbacks used for operational recovery from corruption or misconfiguration. We present Rebound, a general-purpose security framework that preserves rollback protection while enabling policy-authorized legitimate rollbacks of application binaries, configuration, and data. Key to Rebound is a reference monitor that mediates state transitions, enforces authorization policy, guarantees atomicity of state updates and rollbacks, and emits a tamper-evident log that provides transparency to applications and auditors. We formally prove Rebound's security properties and show through an application case study -- with software deployment workflows in GitLab CI -- that it enables robust control over binary, configuration, and raw data versioning with low end-to-end overhead.
Related Topics
- Type
- preprint
- Landing Page
- https://doi.org/10.48550/arxiv.2511.13641
- OA Status
- green
- OpenAlex ID
- https://openalex.org/W7106041956
Raw OpenAlex JSON
- OpenAlex ID
-
https://openalex.org/W7106041956Canonical identifier for this work in OpenAlex
- DOI
-
https://doi.org/10.48550/arxiv.2511.13641Digital Object Identifier
- Title
-
It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud ApplicationsWork title
- Type
-
preprintOpenAlex work type
- Publication year
-
2025Year of publication
- Publication date
-
2025-11-17Full publication date if available
- Authors
-
Burke, Quinn, Vahldiek-Oberwagner, Anjo, Swift, Michael, McDaniel, PatrickList of authors in order
- Landing page
-
https://doi.org/10.48550/arxiv.2511.13641Publisher landing page
- Open access
-
YesWhether a free full text is available
- OA status
-
greenOpen access status per OpenAlex
- OA URL
-
https://doi.org/10.48550/arxiv.2511.13641Direct OA link when available
- Concepts
-
Rollback, Computer science, Computer security, Cloud computing, Database transaction, Key (lock), Confidentiality, Atomicity, Software deployment, State (computer science), Workflow, Firewall (physics), Mandatory access control, Compensating transaction, Transaction processing, Data integrity, Transparency (behavior), Threat model, Software, Sandbox (software development), Data security, Exploit, Replay attack, Security analysis, Access control, Consistency (knowledge bases), Data breach, Cryptography, Computer security model, Scope (computer science), Cloud computing security, Concurrency controlTop concepts (fields/topics) attached by OpenAlex
- Cited by
-
0Total citation count in OpenAlex
Full payload
| id | https://openalex.org/W7106041956 |
|---|---|
| doi | https://doi.org/10.48550/arxiv.2511.13641 |
| ids.doi | https://doi.org/10.48550/arxiv.2511.13641 |
| ids.openalex | https://openalex.org/W7106041956 |
| fwci | 0.0 |
| type | preprint |
| title | It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications |
| biblio.issue | |
| biblio.volume | |
| biblio.last_page | |
| biblio.first_page | |
| is_xpac | False |
| apc_list | |
| apc_paid | |
| concepts[0].id | https://openalex.org/C174220543 |
| concepts[0].level | 3 |
| concepts[0].score | 0.910797655582428 |
| concepts[0].wikidata | https://www.wikidata.org/wiki/Q395307 |
| concepts[0].display_name | Rollback |
| concepts[1].id | https://openalex.org/C41008148 |
| concepts[1].level | 0 |
| concepts[1].score | 0.8091966509819031 |
| concepts[1].wikidata | https://www.wikidata.org/wiki/Q21198 |
| concepts[1].display_name | Computer science |
| concepts[2].id | https://openalex.org/C38652104 |
| concepts[2].level | 1 |
| concepts[2].score | 0.7212012410163879 |
| concepts[2].wikidata | https://www.wikidata.org/wiki/Q3510521 |
| concepts[2].display_name | Computer security |
| concepts[3].id | https://openalex.org/C79974875 |
| concepts[3].level | 2 |
