# A Survey of Secure Computation Using Trusted Execution Environments

Xiaoguo Li  0000-0001-6496-7454 Singapore Management University81 Victoria
St.SingaporeSingapore188065<EMAIL_ADDRESS>,  Bowen Zhao
0000-0001-9864-9729 Xidian UniversityGuangzhouChina510555<EMAIL_ADDRESS>,
Guomin Yang  0000-0002-4949-7738 Singapore Management
UniversitySingaporeSingapore188065<EMAIL_ADDRESS>,  Tao Xiang
0000-0002-9439-4623 Chongqing UniversityChongqingChina400044<EMAIL_ADDRESS>,  Jian Weng  0000-0002-7933-9941 Jinan UniversityGuangzhouChina510632
<EMAIL_ADDRESS>and  Robert H. Deng  0000-0003-3491-8146 Singapore
Management UniversitySingaporeSingapore188065<EMAIL_ADDRESS>
(2018)

###### Abstract.

As an essential technology underpinning trusted computing, the trusted
execution environment (TEE) allows one to launch computation tasks on both on-
and off-premises data while assuring confidentiality and integrity. This
article provides a systematic review and comparison of TEE-based secure
computation protocols. We first propose a taxonomy that classifies secure
computation protocols into three major categories, namely secure outsourced
computation, secure distributed computation and secure multi-party
computation. To enable a fair comparison of these protocols, we also present
comprehensive assessment criteria with respect to four aspects: setting,
methodology, security and performance. Based on these criteria, we review,
discuss and compare the state-of-the-art TEE-based secure computation
protocols for both general-purpose computation functions and special-purpose
ones, such as privacy-preserving machine learning and encrypted database
queries. To the best of our knowledge, this article is the first survey to
review TEE-based secure computation protocols and the comprehensive comparison
can serve as a guideline for selecting suitable protocols for deployment in
practice. Finally, we also discuss several future research directions and
challenges.

trusted computing, trusted execution environment, security computation,
federated learning

††copyright: acmcopyright††journalyear: 20XX††doi: XXXXXXX.XXXXXXX††journal:
CSUR††journalvolume: 37††journalnumber: 4††article: 111††publicationmonth:
8††ccs: Security and privacy Tamper-proof and tamper-resistant designs††ccs:
Security and privacy Trust frameworks††ccs: Security and privacy Privacy-
preserving protocols††ccs: Security and privacy Management and querying of
encrypted data

##  1\. Introduction

The popularity of data-driven analytics has brought exponential data volume
growth, especially in the Internet of Things (IoT) era. There will be
approximately 572 zettabytes of data produced by 2030 (Balnojan, 2020), which
is about 30 times that of today. Accompanying the rapid data growth is the
continuously evolving computing technologies for performing complex analytical
tasks over huge-scale data. To eliminate the burden and cost of deploying and
maintaining a high-performance computing infrastructure, many organizations
resort to cloud services nowadays. Nonetheless, under such an off-premises
computing model, a cloud server may extract valuable or sensitive information
for its own benefit, which could damage the interests of the data owners.
Moreover, in computation tasks involving multiple data sources, protecting the
interest of each data owner is also an essential requirement. As a general
terminology, secure computation refers to technologies that can ensure data
privacy and/or integrity throughout the whole computation.

In general, the existing secure computation frameworks mainly target
evaluating a function over encrypted or obfuscated inputs. Its actual form
depends on the computation task and setting. For example, in a multi-party
setting, secure computation allows multiple parties with private inputs to
evaluate a joint function based on all private inputs, such as a statistical
function in a voting scenario or a sorting function in an auction scenario.
During the computation, it is necessary to ensure the privacy of each
individual input as well as the correctness/integrity of the output. In the
outsourced computation setting, secure computation allows a client (or
clients) to outsource computation tasks, which could involve sensitive data,
to an untrusted cloud server. The main challenge of secure computation is: How
can we securely and efficiently evaluate functions on private inputs in the
presence of untrusted or malicious parties participating in the computation?

Cryptographic Approaches for Secure Computation. In the past four decades,
many cryptographic primitives and protocols have been proposed to address
secure computation problems. Following Yao’s garbled circuits (GC, (Yao,
1986)) and GMW’s scheme (Goldreich et al., 1987) since the 1980s, enormous
efforts have been put to improve security and efficiency in secure multi-party
computation. For example, the cut-and-choose mechanism (Lindell and Pinkas,
2007) extended Yao’s protocol against malicious adversaries, and dual
execution (Kolesnikov and Kumaresan, 2013) improved GMW’s scheme to achieve
stronger security. Other examples of cryptographic primitives for secure
computation include Oblivious RAM (ORAM, (Goldreich and Ostrovsky, 1996;
Stefanov et al., 2018)), homomorphic encryption (HE, (Gentry, 2009)), and
secret sharing (SS, (Shamir, 1979)). ORAM-based approaches (Wang et al., 2014;
Liu et al., 2014; Doerner and Shelat, 2017) build shared ORAM, and then data
privacy is achieved by multiple rounds of interactions between the CPU and the
shared memory. Since all these interactions are encrypted and the shared ORAM
re-encrypts and shuffles the data whenever it is accessed, low efficiency
becomes a major drawback. HE-based solutions (Damgård et al., 2012, 2013)
allow computation on ciphertexts directly, however some of them (PHE
(Paillier, 1999), SWHE (Damgård et al., 2012, 2013)) cannot support arbitrary
computation, whereas others (e.g., FHE (Gentry, 2009)) are still impractical
because of the extensive computation cost. SS-based solutions (Cramer et al.,
2000; Halpern and Teague, 2004) split a secret into multiple shares and then
distribute them among two or more players. With the shares, one can
reconstruct the original secret from them (e.g., by Lagrangian interpolation).
In recent years, secret sharing has shown its superiority and serves as an
essential component in several mixed frameworks for secure computation, such
as ABY (Demmler et al., 2015) and ABY2.0 (Patra et al., 2021).

Yet, the aforementioned cryptographic approaches are still not widely adopted
due to their strong trust assumptions or extensive computation and
communication overhead, especially when dealing with complex computation tasks
or large datasets. Many approaches (e.g., (Cramer et al., 2000; Damgård et
al., 2012; Veugen et al., 2015; Patra et al., 2021; Zhao et al., 2022)) assume
the involved parties are semi-honest, meaning those parties, despite being
curious about others’ private inputs, would follow the protocol steps
honestly. Such an assumption does not hold in many application domains where
parties have incentive to gain more benefits or advantages over their
competitors by deviating from the protocol specification. On the other hand,
defending malicious parties using pure crypto-based solutions introduces a
large overhead. We note that secure computation protocols that work in the
semi-honest setting can be converted to defend malicious participants (e.g.,
(Lindell and Pinkas, 2007; Kreuter et al., 2012; Benhamouda et al., 2015)),
but with extensive computation and communication costs.

TEE-based Secure Computation. Today’s growing awareness of Trusted Execution
Environment (TEE (Platform, 2013)) has attracted many interests to explore
alternative ways to build practical general/special-purpose secure computation
protocols. Thanks to the trusted hardware, TEE-based secure computation
protocols are shown to be more efficient than the traditional crypto-based
approaches while offering both confidentiality and integrity guarantees.
Therefore, TEE serves as a promising technology to enable practical and
scalable secure computation for real applications. This article reviews and
compares the state-of-the-art TEE-based secure computation protocols and
discusses the remaining challenges, open problems and future research
directions.

###  1.1. Background of Trusted Execution Environment

TEE provides an isolated environment (called secure enclave 111In the rest of
this survey, we use the terms ‘TEE’ and ‘enclave’ interchangeably) that
safeguards processed data by encrypting the incoming and outgoing data.
Furthermore, TEE provides mechanisms to ensure the computation is correctly
executed with an integrity guarantee. More importantly, TEE protects the data
and computation against any potentially malicious entity residing in the
system (including the kernel, hypervisor, etc.). Thus, TEE-based secure
computation has attracted numerous researchers from academia and industrial
communities in the last two decades (Lie et al., 2000; Champagne and Lee,
2010; Anati et al., 2013; McKeen et al., 2013; Maas et al., 2013; Costan et
al., 2016) because of three appealing features.

  * •

General purpose computation. The supported functions executed in TEE are
usually denoted as user-defined programs; thus, it permits a broad spectrum of
functions.

  * •

Integrity and privacy. TEE provides guarantees of integrity as well as
confidentiality. Confidentiality means the attackers cannot obtain sensitive
information from the computation, and integrity ensures that the program
executes correctly.

  * •

High performance. TEE computes the user-defined programs by decrypting all
encrypted inputs in enclaves and executing the program on plaintext.
Therefore, it enjoys the CPU speed performance, except the overhead for
handling the encrypted inputs.

According to the design, current TEE can be classified into two categories:
(1) TEE without a secure counter just supports simple stateless functions
(e.g., smart cards (Smartcard, 1988; Poulsen, 2001)) and (2) TEE with a secure
counter supports complex stateful functions. In recent years, many TEE designs
focus on the latter such as the Trusted Platform Modules (TPM/vTPM) (Sumrall
and Novoa, 2003), Intel TXT (Futral and Greene, 2013), Intel SGX (Costan and
Devadas, 2016), ARM’s TrustZone (Limited, 2009), Sanctum (Costan et al.,
2016), KeyStone (Lee et al., 2020) and AMD SEV (Kaplan et al., 2016). These
designs vary significantly in terms of architectural choices, instruction
sets, implementation details, cryptographic suites, as well as security
features (Pass et al., 2017).

