During RP1, ELASTIC has delivered a range of innovations that extend the state of the art in secure orchestration across the cloud–edge–IoT continuum. In WP1, advances were achieved in Wasm and eBPF security, including stack smashing protection for LLVM, an eBPF static analyser, and a novel traffic capture tool capable of intercepting encrypted service mesh traffic. A hardware-accelerated intrusion detection system was integrated with this capability, while a reliable migration protocol based on fair exchange was designed. In addition, wacky, a new tool for inserting shims over Wasm interfaces, was introduced.
In WP2, two open-source frameworks for WebAssembly orchestration were released: Propeller, which has already gathered 8 forks and 24 stars, and the wasm-operator, with 5 forks and 54 stars, showing strong early community uptake. ELASTIC partners also contributed new WASI proposals (USB, I2C) that were voted into effect by the W3C with strong support from the ByteCode Alliance and industrial stakeholders such as Siemens, Collins Aerospace, and Sony. Complementary research produced recommendations on serverless repository security and initial methods for fingerprinting confidential WebAssembly applications.
In WP3, a TEE hardware abstraction layer (HAL) was developed to provide platform-agnostic support for WebAssembly workloads. Multi-platform attestation and verification were implemented for Wasm components, complemented by cross-TEE attestation mechanisms that enable secure trust establishment for serverless applications deployed across heterogeneous cloud environments.
In WP4, ELASTIC introduced a new WASI proposal for GPIO, enabling secure communication between WebAssembly applications and sensors or actuators. eBPF was integrated with AI-IDS on the Pynq-Z1, demonstrating an AI-enhanced, hardware-accelerated intrusion detection system capable of achieving low latency and resource efficiency on constrained edge devices. Furthermore, the open-source IoT gateway platform “S0” was developed on ESP32-C6 with Zephyr RTOS and WAMR, combining Wi-Fi, BLE, and hardware-backed TEE support to provide a flexible platform for prototyping secure edge workloads.
Beyond the results of individual work packages, ELASTIC introduces a set of cross-cutting innovations that position the project beyond the state of the art. These include seamless access to TEE functionalities through a Wasm HAL, lightweight orchestration frameworks optimised for constrained edge devices, and new mechanisms for remote attestation, secure workload migration, and adaptive access control across heterogeneous environments. The project also advances low-latency serverless Wasm orchestration agents, a Wasm-based Federated Learning Toolbox for secure and traceable AI at the edge, early eBPF vulnerability detection methods, and microservices acceleration combining eBPF and RDMA.