| concepts[3].score | 0.6398501396179199 |
| concepts[3].wikidata | https://www.wikidata.org/wiki/Q483639 |
| concepts[3].display_name | Cloud computing |
| concepts[4].id | https://openalex.org/C75949130 |
| concepts[4].level | 2 |
| concepts[4].score | 0.5211594104766846 |
| concepts[4].wikidata | https://www.wikidata.org/wiki/Q848010 |
| concepts[4].display_name | Database transaction |
| concepts[5].id | https://openalex.org/C26517878 |
| concepts[5].level | 2 |
| concepts[5].score | 0.5107273459434509 |
| concepts[5].wikidata | https://www.wikidata.org/wiki/Q228039 |
| concepts[5].display_name | Key (lock) |
| concepts[6].id | https://openalex.org/C71745522 |
| concepts[6].level | 2 |
| concepts[6].score | 0.4954586327075958 |
| concepts[6].wikidata | https://www.wikidata.org/wiki/Q2476929 |
| concepts[6].display_name | Confidentiality |
| concepts[7].id | https://openalex.org/C188045909 |
| concepts[7].level | 3 |
| concepts[7].score | 0.47177815437316895 |
| concepts[7].wikidata | https://www.wikidata.org/wiki/Q3306359 |
| concepts[7].display_name | Atomicity |
| concepts[8].id | https://openalex.org/C105339364 |
| concepts[8].level | 2 |
| concepts[8].score | 0.46960872411727905 |
| concepts[8].wikidata | https://www.wikidata.org/wiki/Q2297740 |
| concepts[8].display_name | Software deployment |
| concepts[9].id | https://openalex.org/C48103436 |
| concepts[9].level | 2 |
| concepts[9].score | 0.46814659237861633 |
| concepts[9].wikidata | https://www.wikidata.org/wiki/Q599031 |
| concepts[9].display_name | State (computer science) |
| concepts[10].id | https://openalex.org/C177212765 |
| concepts[10].level | 2 |
| concepts[10].score | 0.44917723536491394 |
| concepts[10].wikidata | https://www.wikidata.org/wiki/Q627335 |
| concepts[10].display_name | Workflow |
| concepts[11].id | https://openalex.org/C77714075 |
| concepts[11].level | 5 |
| concepts[11].score | 0.41323748230934143 |
| concepts[11].wikidata | https://www.wikidata.org/wiki/Q5452017 |
| concepts[11].display_name | Firewall (physics) |
| concepts[12].id | https://openalex.org/C2777407602 |
| concepts[12].level | 4 |
| concepts[12].score | 0.38095226883888245 |
| concepts[12].wikidata | https://www.wikidata.org/wiki/Q1888932 |
| concepts[12].display_name | Mandatory access control |
| concepts[13].id | https://openalex.org/C155951066 |
| concepts[13].level | 5 |
| concepts[13].score | 0.3734183609485626 |
| concepts[13].wikidata | https://www.wikidata.org/wiki/Q5156254 |
| concepts[13].display_name | Compensating transaction |
| concepts[14].id | https://openalex.org/C72108876 |
| concepts[14].level | 3 |
| concepts[14].score | 0.36285170912742615 |
| concepts[14].wikidata | https://www.wikidata.org/wiki/Q844565 |
| concepts[14].display_name | Transaction processing |
| concepts[15].id | https://openalex.org/C33762810 |
| concepts[15].level | 2 |
| concepts[15].score | 0.3578270971775055 |
| concepts[15].wikidata | https://www.wikidata.org/wiki/Q461671 |
| concepts[15].display_name | Data integrity |
| concepts[16].id | https://openalex.org/C2780233690 |
| concepts[16].level | 2 |
| concepts[16].score | 0.3428439199924469 |
| concepts[16].wikidata | https://www.wikidata.org/wiki/Q535347 |
| concepts[16].display_name | Transparency (behavior) |
| concepts[17].id | https://openalex.org/C140547941 |
| concepts[17].level | 2 |
| concepts[17].score | 0.32964470982551575 |
| concepts[17].wikidata | https://www.wikidata.org/wiki/Q7797194 |
| concepts[17].display_name | Threat model |
| concepts[18].id | https://openalex.org/C2777904410 |
| concepts[18].level | 2 |
| concepts[18].score | 0.32848259806632996 |
| concepts[18].wikidata | https://www.wikidata.org/wiki/Q7397 |
| concepts[18].display_name | Software |