####  1.1.1. Security Mechanisms

TEE exhibits a broad range of security features (Fei et al., 2021) to achieve
confidentiality and integrity of the computation. With these features, TEE has
been adopted widely by complex secure systems (Choi and Butler, 2019). We
present several essential features related to secure computation below.

  * •

Secure boot (Singh et al., 2021). When the host starts, secure boot loads
immutable and verified images into an enclave to ensure a chain of trust among
the enclave images, operating system components, and configurations. Before
the operating system starts, a secure boot ensures the TEE is loaded correctly
and no hosts, even the hypervisor, can tamper with it.

  * •

Attestation (Anati et al., 2013). Attestation establishes trust between an
enclave and another enclave or a remote machine by building a secure channel.
Generally, there are two attestation mechanisms: local attestation and remote
attestation. While two enclaves on the same platform can attest to each other
using local attestation, remote attestation allows a client to authenticate
that its program is configured and executed correctly (i.e., not modified or
tampered with) in a remote server.

  * •

Isolated execution (McKeen et al., 2013). TEE loads user-defined programs into
enclaves and then performs isolated execution for each program. During
execution, sensitive data (including code and data) is maintained in EPCs
(Enclave Page Caches) within the PRM (Processor Reserved Memory), which is
pre-configured in DRAM in bootstrapping phase. The code loaded inside an
enclave can access both non-PRM and PRM memory. On the other hand, external
programs cannot access any data in the PRM memory.

  * •

Sealing (Anati et al., 2013). Sealing is a mechanism to let a TEE securely
persist and retrieve “secrets” on the local disk. Sealing binds the secrets to
a specific enclave identity by a sealing key derived from the CPU hardware.
Using the sealing key, TEE encrypts the enclave’s secrets and stores them on a
local disk. Conversely, TEE retrieves the secrets from the disk by the
unsealing mechanism.

####  1.1.2. Vulnerabilities

Despite its appealing features, TEE is also vulnerable to several attacks, and
the survey in (Fei et al., 2021) discusses these attacks in details. Below we
briefly review two major attacks that would affect secure computation. First,
TEE may suffer from side-channel attacks which could breach data privacy.

  * •

Timing side channel (Gupta et al., 2016). Given different inputs, the running
time of the program in the enclave may be different too. By monitoring the
difference over the execution time, an attacker may derive some sensitive
information about the input, e.g., a secret value reflecting how many times a
loop is executed. To solve this problem, one approach is to ensure the program
loaded into the enclave always takes approximately the same amount of
execution time.

  * •

Memory side channel (Sasy et al., 2017). In some programs, the access pattern
to the non-PRM memory may depend on the enclave’s secret. For example, if the
enclave runs a binary search program, the access pattern is a path from the
root node to a leaf node, which may reveal the real secret. Therefore the
loaded program should remove any correlation between the memory access pattern
and the insider secret.

  * •

Network side channel (Zheng et al., 2017). In a distributed system, network
access patterns (e.g., sorting or hash partitioning) may reveal sensitive
information. Therefore, the network access protocol should also be well-
designed such that no sensitive information can be deduced from the patterns.

Second, TEEs may also be vulnerable to rewind attacks (or replay attacks),
which allows an attacker to actively reset the state of the computation
(Bellare et al., 2001). Note that such attacks may result in catastrophic
consequences for stateful computation, such as limited-attempt password
checking (Skorobogatov, 2016). We cannot always expect the TEE to maintain the
state securely for two reasons. (1) TEE may be stateless in practice. (2) Even
for stateful TEE, the limited protected memory makes it fail to correctly
maintain a large state. Therefore, the designer should be careful and provides
special mechanisms to counter rewind attacks.

###  1.2. Our Contributions

TEE provides a promising hardware-based alternative for achieving secure
computation with a CPU-level performance, and thus bridges the gap between
academic research and industrial adoption of secure computation. Trusted
hardware provides a powerful abstraction for building secure systems and can
be applied to many potential applications, such as machine learning algorithms
(Ohrimenko et al., 2016; Tramèr and Boneh, 2019; Kunkel et al., 2019; Mo et
al., 2020; Ng et al., 2021; Mo et al., 2021), cloud computing (Santos et al.,
2012; Martignoni et al., 2012; Baumann et al., 2015; Schuster et al., 2015;
Tamrakar et al., 2017; Correia et al., 2020), blockchain (Zhang et al., 2016;
Lind et al., 2018; Bentov et al., 2019; Bowe et al., 2020), network traffic
analysis (Duan et al., 2019), scientific computation (Shaon et al., 2017),
data analytics (Zheng et al., 2017; Priebe et al., 2018; Kim et al., 2019;
Zhou et al., 2021; Dave et al., 2020), and privacy-preserving COVID-19 contact
tracing (Kato et al., 2021).

To help readers systemically perceive the core design of TEE-based secure
computation protocols, this article presents a comprehensive survey on the
state of the art of this research field. Our contributions are summarized as
follows:

  * •

First, we propose two taxonomies for TEE-based secure computation protocols
from the computing framework and TEE utilization perspectives. According to
the framework, we categorize secure computation protocols into secure
outsourced computation (SOC), secure distributed computation (SDC), and secure
multiparty computation (SMC). Based on the TEE utilization, the existing
protocols are classified into three categories: (1) pure TEE based protocols,
which use TEE as a black box, (2) TEE with oblivious primitives, which can
prevent side-channel and leakage attacks, and (3) TEE with trusted ledge,
which can resist attacks targeting TEE state.

  * •

Second, comprehensive assessment criteria are presented for the purpose of
evaluating and comparing the existing protocols. The assessment criteria are
made from four dimensions: (1) setting that specifies the computing function
and framework; (2) methodology that describes the TEE utilization method and
the additional crypto-primitives used; (3) security that highlights the
security features of a protocol, such as privacy, integrity, fairness, and
freshness; and (4) performance that shows the experimental configurations and
results.

  * •

Third, comprehensive comparisons among the existing protocols are made in
accordance with the above assessment criteria. Specifically, this article
first compares the existing proposals for general-purpose secure computation.
Then detailed comparisons are made on two specific computational tasks: (1)
machine learning, which consists of training and inference; and (2) encrypted
database queries.

  * •

Lastly, we discuss several future research directions and challenges in the
light of our observations on the state-of-the-art TEE-enabled secure
computation solutions.

This survey also aims to help non-specialists comprehend TEE-enabled secure
computation and assist practitioners to determine appropriate TEE technologies
for system deployment.

##  2\. Taxonomy and Assessment Criteria

This section presents taxonomy and assessment criteria for TEE-based secure
computation in Sec. 2.1 and in Sec. 2.2, respectively.

###  2.1. Taxonomy of TEE-based Secure Computation

(a) Outsourced Framework (b) Distributed Framework

(c) Multi-Party Framework

Figure 1. Three Different Frameworks For Secure Computation

Three Different Frameworks For Secure Computation.

We categorize TEE-based secure computation protocols based on two orthogonal
aspects: the computation framework and the TEE utilization.

Based on the computation framework, we separate TEE-based secure computation
protocols into the following three categories:

  * •

Secure outsourced computation (SOC). Fig. 1(a) shows the framework of SOC, in
which data owners outsource encrypted data to a single cloud server.
Subsequently, an authorized data user will run an SOC protocol with the cloud
server to realize desired computation tasks. In practice, the single cloud is
an untrusted entity, which may behave as a passive/semi-honest attacker or an
active/malicious attacker.

  * •

Secure distributed computation (SDC). Fig. 1(b) shows the framework of SDC, in
which the encrypted data is outsourced to multiple servers. Specifically, one
master node is in charge of coordinating the computational tasks, and several
slave nodes execute the computation in a distributed manner. An SDC protocol
is run between an authorized data user and these server nodes. Specifically,
each slave node calculates an intermediate result, and the master node
responds data user with the final output, which is reconstructed from
intermediate results. The master node and slave nodes may be semi-honest or
malicious. Compared to SOC, the interactions among the servers and the
intermediate results in SDC expose a larger attack surface to attackers.

  * •

Secure multi-party computation (SMC). Fig. 1(c) shows the framework of SMC, in
which data owners jointly run a SMC protocol themselves without losing control
of their data. The difference between SMC and SDC is that SMC does not involve
a master node to coordinate computation tasks. The data owners (also called
parties) participating in the computation don’t trust each other.
Specifically, each party in SMC tries to protect their sensitive information
from other parties who may behave semi-honestly or even maliciously (i.e., by
undermining the protocol).

Based on TEE utilization, i.e., whether it is used alone or in conjunction
with other tools for preventing side-channel or state-related attacks, we can
also categorize the protocols into the following types:

  * •

TEE as a black box. TEE enables general-purpose computation with confidential
and integrity guarantee against eavesdropping adversaries. Because the input
and output are encrypted by an authenticated encryption scheme (e.g., AES-
GCM), the untrusted host cannot learn sensitive information. Many existing
solutions regard TEE as a black box and fall in this category. If a protocol
requires a stateful hardware device, we mark it as “stateful TEE”; otherwise,
we mark is as ”stateless TEE”..

  * •

TEE with oblivious primitives. As mentioned earlier, although a host cannot
directly access TEE’s state, sensitive information may still be leaked via
different side-channels. To prevent such leakage, well-designed oblivious
primitives (OP) (Sasy and Ohrimenko, 2019) and differential obliviousness
(Mazloom and Gordon, 2018; Xu et al., 2018; Allen et al., 2019) are leveraged
to mitigate side-channel attacks from different levels. The resulting
proposals, such as ZeroTrace (Sasy et al., 2017) and ObliJoin(Chang et al.,
2022), not only achieve confidentiality and integrity but also avoid sensitive
information leakage from other channels. The protocols in this category are
labeled as “stateful TEE + OP” or “stateless TEE + OP” for comparison.

  * •

TEE with trusted public ledger. When TEE is deployed on a remote malicious
host, the latter may submit illegal inputs to the enclave. For example rewind
attack in a stateful computation, the host may provide a stale encrypted state
to the enclave, which may lead to catastrophic effects. Therefore a trusted
public ledger (PL) (Kaptchuk et al., 2017) can be introduced to ensure the
legitimacy of inputted state, and the protocols that fall in this category are
labeled as ”stateful TEE + PL” or ”stateless TEE + PL” for comparison.

###  2.2. Assessment Criteria

For a systematic and fair comparison of existing proposals for TEE-based
secure computation, we present the common assessment criteria with respect to
four aspects: setting, methodology, security and performance (shown in Fig.
2). These criteria are applied in the comparison of existing protocols
throughout this survey.

Figure 2. Assessment Criteria

Assessment

####  2.2.1. Setting

Secure computation protocols are designed for different purposes and can
follow different computation frameworks. For achieving a fair comparison, we
distinguish the secure computation setting from two aspects: framework and
function as shown in Fig. 2. The framework specifies the architecture of the
designed protocol, which has been elaborated in Sec. 2.1. The function
represents the primary goal of the protocol, such as a machine learning task
(training or inference), scientific computation (such as matrix multiplication
and polynomial evaluation), data analytics (such as SQL queries and
statistical analysis), or a general-purpose function.

####  2.2.2. Methodology

Methodology describes the design principle of a proposal and will guide
developers to facilitate the practical deployment. We describe the methodology
of TEE-based protocols from two aspects (shown in Fig. 2): TEE utilization and
crypto primitives. The former describes how TEE is used in a protocol (Sec.
2.1) and the latter presents which cryptographic toolkit is leveraged. It is
worth noting that many crypto primitives are employed to deal with the
security issues outside the TEE, such as authenticated encryption, digital
signatures, secret sharing, and zero-knowledge proof. Therefore, we also
highlight crypto primitives in the comparison.

####  2.2.3. Security

Generally, security evaluation consists of two dimensions: security goals and
adversarial models. According to system requirements, different security goals
are defined under different adversarial models. We present the common security
goals and adversarial models as follows.

  * •

Security goals. Security goals define which security requirements should be
achieved in a secure computation protocol. In this article, four types of
security goals are considered: privacy, integrity, fairness, and freshness.
Specifically,

    * –

Privacy. Privacy in secure computation means that sensitive data (including
input, intermediate result, output, or other metadata during computation such
as access pattern) is not visible to potential attackers. Moreover, the
sensitive data may include the concrete queries in privacy-preserving database
queries or model parameters and inference data in privacy-preserving machine
learning. All sensitive information should be safeguarded from being leaked to
any unauthorized party (e.g., a cloud server).

    * –

Integrity. Integrity in secure computation means that no malicious party can
sabotage the protocol execution and produce the wrong output for other
parties. For example, in federated machine learning, a party may launch a
backdoor attack to corrupt the performance of the training model by training
its local model maliciously (Yin et al., 2021).

    * –

Freshness. Freshness in secure computation means that the involved party
cannot leverage stale state or old data for stateful computation. For example,
an adversary may launch a replay attack by re-transmitting stale valid
messages to honest parties, thereby fooling the honest parties. Therefore, any
messages transmitted between the parties should be passed with freshness
checking, which ensures the state or the data is up to date.

    * –

Fairness. Fairness is a natural and desirable security requirement in SMC,
which has shown its importance in auctions, contract signing, payment and
other application scenarios. Fairness ensures that either all parties receive
the protocol output or no one does (Choudhuri et al., 2017). While complete
fairness for general computation is impossible (Cleve, 1986), several possible
and useful fairness solutions have been proposed such as gradual release
(Blum, 1983), probabilistic fairness (Luby et al., 1983), optimistic exchange
(Bao et al., 1998), fairness with penalties (Andrychowicz et al., 2014), and
$\Delta$-fairness (Pass et al., 2017).

  * •

Adversarial models. Adversarial models abstract attackers’ power. In general,
secure computation protocols consider two types of attackers: semi-honest and
malicious. Specifically,

    * –

Semi-honest. A semi-honest adversary, also called honest-but-curious
adversary, is assumed to follow the protocol’s instructions honestly so that
the tasks are conducted and completed correctly. However, the attacker is
curious and tries to learn sensitive information from each step of the
computation.

    * –

Malicious. A malicious adversary is stronger than the semi-honest one since it
can arbitrarily deviate from the prescribed protocol. A malicious adversary
could learn more information about the sensitive data through active attacks
or save computation or storage costs by performing lazy computation and
returning random results to other honest parties.

Besides, formal proof is an important aspect of evaluating security. A formal
abstraction of the secure enclave was introduced in (Pass et al., 2017), which
is also adopted by the subsequent works with formal security analysis, such as
(Choudhuri et al., 2017; Paul and Shrivastava, 2019; Wu et al., 2022). We
present the formal TEE abstraction (also denoted $\mathcal{G}_{att}$) in our
supplementary material (Sec. B).

####  2.2.4. Performance

We present the performance assessment criteria from four aspects: experimental
configuration, costs, accuracy, and open-sourceness, which are elaborated
below. We should note that a fair comparison of secure computation protocols
is not a trivial task, because the performance indicators may be obtained from
different data sets and be exhibited in many different manners. Thus, we are
not able to compare all the protocols under the same experimental
configuration. Instead, we aim to provide a relatively objective comparison
based on the following four aspects.

  * •

Experimental configuration. Experimental configurations are diverse, such as
computer specifications, platforms, workloads, data sets, and network
architectures. Therefore, we will specify the necessary experimental
configurations in the comparison, which would also help readers to understand
the performances in real deployment.

  * •

Costs. The secure computations exhibit their performances in many different
ways, such as complexity estimation without experiments, absolute time
consumption, a percent indicating relative cost, throughput, or others. To be
as unified as possible, we present its baseline in the comparison.
Specifically, the following baselines are considered.

    * –

Plaintext model. The plaintext model means that the function is computed
outside the TEE without any protection, which exhibits exceptionally high
performance. For comparing with the plaintext model, the protocols’
performance will be worse, and we highlight the “slowdown” factor in
comparisons.

    * –

Fully in enclave. The fully in enclave model means that the entire
computational task is completed in the enclave, which may trigger the page
swapping of the TEE and thus results in a large TCB size and worse
performance. A well-designed protocol’s performance will usually be better
than the fully in enclave model, and we highlight the “speedup” factor in
comparisons.

    * –

State of the arts. Some references compare their protocol with the state of
the arts. In comparison, we highlight “slowdown” or “speedup” factors for
degrading or improvement in performance.

  * •

Accuracy. Accuracy is an essential criterion in many machine learning
algorithms. Informally, accuracy is the fraction of predictions the model got
right, and high accuracy is preferred. Accuracy in general secure computation
means that the absolutely correct results should be returned. However,
differential privacy based solutions adds noise perturbations to the results
for meeting specific privacy requirements and thus may not produce absolutely
correct results.

  * •

Open-Sourceness. Last but not least, we also summarize whether an implemented
protocol is open-sourced, which helps other researchers to understand the
proposal better and to check its validity and performance.

###  2.3. Roadmap

Fig. 3 presents the roadmap of this survey. The completed survey consists of
the primary part and additional supplementary material. In the primary part,
TEE-based secure computation protocols for general-purpose function and
machine learning are sequentially reviewed in Sec. 3 and Sec. 4, respectively.
In the supplementary material, we review the TEE-based secure computation
protocols for database queries in Sec. A. In each section, we present problem
statements and research status with regard to different frameworks. For
example, Sec. 3 reviews TEE-based protocols for general-purpose secure
computation. Following the taxonomy presented in Sec. 2.1, we present the SOC,
SDC, and SMC in Sec. 3.1, Sec. 3.2, and Sec. 3.3, respectively. After that, we
provide thorough comparisons in Sec. 3.4 according to assessment criteria
shown in Sec. 2.2. As two important and special research directions in secure
computation, we organize contents for Machine Learning (in Sec. 4) and
Database Queries (in Sec. A) in a similar way as in Sec. 3. Finally,
concluding remarks and future directions are made in Sec. 5.

Figure 3. Taxonomy, Assessment, and Organizations.

Taxonomy and organizations.

##  3\. Secure Computation Using TEEs

In this section, we turn to discuss and compare existing general-purpose
secure computation protocols using TEEs. According to different frameworks, we
successively present secure outsourced computation, secure distributed
computation, and secure multiparty computation.