| concepts[19].id | https://openalex.org/C167981075 |
| concepts[19].level | 2 |
| concepts[19].score | 0.328039288520813 |
| concepts[19].wikidata | https://www.wikidata.org/wiki/Q2667186 |
| concepts[19].display_name | Sandbox (software development) |
| concepts[20].id | https://openalex.org/C10511746 |
| concepts[20].level | 3 |
| concepts[20].score | 0.3235895037651062 |
| concepts[20].wikidata | https://www.wikidata.org/wiki/Q899388 |
| concepts[20].display_name | Data security |
| concepts[21].id | https://openalex.org/C165696696 |
| concepts[21].level | 2 |
| concepts[21].score | 0.31759873032569885 |
| concepts[21].wikidata | https://www.wikidata.org/wiki/Q11287 |
| concepts[21].display_name | Exploit |
| concepts[22].id | https://openalex.org/C11560541 |
| concepts[22].level | 3 |
| concepts[22].score | 0.30975955724716187 |
| concepts[22].wikidata | https://www.wikidata.org/wiki/Q1756025 |
| concepts[22].display_name | Replay attack |
| concepts[23].id | https://openalex.org/C38369872 |
| concepts[23].level | 2 |
| concepts[23].score | 0.3045496642589569 |
| concepts[23].wikidata | https://www.wikidata.org/wiki/Q7445009 |
| concepts[23].display_name | Security analysis |
| concepts[24].id | https://openalex.org/C527821871 |
| concepts[24].level | 2 |
| concepts[24].score | 0.2931791841983795 |
| concepts[24].wikidata | https://www.wikidata.org/wiki/Q228502 |
| concepts[24].display_name | Access control |
| concepts[25].id | https://openalex.org/C2776436953 |
| concepts[25].level | 2 |
| concepts[25].score | 0.28292468190193176 |
| concepts[25].wikidata | https://www.wikidata.org/wiki/Q5163215 |
| concepts[25].display_name | Consistency (knowledge bases) |
| concepts[26].id | https://openalex.org/C165609540 |
| concepts[26].level | 2 |
| concepts[26].score | 0.28236982226371765 |
| concepts[26].wikidata | https://www.wikidata.org/wiki/Q1172486 |
| concepts[26].display_name | Data breach |
| concepts[27].id | https://openalex.org/C178489894 |
| concepts[27].level | 2 |
| concepts[27].score | 0.27763861417770386 |
| concepts[27].wikidata | https://www.wikidata.org/wiki/Q8789 |
| concepts[27].display_name | Cryptography |
| concepts[28].id | https://openalex.org/C121822524 |
| concepts[28].level | 2 |
| concepts[28].score | 0.2688960134983063 |
| concepts[28].wikidata | https://www.wikidata.org/wiki/Q5157582 |
| concepts[28].display_name | Computer security model |
| concepts[29].id | https://openalex.org/C2778012447 |
| concepts[29].level | 2 |
| concepts[29].score | 0.26865118741989136 |
| concepts[29].wikidata | https://www.wikidata.org/wiki/Q1034415 |
| concepts[29].display_name | Scope (computer science) |
| concepts[30].id | https://openalex.org/C184842701 |
| concepts[30].level | 3 |
| concepts[30].score | 0.2612012028694153 |
| concepts[30].wikidata | https://www.wikidata.org/wiki/Q370563 |
| concepts[30].display_name | Cloud computing security |
| concepts[31].id | https://openalex.org/C84511453 |
| concepts[31].level | 3 |
| concepts[31].score | 0.2503664195537567 |
| concepts[31].wikidata | https://www.wikidata.org/wiki/Q2914952 |
| concepts[31].display_name | Concurrency control |
| keywords[0].id | https://openalex.org/keywords/rollback |
| keywords[0].score | 0.910797655582428 |
| keywords[0].display_name | Rollback |
| keywords[1].id | https://openalex.org/keywords/cloud-computing |
| keywords[1].score | 0.6398501396179199 |
| keywords[1].display_name | Cloud computing |
| keywords[2].id | https://openalex.org/keywords/database-transaction |
| keywords[2].score | 0.5211594104766846 |
| keywords[2].display_name | Database transaction |
| keywords[3].id | https://openalex.org/keywords/key |
| keywords[3].score | 0.5107273459434509 |