###  3.1. Secure Outsourced Computation

####  3.1.1. Problem Statement

Secure outsourced computation (SOC) allows a resource-limited client to
outsource a computation task $(\Phi,x)$ to a powerful cloud server, where
$\Phi$ is a function or a program for computation, and $x$ is a sensitive
input. To provide privacy guarantee, the task $(\Phi,x)$ should be encrypted
to $(\llbracket{\Phi}\rrbracket,\llbracket{x}\rrbracket)$ and the cloud server
finishes the computation in encrypted domain,
$(\llbracket{y}\rrbracket,\Gamma)=\text{SOC}(\llbracket{\Phi}\rrbracket,\llbracket{x}\rrbracket)$,
where $\llbracket{y}\rrbracket$ is encrypted output and $\Gamma$ is the proof
for checking the integrity of execution. Upon receiving
$\llbracket{y}\rrbracket$, the client decrypts it to the final output $y$. The
consistency of SOC means that the final output $y=\Phi(x)$. The privacy  means
that the cloud server cannot learn any sensitive information about $\Phi$
(function privacy), $x$ (input privacy), or $y$ (output privacy). The
integrity means that the server correctly executes the task $(\Phi,x)$.

Shan et al. (Shan et al., 2018) surveyed the non-TEE approaches for SOC, such
as fully homomorphic encryption, additive homomorphic encryption, random
transformation, secret sharing, etc. Since the arising of trusted hardware,
the TEE-based methods received a lot of attentions due to its high
performance. As shown in Fig. 4, we provide the basic SOC workflow to explain
the interactions between a client and a TEE-equipped server. The client builds
a secure channel between the enclave by remote attestation, after which four
steps are followed. (1) The client loads the program $\Phi$ into the enclave,
and (2) The enclave responds with a triple $(b,\Phi,\Gamma_{1})$, in which
$\Gamma_{1}$ proves the program is loaded successfully ($b=1$); otherwise,
$b=0$ and $\Gamma_{1}=\bot$. (3) The client submits an input $x$ to the
enclave. (4) The enclave returns the final results $(y,\Gamma_{2})$, in which
$y=\Phi(x)$ and $\Gamma_{2}$ proves the program is executed honestly. Note
that all messages between client and enclave are sent to each other over the
secure channel.

Figure 4. Secure Outsourced Computation

Assessment

####  3.1.2. Research Status

In (Barbosa et al., 2016), Barbosa et al. presented the notion attested
computation, which focuses on integrity assurance by building a secure channel
via key exchange. With their proposed utility theorem, they presented the
first SOC framework using trusted hardware, which also offers formal security
analysis by simulation-based proof. Another formal treatment for TEE-based SOC
is the symbolic model (Jacomme et al., 2017; Subramanyan et al., 2017), which
aims to design secure remote attestation execution protocols. To against side-
channel attacks, ObliCheck (Son et al., 2021) employs symbolic execution to
check whether all execution paths exhibit the same observable behavior. In
(Pass et al., 2017), Pass et al. presented the formal abstractions and
rigorous exploration of TEE and offered a TEE-based stateful obfuscation to
show the power of attested execution. Then, for the first time, they described
the basic $\mathcal{G}_{att}$ abstraction (Sec. B in supplementary material)
capturing the essence of TEE. After that, Pass et al. employed the abstraction
to design an SOC protocol, which was proved to be UC-secure in
$\mathcal{G}_{att}$-hybrid model. Following (Pass et al., 2017), many works in
hardware-supported secure computation protocols were formally treated and
proved to be UC-secure by employing $\mathcal{G}_{att}$ abstraction (e.g., (Wu
et al., 2022)).

To mitigate rewind attack, a public ledger (PL) served as a trusted data
source is utilized to ensure the TEE state freshness while computing a
stateful function (Kaptchuk et al., 2017). The authors proposed a hybrid
computing framework in which each input is registered from the public ledger.
The public ledger signs the inputs by a signature scheme, and then the enclave
checks the freshness of the state according to the public ledger before
executing the general function computation. Therefore, it achieves stateful,
interactive functionality, even on devices without persistent storage (such as
mobile devices).

The fairness in SOC is different from the one in SMC. In (Dang et al., 2019),
Dang et al. explored the fair exchange in a marketplace for secure outsourced
computation. In the market, the client first commits a remuneration and then
submits a computational task to computing nodes. The computing nodes get the
remuneration if the task is completed successfully. To achieve the goals, the
authors proposed a framework Kosto, which introduced a third party (called a
broker) to assist the clients in attesting correct instantiation of the
enclaves and computing nodes’ certain commission fees.

###  3.2. Secure Distributed Computation

####  3.2.1. Problem Statement

Secure distributed computation (SOC) is run between a master node and multiple
slave nodes. Generally, each slave node computes an intermediate result over
its inputs, and then the master node aggregates all intermediates into the
final results. Specifically, the task $(\Phi,x)$ is split into many sub-
computational tasks $(\Psi,x_{i})$, $i=\\{1,2,\cdots,N\\}$ and an aggregation
task $\Pi$ such that

(1) $\Phi(x)=\Pi\left(\Psi(x_{1}),\Psi(x_{2}),\cdots,\Psi(x_{N})\right)$

Each slave node runs a sub-computational task, and the master node takes
charge of the aggregation task. According to different secure computation
protocols, the algorithms $\Psi$ and $\Pi$ may work interactively. Note that
privacy and integrity also should be achieved in an SDC protocol.

Shyuan et al. (Ng et al., 2020) surveyed the non-TEE approaches for SDC, such
as linear secret sharing, homomorphic encryption, and random transformation,
etc. These solutions may be used on different platforms such as MapReduce and
Spark. Unlike the above approaches, we survey the hardware-supported
technologies for SDC protocols. As shown in Fig. 5, we provide the basic SDC
workflow to explain the interactions between the master node and multiple
slave nodes. (1) The client builds secure channel with servers (including
master and slave nodes) via remote attestation, and then ensures distributed
program $\Psi$ and aggregation program $\Pi$ are successfully loaded into the
slave nodes’ enclave and the master node’s enclave, respectively. (2) The
client submits an input $x$ to the master node. (3) The master node splits the
inputs $x$ into $x_{1},x_{2},\cdots,x_{N}$ and then distributes $x_{i}$ to
$i$-th slaves. (4) Each slave node finishes the sub-computational tasks in TEE
and responds to the master node with a tuple
$\left(\Psi(x_{i}),\Gamma_{i}\right)$, in which $\Psi(x_{i})$is the $i$-th
intermediate result and $\Gamma_{i}$ proves slave node executes the program
$\Psi$ honestly. (5) Finally, the master node aggregates all intermediate
results by $\Pi$ and then sends the final results $(y,\Gamma)$ to the client,
in which $\Gamma$ proves the program $\Pi$ is honestly executed. Note that all
messages among the entities are exchanged over the secure channel.

Figure 5. Secure Distributed Computation

Assessment

####  3.2.2. Research Status

In (Schuster et al., 2015), a TEE-based framework VC3 for secure distributed
computation in the cloud was proposed by Schuster et al. VC3 enables users to
finish computations in the distributed MapReduce setting while maintaining the
confidentiality of data and ensuring the accuracy and completeness of the
final results. VC3 does not modify the original Hadoop and thus maintains
compatibility with Hadoop. In the design of VC3, the trusted computing base
(TCB) excludes the operating system and the hypervisor; therefore, it achieves
confidentiality and integrity even if the host is corrupted. Relying on the
well-designed safe r/w operators inside the enclave to unsafe memory, VC3
facilitates the deployment of new SDC protocols under the MapReduce platform.
However, it does not solve the access pattern leakage and does not support
multi-user key exchange, which may result in huge overhead in the remote
attestation. On top of VC3, Ohrimenko et al. in (Ohrimenko et al., 2015)
observed that intermediate traffic might leak sensitive information by
employing geographical data as the motivating example. They proposed a
mechanism to hide the correlation between the map function and the reduce
function against a Map-Reduce game and then prove security by a heuristic
method.

To overcome the limited memory of TEEs, an ORAM controller is installed
insider the TEE and an ORAM storage is arranged in external memory or disk. By
contrast, M2R proposed in (Dinh et al., 2015) focuses on resisting the side-
channel attacks in SDC where each unit is equipped with trusted hardware. M2R
allows adversaries to obtain channel information and launch passive attacks
(dataflow patterns, order of execution, time of access) and active attacks
(tuple tampering, misrouting tuples). While expensive ORAM introduces a
multiplication factor $O(\log{N})$ overhead to the latency, M2R incurs only an
additive logarithmic factor by grouping then shuffling technique, which
employs the shuffler in the MapReduce platform directly without degrading
privacy. However, all the above schemes only work on small-scale data (e.g.,
1-5GB).

To build a UC-secure SDC protocol, ObliDC (Wu et al., 2019) is an SGX-based
framework that introduces the ODC-privacy to capture the privacy leakage in
the entire life circle, which is modeled as a data-flow graph. Specifically,
it decomposes the distributed computing into four phases: job deployment, job
initialization, job execution, and results return, and for each step, a UC-
secure two-party protocol was designed to meet ODC privacy. It is worth
mentioning that obliDC achieves both semantic security and oblivious traffic
even if the adversaries are malicious. Furthermore, ObliDC supports any
general-purpose computation by defining the sensitive C-style code to be run
in an enclave.

###  3.3. Secure Multiparty Computation

####  3.3.1. Problem Statement

Secure multiparty computation (SMC) is aimed at computing a joint task among a
number of distinct yet connected parties while revealing nothing but the
output. Specifically, assume each participant has an input $x$. In SMC
protocol for a task $\Phi$, the correctness means that
$\Phi(x_{1},x_{2},\cdots,x_{n})$ is computed correctly, and the privacy means
that the execution of the protocol only reveals the final result to each
party. Integrity ensures that all parties follow the protocol steps honestly.
Some applications may enforce the SMC to be fair, which means that malicious
parties receive the outputs if and only if other honest parties also receive
their outputs. SMC has shown its importance in many application domains, such
as privacy-preserving biding, private DNA comparison, privacy-preserving
machine learning, etc.

Choi et al. (Choi and Butler, 2019) surveyed the non-TEE approaches for SMC.
Since Yao’s Garbled Circuits (Yao, 1986), many researchers have targeted
designing a secure and efficient SMC protocol. Nevertheless, the solution is
still impractical because of the huge communication or extensive computational
cost. Many existing non-hardware solutions focus on improving efficiency, such
as Sharemind (Bogdanov et al., 2008), VMCrypt (Malka, 2011), ABY (Demmler et
al., 2015), SPDZ (Damgård et al., 2012), HyCC (Büscher et al., 2018), etc.
Most of them rely on the primitives such as GC-OT, GMW, FHE, Secret Sharing,
ORAM, etc. In this survey, we review the approaches relying on TEE.

Secure two-party computation workflow is presented in Fig. 6, which can be
easily extended to multiple parties. Both parties equip TEEs and build a
secure channel via remote attestation. Taking their own data $x_{1}$ and
$x_{2}$ as inputs, two parties finish the computation in an interactive
manner, which consists of multiple rounds of communication. At each round, a
message associated with a proof $(m_{i},\Gamma_{i})$ is sent to another party
where $m_{i}$ is a committed message to ensure the privacy of the execution,
and $\Gamma_{i}$ is employed to prove that $m_{i}$ is computed honestly.
Finally, the two parties may run a fair protocol to distribute the final
result $\Phi(x_{1},x_{2})$. Note that all messages between the two parties are
sent over the secure channel.

Figure 6. Secure Two Party Computation

Assessment

####  3.3.2. Research Status

In (Gupta et al., 2016), Gupta et al. showed the naive execution of functions
within TEE might result in significant side-channel leakages, such as runtime
and RAM access patterns. Instead of relying on SGX enclaves to process the
entire computation, the authors leveraged the garbled circuits to handle the
sensitive portion of the computation and advocate separating the computation
into separate circuits and SGX components. In such a way, the secrets are
protected even if the enclave is compromised. However, they did not treat the
SMC problem formally. Bahmani et al. in (Bahmani et al., 2017) extended the
attested computation (Barbosa et al., 2016) to labeled attested computation
(LAC), which makes each party a label. Thus users can get attestations of
parts of code corresponding to specific labels. With the proposed LAC, they
built an efficient SMC protocol from SGX by composing attested key exchange
procedures for each participant in parallel. Furthermore, the TEE-based SMC
protocol was proved by simulation, and some benchmarks compared to ABY
(Demmler et al., 2015) are presented to show its efficiency.

Based on the $\mathcal{G}_{att}$-hybrid abstraction (Pass et al., 2017), Pass
et al. drew several surprising results on SMC. (1) UC-secure SMC protocol is
impossible if at least one party is not equipped with a TEE. However, global
Augmented Common Reference String (ACRS) (Canetti et al., 2007) model makes
the UC-secure SMC realizable even if only one party is equipped with a TEE
because it allows simulating corrupted clients during proof. (2) Combined with
secure key exchange, UC-secure 2-party computation is possible when both
parties have TEEs. (3) Combined with secure key exchange, if both parties have
TEEs and trusted clocks, then fair 2-party computation is achievable. (4)
Fairness is impossible for general functionalities when one party is not
clock-aware, but fairness for certain functions would be possible with the
help of the ACRS model.

To alleviate the burden of trust on the enclave, Choi et al. (Choi et al.,
2019) explored a balanced method to split a function $f$. Instead of
evaluating the entire function $f$ in the enclave, the proposed 2P-SFE
protocol allows the designer to choose which components should be evaluated
within the enclave. 2P-SFE modeled the enclave as a black box and was applied
to two practical problems: private queries to a database and private
navigation based on Dijkstra’s algorithm. However, the scalability of 2P-SFE
is limited. While 2P-SFE only works for boolean circuits, the authors in
(Felsen et al., 2019) proposed a method to evaluate the universal circuit via
Intel SGX, where the universal circuit can emulate any function by programming
input bits to a given size. However, both (Choi et al., 2019) and (Felsen et
al., 2019) assume the parties are semi-honest. In (Wu et al., 2022), Wu et al.
proposed a generic framework HYBRTC, which introduces the concept of TEE trust
levels. Specifically, in an SMC protocol, a party might fully trust TEE, while
another party may only trust the TEE partially or never trust it. HYBRTC
solves the problem when different levels of trust exist in an SMC protocol.
From a high-level overview, for parties who think TEEs are reliable, their
private inputs can be processed in the enclave. Otherwise, their private
inputs should be protected by a cryptographic SMC protocol. Besides, HYBRTC
also eliminates side-channel attacks.

Fairness in SMC. TEE was also explored to design fair SMC protocols. In
(Choudhuri et al., 2017), Choudhuri et al. presented a hybrid model for
achieving fairness by using a public ledger, even in the case of a dishonest
majority. Note that existing solutions such as blockchains or Google’s
certificate transparency logs can implement the public ledger. What important
is that the proposed SMC has complete fairness, which is different from the
method of penalizing an aborting party or achieving weaker notions such as
$\Delta$-fairness. After that, (Paul and Shrivastava, 2019) presented a robust
construction that ensures fairness, although it allows to output an incorrect
value. While implementing fairness by leveraging a public ledger, the input,
output and the state need to be stored on the chain, which brings the burden
of the blockchain. In (Sinha et al., 2019), LucidiTEE explored a method that
does not store inputs, outputs or states on the chain. Besides, LucidiTEE also
suggested integrating the history-based policy into SMC, which achieves fair
delivery and enforces policy-restricted input.

Table 1. Comparisons of Secure Computation

Schemes | Settings | Methodology | Security | Performance
---|---|---|---|---
Security Goals |  Adversarial Models |  Formal proof
Framework | Function | Technologies | Primitives | Privacy | Integrity | Fairness | Freshness | Configurations | Costs
[M2R (Dinh et al., 2015), USENIX Security, 2015] | SDC, n |  Key-value Pair Analysis | Stateless TEE + OP |  PRP, Sig, PKE, SecMix | IO, pattern, IR |  IO, exe, Completeness | ✗ | ✗ |  Malicious Servers HBC client | ✗ |  Baseline: Fully in Enclave Data size : 2-4GB | 0.17-1.0x slowdown
[0.1pt/0.6pt] [VC3 (Schuster et al., 2015), SP, 2015] | SDC, n | General | Stateless TEE |  PRF, Sig, PKE, KE | IO, IR |  IO, exe, Completeness | ✗ | ✓ |  Malicious Servers HBC client | ✗ |  Baseline: Plaintext Model Datasize: 1GB | WordCount: 0.05-0.4x slowdown
[0.1pt/0.6pt] [OCF (Ohrimenko et al., 2015), CCS, 2015] | SDC, n |  Key-value Pair Analysis | Stateless TEE + OP |  PRF, Sig, PKE, KE, PRP | IO, pattern, IR |  IO, exe, Completeness | ✗ | ✗ |  Malicious Adaptive Servers HBC client | ✗ |  Baseline: Plaintext Model Datasize: 2GB | Aggregate: 2x slowdown
[0.1pt/0.6pt] [2P-SFE (Gupta et al., 2016), FC, 2016] | SDC, 2 | Stateless Function | Stateless TEE | GC | IO | exe | ✗ | ✗ | Malicious Server | ✗ | ✗
[0.1pt/0.6pt] [Att. Comp. (Barbosa et al., 2016), EuroS&P, 2016] | SOC | General | Stateful TEE | KE, AE | IO, state | IO, exe | ✗ | ✗ | Malicious Server | SIM | ✗
[0.1pt/0.6pt] [Labeled Att.Comp. (Bahmani et al., 2017), FC, 2017] | SMC, n | General | Stateful TEE | KE, AE | IO, state | IO, exe | ✗ | ✓ | Malicious Parties | SIM | Baseline: ABY |  HD: 5-10x speedup PSI: 8-200x speedup
[0.1pt/0.6pt] [PST17-I (Pass et al., 2017), EUROCRTPT, 2017] | SOC | General | Stateful TEE | Sig, AE | IO | IO, exe | ✗ | ✓ | Malicious Server | UC | ✗
[0.1pt/0.6pt] [PST17-II (Pass et al., 2017), EUROCRTPT, 2017] | SMC,2 | General | Stateful TEE |  Sig, PKE, AE, NIZK | IO | IO, exe | ✗ | ✓ | Malicious Parties | UC | ✗
[0.1pt/0.6pt] [PST17-III (Pass et al., 2017), EUROCRTPT, 2017] | SMC,2 | General | Stateful TEE |  Sig, PKE, AE, NIZ, Clock | IO | IO, exe |  $\Delta$-Fairness | ✓ | Malicious Parties | UC | ✗
[0.1pt/0.6pt] [FSMC (Choudhuri et al., 2017), CCS, 2017] | SMC, n | General | Stateful TEE + PL |  OWF, Sig, AE, Com | IO | IO, exe | ✓ | ✗ | Malicious Parties | UC | ✗
[0.1pt/0.6pt] [2P-SFE$\dagger$ (Hunt et al., 2018), AsiaCCS, 2018] | SMC, 2 | Garbled Circuits | Stateful TEE | GC, OT | IO, IR | IO, exe | ✗ | ✗ | HBC parties | SIM | Baseline : GC | Dijkstra: 1.01-200x speedup
[0.1pt/0.6pt] [KGM (Kaptchuk et al., 2017), NDSS, 2019] | SOC | General | Stateless TEE + PL | PRF, DAE, Com | IO, state | IO, exe, state | ✗ | ✓ | Malicious Server | SIM | ✗
[0.1pt/0.6pt] [Kosto (Dang et al., 2019), ESORICS, 2019] | SOC | General | Stateful TEE | PRF, AE, Com | IO | IO, exe | ✓ | ✗ | Malicious Parties | ✗ | Baseline: Plaintext Model |  mcf: 2x slowdown deepsjeng: 2.3x slowdown leela : 2.1x slowdown xz : 1.2x slowdown exchange: 0.4x slowdown
[0.1pt/0.6pt] [ObliDC (Wu et al., 2019), AsiaCCS, 2019] | SDC, n | General | Stateful TEE + OP | Sig, AE, PKE | IO, pattern, IR |  IO, exe, Completeness | ✗ | ✓ |  Malicious Adaptive Servers HBC client | UC |  Baseline: Plaintext Model Datasize: 2GB |  WordCount: 0.8-1.2x slowdown RandomWriter: 0.3-1.42x slowdown
[0.1pt/0.6pt] [LucidTEE (Sinha et al., 2019), Preprint, 2019] | SMC, n | General | Stateless TEE + PL |  PKE, Sig, AE, Com | IO, state |  IO, exe, state, policy | ✓ | ✓ | Malicious Parties | UC |  No baseline Datasize: 30MB | PSI: 10s
[0.1pt/0.6pt] [WNS22$\ddagger$ (Wu et al., 2022), NDSS, 2022] | SMC, n | SELECT-JOIN | Stateful TEE |  PRF, HE, BF, CHF | IO, pattern | IO, exe | ✗ | ✓ | Malicious Parties | UC |  Baseline: ABY Function: Select-join | Select-join: 2-18kx speedup