| keywords[3].display_name | Key (lock) |
| keywords[4].id | https://openalex.org/keywords/confidentiality |
| keywords[4].score | 0.4954586327075958 |
| keywords[4].display_name | Confidentiality |
| keywords[5].id | https://openalex.org/keywords/atomicity |
| keywords[5].score | 0.47177815437316895 |
| keywords[5].display_name | Atomicity |
| keywords[6].id | https://openalex.org/keywords/software-deployment |
| keywords[6].score | 0.46960872411727905 |
| keywords[6].display_name | Software deployment |
| keywords[7].id | https://openalex.org/keywords/state |
| keywords[7].score | 0.46814659237861633 |
| keywords[7].display_name | State (computer science) |
| keywords[8].id | https://openalex.org/keywords/workflow |
| keywords[8].score | 0.44917723536491394 |
| keywords[8].display_name | Workflow |
| keywords[9].id | https://openalex.org/keywords/firewall |
| keywords[9].score | 0.41323748230934143 |
| keywords[9].display_name | Firewall (physics) |
| language | |
| locations[0].id | doi:10.48550/arxiv.2511.13641 |
| locations[0].is_oa | True |
| locations[0].source.id | https://openalex.org/S4306400194 |
| locations[0].source.issn | |
| locations[0].source.type | repository |
| locations[0].source.is_oa | True |
| locations[0].source.issn_l | |
| locations[0].source.is_core | False |
| locations[0].source.is_in_doaj | False |
| locations[0].source.display_name | arXiv (Cornell University) |
| locations[0].source.host_organization | https://openalex.org/I205783295 |
| locations[0].source.host_organization_name | Cornell University |
| locations[0].source.host_organization_lineage | https://openalex.org/I205783295 |
| locations[0].license | |
| locations[0].pdf_url | |
| locations[0].version | |
| locations[0].raw_type | article |
| locations[0].license_id | |
| locations[0].is_accepted | False |
| locations[0].is_published | |
| locations[0].raw_source_name | |
| locations[0].landing_page_url | https://doi.org/10.48550/arxiv.2511.13641 |
| indexed_in | datacite |
| authorships[0].author.id | https://openalex.org/A4223544296 |
| authorships[0].author.orcid | |
| authorships[0].author.display_name | Burke, Quinn |
| authorships[0].author_position | first |
| authorships[0].raw_author_name | Burke, Quinn |
| authorships[0].is_corresponding | True |
| authorships[1].author.id | https://openalex.org/A4301440262 |
| authorships[1].author.orcid | |
| authorships[1].author.display_name | Vahldiek-Oberwagner, Anjo |
| authorships[1].author_position | middle |
| authorships[1].raw_author_name | Vahldiek-Oberwagner, Anjo |
| authorships[1].is_corresponding | False |
| authorships[2].author.id | https://openalex.org/A4288032107 |
| authorships[2].author.orcid | |
| authorships[2].author.display_name | Swift, Michael |
| authorships[2].author_position | middle |
| authorships[2].raw_author_name | Swift, Michael |
| authorships[2].is_corresponding | False |
| authorships[3].author.id | https://openalex.org/A2742447175 |
| authorships[3].author.orcid | |
| authorships[3].author.display_name | McDaniel, Patrick |
| authorships[3].author_position | last |
| authorships[3].raw_author_name | McDaniel, Patrick |
| authorships[3].is_corresponding | False |
| has_content.pdf | False |
| has_content.grobid_xml | False |
| is_paratext | False |
| open_access.is_oa | True |
| open_access.oa_url | https://doi.org/10.48550/arxiv.2511.13641 |
| open_access.oa_status | green |
| open_access.any_repository_has_fulltext | False |
| created_date | 2025-11-19T00:00:00 |
| display_name | It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications |
| has_fulltext | False |
| is_retracted | False |
| updated_date | 2025-11-19T23:39:43.309859 |
| primary_topic | |