  * •

GC: Garbled Circuits, KE: Key Exchange, SDC,$n$: Secure Distributed
Computation with $n$ Slave Nodes, SOC: Secure Outsourced Computation, SMC,$n$:
Secure Multiparty Computation with $n$ Parties, AE: Authenticated Encryption,
SIM: Simulate-based Proof, HD: Hamming Distance, PSI: Private Set
Intersection, Sig: Signature Scheme, PKE: Public key encryption, NIZK: Non-
interactive Zero-knowledge Proof, OWF: One Way Function, Com: Commitment
Scheme, PRF: Pseudo-random Functions, DAE: Deterministic Authenticated
Ancryption, HE: Homomorphic Encryption, BF: Bloom Filter, CHF: Cuckoo Filter,
IR: Intermediate Results, PRP: Pseudo-Random Permutation, SecMix: Secure
Mixer, OT: Oblivious Transfer;

  * $\dagger$

https://github.com/FICS/smcsgx,

  * $\ddagger$

https://github.com/HybrTC/HybrTC.git;

###  3.4. Comparisons

A comprehensive comparison is made in Table 1 to analyze existing secure
computation protocols with regard to the setting, methodology, security
features, and performance. Since TEE provides basic confidentiality and
integrity guarantees, most of the existing secure computation protocols are
against malicious parties. Only LucidiTEE (Sinha et al., 2019) achieves
fairness and freshness simultaneously; however, it only works on a very small-
scale data set (around 30MB). Due to the different settings and experimental
configurations, we are unable to give an explicit performance comparison among
the referenced works in Table 1. Instead, we present the performance
comparison between a protocol and its baseline protocol. For example, WNS22
(Wu et al., 2022) improves the performance by about 2-18k times compared to
its baseline ABY (Demmler et al., 2015) for the select-join function.

##  4\. Secure Machine Learning using TEEs

This section turns to review and compare TEE-based protocols towards secure
machine learning. Following the frameworks presented in Sec. 2, the protocols
are classified into secure outsourced learning, secure distributed learning,
and secure multiparty learning. In secure outsourced learning, we consider two
types of computational tasks: training and inference. Training refers to using
training data sets and a machine learning algorithm to generate a trained
machine learning model. Inference refers to using a trained machine learning
model to make a prediction for a given data item. Secure training and
inference are also called privacy-preserving Machine Learning as a Service
(MLaaS) (Hesamifard et al., 2018). We found that approaches in secure training
can also apply to secure inference, therefore we do not consider secure
inference in distributed and multiparty learning. Instead, we only consider
secure inference under the outsourced learning setting.

###  4.1. Secure Outsourced Learning

####  4.1.1. Problem Statement

We review secure outsourced learning from two aspects: secure outsourced
training (SOT) and secure outsourced inference (SOI). SOT enables a resource-
limited client to outsource a training task
$(\Phi,\llbracket{\mathcal{X}}\rrbracket)$ to a single cloud server with
powerful resources and generate a trained model $M$. Note that
$\mathcal{X}=\\{(x_{i},y_{i})\\}_{i=1}^{N}$ is an ensemble of data item (e.g.,
$x_{i}$) with its label (e.g., $y_{i}$). To protect the privacy of training
data and model, the cloud server performs training operations $\Phi$ on
encrypted data sets $\llbracket{\mathcal{X}}\rrbracket$ and outputs
$(\llbracket{M}\rrbracket,\Gamma)$, where $\llbracket{M}\rrbracket$ is an
encrypted trained model, and $\Gamma$ is a proof of integrity assurance. The
correctness of SOT means that the final result $M=\Phi(\mathcal{X})$. In other
words, the result of SOT is equivalent to the one trained locally. Privacy
means that the cloud server cannot learn anything sensitive information about
$\mathcal{X}$ (input privacy) or $M$ (model privacy, known as output privacy
in SOC). The integrity enforces the cloud server performing
$\Phi(\llbracket{\mathcal{X}}\rrbracket)$ honestly by generating a proof
$\Gamma$ to prove the integrity of execution.

While cryptographic primitives (e.g., homomorphic encryption, secret sharing,
secure multi-party computation) can support secure training (Boulemtafes et
al., 2020), they introduce high computation and communication overhead (Duy et
al., 2021). TEE-based SOT has gain its popularity in recent years due to its
appealing performance advantages. As shown in Fig. 7(a), we provide a general
workflow of SOT to explain the interactions between a client and a TEE-
equipped cloud server. The client builds a secure channel between the enclave
by remote attestation, after which four steps are followed. (1) The client
loads the program $\Phi$ to the enclave via a secure channel by remote
attestation. (2) The enclave responds with a triple $(b,\Phi,\Gamma_{0})$, in
which $\Gamma_{0}$ proves the program is loaded correctly ($b=1$); otherwise,
$b=0$ and $\Gamma_{0}=\bot$. (3) The client submits an encrypted data ensemble
$\llbracket{\mathcal{X}}\rrbracket$ to the enclave. (4) The enclave cooperates
with the untrusted cloud server to generate the final results
$(\llbracket{M}\rrbracket,\Gamma)$, where $M=\Phi(\mathcal{X})$ and $\Gamma$
proves the program is executed honestly. The enclave returns the final results
to the client.

(a) Secure Outsourced Training (b) Secure Outsourced Inference

Figure 7. Secure Outsourced Learning

Secure outsourced training and inference.

In SOI, a single cloud server holds the trained model $M$ and allows a
resource-limited client to submit an inference task
$(\Psi,\llbracket{x}\rrbracket)$, and then responds the client with an
inference output $y$. Note that here $x$ is just a single data item and the
output $y$ is the prediction result. To protect the privacy of $x$, the cloud
server performs inference operations $\Psi$ on encrypted inference data
$\llbracket{x}\rrbracket$. It outputs $(\llbracket{y}\rrbracket,\Gamma)$,
where $\llbracket{y}\rrbracket$ is an encrypted inference result, and $\Gamma$
is a proof of integrity for operations. The correctness of SOI means that the
final inference result $y=\Psi(x,M)$. In other words, the result of SOI is
equal to the one that finishes the inference task locally. The SOI privacy
means that the cloud server cannot learn anything sensitive information about
$x$ (input privacy) or $y$ (output privacy). In case the cloud server has no
ownership of the model $M$, the encrypted model $\llbracket{M}\rrbracket$ is
fed to server to achieve the model privacy. The integrity enforces the cloud
server to perform $\Psi(\llbracket{x}\rrbracket,M)$ honestly and generate the
integrity proof $\Gamma$.

Fig. 7(b) shows a general workflow of SOI and the interactions between a
client and a single cloud server that equips TEE and holds a machine learning
model $M$. The client builds a secure channel between the enclave by remote
attestation, after which five steps are followed. (1) The client loads the
program $\Psi$ to the enclave via a secure channel. (2) The enclave responds
with a tuple $(b,\Psi,\Gamma_{0})$, in which $\Gamma_{0}$ proves the program
is loaded successfully ($b=1$); otherwise, $b=0$ and $\Gamma_{0}=\bot$. (3)
The client submits an encrypted input $\llbracket{x}\rrbracket$ to the
enclave. (4) The enclave cooperates with the cloud server to generate the
final results $(\llbracket{y}\rrbracket,\Gamma)$, in which
$\llbracket{y}\rrbracket=\Psi(\llbracket{x}\rrbracket,M)$ and $\Gamma$ proves
that the program is executed honestly. The enclave returns the final results
to the client.

####  4.1.2. Research status of SOT

In (Ohrimenko et al., 2016), Ohrimenko et al. combined SGX and data-oblivious
primitives to design data-oblivious machine learning training algorithms, such
as support vector machines, matrix factorization, neural networks, decision
trees, and k-means clustering. Experimental evaluations show that its
performance outperforms the MPC-based solutions. However, the approach results
in a large TCB, which limits its use to support large machine learning models.
To reduce TCB and enable the TensorFlow framework, Kunkel et al. (Kunkel et
al., 2019) presented the TensorScone framework to support secure machine
learning computations on untrusted infrastructure. TensorScone can achieve
more than 80% precision compared with GPU-only baseline training. In (Yuhala
et al., 2021), Peterson et al. proposed Plinius that combined the features
between persistent memory (PM) and Intel SGX enclave. Plinius achieves
3.2-3.7$\times$ performance improvement for saving and restoring models on
real PM hardware, respectively. Besides, GPU-based TEEs (Volos et al., 2018)
were introduced to accelerate secure training (e.g., Telekine (Hunt et al.,
2020)). To enable parallel GPU acceleration, the proposed AsymML in (Niu et
al., 2021) partitions a target machine learning model into trusted and
untrusted parts. Thus, AsymML can provide more than 5$\times$ speedup than
pure TEE-based training. Besides, model partition is also a popular technology
to accelerate the TEE-based training (Hashemi et al., 2021; Yuhala et al.,
2021; Asvadishirehjini et al., 2022).

To enable realistic integrity-preserving deep neural network (DNN) model
training for heavy workloads, Asvadishirehjini et al. (Asvadishirehjini et
al., 2022) presented GINN that combined random verification of selected
computation steps with systematic adjustments of DNN hyperparameters to limit
the attacker’s ability to shift the model parameters arbitrarily. GINN can
achieve high integrity and 2-20$\times$ performance improvement over a pure
TEE-based training method. In (Hashemi et al., 2021), to optimize the
performance, Hashemi et al. presented DarKnight framework that uses TEE to
provide privacy and integrity verification and GPUs to perform the bulk of
linear algebraic computation. DarKnight (Hashemi et al., 2021) proposed a
customized data encoding strategy based on matrix masking, which is adopted to
create input obfuscation within the TEE. DarKnight achieves an average of
6.5$\times$ training speedup compared with the pure TEE-based solutions. Goten
(Ng et al., 2021) adopted a dynamic quantization scheme to cater for the
fluctuation in weight during training to optimize performance. It shows a
6.84-132.64$\times$ speedup than a pure TEE-based solution and the latest
secure multi-server cryptographic solution (Wagh et al., 2021). In (Ozga et
al., 2021), Ozga et al. presented Perun that considers multi-stakeholder
collaboratively generating a trained model where the stakeholders consist of
the training data owner, training code owner, model owner, and inference code
owner. Each entity outsources the computation to a cloud server and provides a
service to other entities. Perun gives a 161-1,560$\times$ performance
improvement compared with a pure TEE-based method.

####  4.1.3. Research status of SOI

Due to the similarity of computation between training and inference, many
existing works (Hunt et al., 2020; Niu et al., 2021; Hashemi et al., 2021; Ng
et al., 2021; Yuhala et al., 2021; Ozga et al., 2021) support SOT and SOI
simultaneously. In the following, we review other works focusing on SOI. In
(Grover et al., 2018), Grover et al. first pointed out the inference of DNN
based on Intel SGX enclaves faced with access pattern based attacks, so this
work designed input-oblivious Privado framework to address the problem and
support secure and integrated inference services. Privado with Torch framework
incurs an average 17.18% overhead on 11 different DNN models. The work (Gu et
al., 2018) formulated the information exposure problem as a reconstruction
privacy attack for a cloud-based inference service and quantified the
adversary’s capabilities with different attack strategies. DeepEnclave was
proposed in (Gu et al., 2018) to partition a deep learning model into a
FrontNet and a BackNet, where the FrontNet is enforced to do enclaved
execution, and the BackNet runs out of secure enclaves. DeepEnclave causes
1.64-2.54$\times$ overhead due to the enclaved execution of the FrontNet
compared to GPU execution of the FrontNet. To optimize the performance of
inference, Florian et al. proposed Slalom (Tramèr and Boneh, 2019) that
partitioned DNN computations into trusted and untrusted parts. All the
computation of linear layers of a DNN model are executed in an enclave, while
other computation of the DNN model are loaded to an untrusted GPU for
acceleration. Although Slalom adopts some cryptographic primitives to support
verifiable and private inference, it achieves 4-20$\times$ performance
improvement compared with a pure TEE approach.

To break through the memory limitation of the enclave and accelerate an
inference, Origami (Narra et al., 2019) combines enclave, cryptographic tools,
and GPU/CPU acceleration. The enclave adds noise to obfuscate inference data
and sends the obfuscated data to an untrusted GPU/CPU for computation
acceleration. Origami achieves 11$\times$ performance improvement than a pure
SGX approach, and 15.1$\times$ performance improvement compared to Slalom
(Tramèr and Boneh, 2019). Aiming to address the memory limitation and page
swapping of SGX enclave, Lee et al. (Lee et al., 2019) carefully developed on-
demand weights loading, memory-efficient inference, and parallel processing
pipelines in their proposed Occlumency, which gives a 3.6$\times$ speedup
compared to a pure TEE-based method and 72% latency overhead compared to a
pure GPU approach. In (Schlögl and Böhme, 2020), Alexander et al. presented
the eNNclave tool-chain to cut TensorFlow models at any layers and split them
into public and enclave layers, where GPU performs public layers for
acceleration. In contrast, the enclave executes private layers for security
and integrity. Accuracy results of eNNclave are close to a pure GPU method.
Aiming to solve the large memory allocation and low memory re-usability
problem in deep learning systems, (Kim et al., 2020) presented Vessels that
optimized the memory management of SGX. However, in contrast to a pure GPU-
based inference method, Vessels results in about 3-20$\times$ inference
latency.

To provide dependable and timely inference services, Xiang et al. (Xiang et
al., 2021) proposed AegisDNN that adopted a dynamic-programming algorithm
based on the layer-wise DNN time and Silent Data Corruption profiling
mechanism to find a layer protection configuration for each inference task.
AegisDNN supports Caffe, PyTorch, and TensorFlow frameworks and achieves up to
88.8% less failure rates than the pure GPU-based approach and 99.9% shorter
relative response time than the pure enclave-based approach. Different from
the previous works, (Park et al., 2022) focused on the fairness of inference
for the machine learning model with the enclave.

###  4.2. Secure Distributed Learning

####  4.2.1. Problem Statement

Secure distributed training (SDT) enables $n$ ($n\geq 2$) slave nodes to
jointly perform a training task
$(\Phi,\mathcal{X}_{1},\cdots,\mathcal{X}_{n})$ with the assistance of a
master node and generate a trained model $M$, where $\mathcal{X}_{i}$ is the
$i$-th party’s training data. Particularly, $\Phi$ consists of slaves’ local
training operation $\Phi_{i}$ and master’s aggregation operation $\Pi$ such
that

(2)
$\Phi(x)=\Pi\left(\Phi_{1}(\mathcal{X}_{1}),\Phi_{2}(\mathcal{X}_{2}),\cdots,\Phi_{N}(\mathcal{X}_{N})\right).$

Note that each slave node performs a local training $\Phi_{i}$ and outputs
intermediate result $(\llbracket{m_{i}}\rrbracket,\Gamma_{i})$, where
$\llbracket{m_{i}}\rrbracket$ is an encrypted intermediate model (also called
local model), and $\Gamma_{i}$ proves the local training is executed honestly.
After that, master node aggregates the local models into one global model. The
privacy means that master node and slave nodes fail to learn any sensitive
information about $\mathcal{X}$ (input privacy) or $M$ (output privacy). The
integrity enforces the master node and the slave nodes to honestly perform
$\Pi$ and $\Phi_{i}$ and generate the respective proofs.