| cited_by_count | 0 |
| locations_count | 1 |
| best_oa_location.id | doi:10.48550/arxiv.2511.13641 |
| best_oa_location.is_oa | True |
| best_oa_location.source.id | https://openalex.org/S4306400194 |
| best_oa_location.source.issn | |
| best_oa_location.source.type | repository |
| best_oa_location.source.is_oa | True |
| best_oa_location.source.issn_l | |
| best_oa_location.source.is_core | False |
| best_oa_location.source.is_in_doaj | False |
| best_oa_location.source.display_name | arXiv (Cornell University) |
| best_oa_location.source.host_organization | https://openalex.org/I205783295 |
| best_oa_location.source.host_organization_name | Cornell University |
| best_oa_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| best_oa_location.license | |
| best_oa_location.pdf_url | |
| best_oa_location.version | |
| best_oa_location.raw_type | article |
| best_oa_location.license_id | |
| best_oa_location.is_accepted | False |
| best_oa_location.is_published | False |
| best_oa_location.raw_source_name | |
| best_oa_location.landing_page_url | https://doi.org/10.48550/arxiv.2511.13641 |
| primary_location.id | doi:10.48550/arxiv.2511.13641 |
| primary_location.is_oa | True |
| primary_location.source.id | https://openalex.org/S4306400194 |
| primary_location.source.issn | |
| primary_location.source.type | repository |
| primary_location.source.is_oa | True |
| primary_location.source.issn_l | |
| primary_location.source.is_core | False |
| primary_location.source.is_in_doaj | False |
| primary_location.source.display_name | arXiv (Cornell University) |
| primary_location.source.host_organization | https://openalex.org/I205783295 |
| primary_location.source.host_organization_name | Cornell University |
| primary_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| primary_location.license | |
| primary_location.pdf_url | |
| primary_location.version | |
| primary_location.raw_type | article |
| primary_location.license_id | |
| primary_location.is_accepted | False |
| primary_location.is_published | False |
| primary_location.raw_source_name | |
| primary_location.landing_page_url | https://doi.org/10.48550/arxiv.2511.13641 |
| publication_date | 2025-11-17 |
| publication_year | 2025 |
| referenced_works_count | 0 |
| abstract_inverted_index.a | 63, 86, 105 |
| abstract_inverted_index.-- | 128, 136 |
| abstract_inverted_index.CI | 135 |
| abstract_inverted_index.We | 60, 115 |
| abstract_inverted_index.an | 15, 124 |
| abstract_inverted_index.as | 45 |
| abstract_inverted_index.by | 8, 29 |
| abstract_inverted_index.in | 133 |
| abstract_inverted_index.is | 85 |
| abstract_inverted_index.it | 138 |
| abstract_inverted_index.of | 76, 98 |
| abstract_inverted_index.or | 58 |
| abstract_inverted_index.to | 19, 83, 111 |
| abstract_inverted_index.Key | 82 |
| abstract_inverted_index.all | 43 |
| abstract_inverted_index.and | 1, 47, 80, 101, 103, 113, 121, 145 |
| abstract_inverted_index.but | 39 |
| abstract_inverted_index.for | 53 |
| abstract_inverted_index.log | 107 |
| abstract_inverted_index.low | 150 |
| abstract_inverted_index.raw | 146 |
| abstract_inverted_index.yet | 11 |
| abstract_inverted_index.case | 126 |
| abstract_inverted_index.data | 13, 147 |
| abstract_inverted_index.from | 56 |
| abstract_inverted_index.over | 142 |
| abstract_inverted_index.show | 122 |
| abstract_inverted_index.that | 67, 89, 108, 137 |
| abstract_inverted_index.they | 40 |
| abstract_inverted_index.thus | 48 |
| abstract_inverted_index.used | 52 |
| abstract_inverted_index.with | 36, 129, 149 |
| abstract_inverted_index.Prior | 23 |
| abstract_inverted_index.cloud | 5 |
| abstract_inverted_index.data. | 81 |
| abstract_inverted_index.emits | 104 |
| abstract_inverted_index.prove | 117 |
| abstract_inverted_index.stale | 12 |
| abstract_inverted_index.state | 32, 91, 99 |
| abstract_inverted_index.study | 127 |
| abstract_inverted_index.these | 27 |
| abstract_inverted_index.treat | 42 |
| abstract_inverted_index.while | 71 |
| abstract_inverted_index.(state | 34 |
| abstract_inverted_index.GitLab | 134 |
| abstract_inverted_index.Replay | 0 |
| abstract_inverted_index.robust | 140 |
| abstract_inverted_index.Rebound | 84 |
| abstract_inverted_index.attacks | 3, 28 |
| abstract_inverted_index.binary, | 143 |
| abstract_inverted_index.control | 141 |
| abstract_inverted_index.enables | 139 |
| abstract_inverted_index.monitor | 88 |
| abstract_inverted_index.policy, | 95 |
| abstract_inverted_index.present | 61 |
| abstract_inverted_index.storage | 17 |
| abstract_inverted_index.through | 14, 123 |
| abstract_inverted_index.updates | 100 |
| abstract_inverted_index.Rebound, | 62 |
| abstract_inverted_index.enabling | 72 |
| abstract_inverted_index.enforces | 93 |
| abstract_inverted_index.formally | 116 |
| abstract_inverted_index.mediates | 90 |
| abstract_inverted_index.mitigate | 26 |
| abstract_inverted_index.preclude | 49 |
| abstract_inverted_index.provides | 109 |
| abstract_inverted_index.recovery | 55 |
| abstract_inverted_index.rollback | 2, 44, 69 |
| abstract_inverted_index.security | 24, 65, 119 |
| abstract_inverted_index.software | 130 |
| abstract_inverted_index.threaten | 4 |
| abstract_inverted_index.Rebound's | 118 |
| abstract_inverted_index.atomicity | 97 |
| abstract_inverted_index.auditors. | 114 |
| abstract_inverted_index.authentic | 10 |
| abstract_inverted_index.binaries, | 78 |
| abstract_inverted_index.enforcing | 30 |
| abstract_inverted_index.framework | 66 |
| abstract_inverted_index.integrity | 7 |
| abstract_inverted_index.interface | 18 |
| abstract_inverted_index.malicious | 46 |
| abstract_inverted_index.overhead. | 152 |
| abstract_inverted_index.preserves | 68 |
| abstract_inverted_index.reference | 87 |
| abstract_inverted_index.rollbacks | 51, 75 |
| abstract_inverted_index.untrusted | 16 |
| abstract_inverted_index.workflows | 132 |
| abstract_inverted_index.compromise | 20 |
| abstract_inverted_index.corruption | 57 |
| abstract_inverted_index.deployment | 131 |
| abstract_inverted_index.end-to-end | 151 |
| abstract_inverted_index.frameworks | 25 |
| abstract_inverted_index.guarantees | 96 |
| abstract_inverted_index.legitimate | 50, 74 |
| abstract_inverted_index.properties | 120 |
| abstract_inverted_index.protection | 70 |
| abstract_inverted_index.rollbacks, | 102 |
| abstract_inverted_index.versioning | 148 |
| abstract_inverted_index.application | 6, 21, 77, 125 |
| abstract_inverted_index.continuity) | 35 |
| abstract_inverted_index.mechanisms, | 38 |
| abstract_inverted_index.operational | 54 |
| abstract_inverted_index.transitions | 33 |
| abstract_inverted_index.applications | 112 |
| abstract_inverted_index.forward-only | 31 |
| abstract_inverted_index.transitions, | 92 |
| abstract_inverted_index.transparency | 110 |
| abstract_inverted_index.authorization | 94 |
| abstract_inverted_index.categorically | 41 |
| abstract_inverted_index.reintroducing | 9 |
| abstract_inverted_index.configuration, | 79, 144 |
| abstract_inverted_index.tamper-evident | 106 |
| abstract_inverted_index.general-purpose | 64 |
| abstract_inverted_index.hardware-backed | 37 |
| abstract_inverted_index.decision-making. | 22 |
| abstract_inverted_index.misconfiguration. | 59 |
| abstract_inverted_index.policy-authorized | 73 |
| cited_by_percentile_year | |
| countries_distinct_count | 0 |
| institutions_distinct_count | 4 |
| citation_normalized_percentile |