Figure 8. Secure Distributed Training

Secure Distributed Learning

As depicted in Fig. 8, we present a general workflow of TEE-based SDT to
explain the interactions among a client, multiple TEE-equipped parties, and a
TEE-equipped master node. The client builds a secure channel between the
master node’s enclave via remote attestation, after which six steps are
followed. (1) The client uploads the model parameter to the master node. (2)
The client ensures the aggregation program $\Pi$ is loaded to the master
node’s enclave successfully and (3) ensures the local training algorithm
$\Phi_{i}$ is loaded into slaves’ enclave successfully. (4) The slave nodes
download the initial global model $M$ and then generate a model gradient
$\Delta M$. (5) The slave nodes submits the gradient $\Delta M$ to the master
node. Note that the steps (4) and (5) are repeated until a convergent model is
generated or the maximum number of iterations is reached. (6) Finally the
master node returns the final global model to the client.

Note that Federated Learning (FL) also belongs to the distributed framework.
FL serving as a special scenes of SDT has recently attracted much attention
from the research and industrial community. The input data in SDT can either
be encrypted or unencrypted. However in FL, each slave has its own training
data set and a local model over local unencrypted data. The privacy for FL
means that master node fails to learn any sensitive information about
$\mathcal{X}$ (input privacy) or $M$ (output privacy). The integrity enforces
the master node and slave nodes performing $\Pi$ and $\Phi_{i}$ honestly and
generating the proof accordingly, respectively.

####  4.2.2. Research Status

In (Hunt et al., 2018), the proposed Chiron adopted SGX and the sandbox Ryoan
(Hunt et al., 2016) to perform model training and protect the privacy of both
training data and the trained model, where Ryoan sandbox was used to prevent
leaking the training data outside the enclave. Particularly, Chiron supports
distributed training with multiple enclaves. Compared with training deep
neural networks on CPU-only, Chiron increases about 4%-20% training cost. The
work (Zhang et al., 2021b) proposed Citadel that allows parties (or say data
owners) holding training data and an aggregation server (or say aggregator
owner) equipped with enclaves to protect their input privacy. When multiple
enclaves are deployed, Citadel achieves a less than 1.73$\times$ performance
slowdown. In contrast to other solutions, (Huang et al., 2021) proposed StarFL
that combines multiple techniques, such as TEE, MPC, and satellites (who are
responsible for distributing keys). When the last four layers are inside
enclave execution, the running time of StarFL is no more than 5% higher than a
pure CPU-based training approach. Brito et al. presented Soteria (Brito et
al., 2021), a distributed privacy-preserving machine learning (ML) system
based on TEEs. Soteria made performance trade-offs for the distributed Apache
Spark framework and its ML library. As Soteria supports executing non-
sensitive operations outside an enclave, it improves the runtime performance
of distinct ML algorithms by up to 1.7$\times$ compared to a pure SGX-spark
method.

To support unmodified TensorFlow applications, Quoc et al. presented a
distributed secure machine learning framework (secureTF) based on TensorFlow
for the untrusted cloud infrastructure (Quoc et al., 2020). In contrast to
Chiron (Hunt et al., 2018), secureTF support SDT and SDI simultaneously and
enjoys the advantage of unmodified TensorFlow applications. But it endures
roughly 14$\times$ training overhead compared to a pure GPU approach.

Federated Learning. SecureFL (Kuznetsov et al., 2021) equips slave nodes and
the master node of FL with TEEs. However, due to the partial in-enclave
training, SecureFL results in 1.6%-23.6% overhead compared with a pure CPU-
based training. Aiming to limit privacy leakages in FL, Mo et al. presented a
privacy-preserving federated learning (PPFL) framework (Mo et al., 2020) for
mobile systems using TEE. PPFL adopted TEE to train each layer of the model
until its convergence by leveraging the greedy layer-wise. Thanks to the TEE,
PPFL can defend against data reconstruction, property inference, and
membership inference attacks. In contrast to the standard FL without privacy
protection, PPFL introduces about 1.3s-1.5$\times$ training overhead.

To improve the efficiency, TrustFL proposed in (Zhang et al., 2020) suggested
using GPU to train a local model for each party and then verifying the
correctness in an enclave. TrustFL utilized a ”commit-and-prove” MHT-based
commitment scheme to verify the integrity of the training algorithm and a
”dynamic-yet-deterministic” data selection strategy for fresh training data.
Thanks to GPU-based training, TrustFL provides 1-2 orders of magnitude speedup
than a pure TEE-based FL method. Aiming to defend against Byzantine failures
in FL and enable secure model aggregation, Zhao et al. proposed SEAR based on
TEE (Zhao et al., 2021). The key idea of SEAR is to build a secure channel
between a party and the aggregation server by remote attestation, and
encrypted local models are aggregated in the aggregation server’s enclave.
SEAR achieves a 4$\times$-6$\times$ performance improvement compared to the
existing secure aggregation framework. ShuffleFL (Zhang et al., 2021a) is
proposed to protect the privacy of model gradients and defend against side-
channel attacks. It combined random group structure and intra-group gradient
segment aggregation mechanisms to prevent the exploitation of side-channel
attacks. Like TrustFL, ShuffleFL also uses enclave to perform model
aggregation.

###  4.3. Secure Multiparty Learning

This section turns to review and compare TEE-based protocols towards secure
multi-party training.

####  4.3.1. Problem Statement

Secure multi-party training (SMT) enables $n$ ($n\geq 2$) parties holding data
jointly performing a training task
$(\Phi,\mathcal{X}_{1},\cdots,\mathcal{X}_{N})$ and generating a trained model
$M$, where $\mathcal{X}_{i}$ is the $i$-th party’s training data. The
correctness of SMT means that the trained model is equal to the model that was
trained on an honest party over the same data set. The privacy means that any
party fails to learn any sensitive information about other parties’ data. The
integrity enforces each party performing $\Psi_{i}(x_{i})$ honestly and
generating the operation integrity proof $\Gamma_{i}$.

Figure 9. Secure Multiparty Training

Assessment

Fig. 9 shows a general workflow of secure two party training between two TEE-
equipped parties, which can be easily extended to the multi-party setting. The
two party builds a secure channel via remote attestation, after which all
messages are communicated over the secure channel. Then three steps are
followed. (1) Both enclave read the model parameter into TEE. (2) Both parties
take their own data $\mathcal{X}_{1}$ and $\mathcal{X}_{2}$ as input,
respectively. (3) Both parties ensure the training program $\Phi$ is loaded
into the TEEs successfully. After that the protocol executes interactively
between the two parties. In each interaction, a message associated with a
proof $(m_{i},\Gamma_{i})$ is sent to another party. Here $m_{i}$ is a
committed message to ensure the privacy of the execution, and $\Gamma_{i}$ is
employed to prove the message $m_{i}$ is computed honestly. The protocol halts
until generating a convergent model and outputs a final trained model
$(M,\Gamma)$, where $\Gamma$ proves the protocol is run honestly.

####  4.3.2. Research Status

Although secure multi-party computation (MPC) is successfully applied to
secure machine learning (Choi and Butler, 2019), only few solutions of multi-
party machine learning training are designed without requiring a third party
(or master node) to participate in computations. One possible explanation is
that the training algorithms faces with complex computations, which affects
the performance significantly. In (Ren et al., 2021), to reduce the
communication overhead of MPC-based methods for privacy-preserving neural
networks training, Ren et al. presented an $n$-party training framework for
Graph Neural Networks (GNNs) using SGX. During training, $n$ parties hold
training data, and SGX shares training data by additive secret sharing and
perform training operations on the local enclave. Following that, the party
aggregates other $n-1$ parties’ training results to obtain the trained model.
The solution of (Ren et al., 2021) can output a trained GNN within dozens of
seconds.

Table 2. Comparisons of Secure Machine Learning

Schemes | Settings | Methodology | Security | Performance
---|---|---|---|---
Security Goals |  Adversarial Models |  Formal proof
Framework | Function | Technologies | Primitives | Privacy | Integrity | Freshness | Configurations | Costs
[OMPML (Ohrimenko et al., 2016), USENIX Security, 2016] | SOT | Training | TEE+OP |  AES-GCM, GPO | IO, exe, pattern | IO, exe | ✓ | Malicious Server/Client | ✗ |  Dataset: MNIST, SUSY, MovieLens, Nursery Models: K-Means, CNN, SVM, Matrix factorizatoin Baseline: MPC | 1.7-2.5x speedup
[0.1pt/0.6pt] [Privado (Grover et al., 2018), arXiv, 2018] | SOI | Inference | TEE | DO,TLS | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: MNIST, CIFAR10 Models: MLP, LeNet, VGG19, Wideresnet, ResNet29/50/110, AlexNet, Squeezenet, InceptionV3, DenseNet Platform: Intel SGX SDK, torch Baseline: Plaintext Model | 0.18x slowdown
[0.1pt/0.6pt] [Chiron (Hunt et al., 2018), arXiv, 2018] | SDT | Training | TEE |  AES-GCM, DF, TLS | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: CIFAR-10, ImageNet Models: VGG-9, AlexNet Platforms: Intel SGX, Ryoan sandbox Baseline: Plaintext Model | 0.04-0.2x slowdown
[0.1pt/0.6pt] [DeepEnclave (Gu et al., 2018), arXiv, 2018] | SOI | Inference | TEE | AE, TLS | IO, exe | IO, exe | ✗ | Malicious Server | ✓ |  Dataset: ImageNet Models: Darknet, Extraction, DeseNets Baseline: Pliantext Model | 1.64-2.54x slowdown
[0.1pt/0.6pt] [Slalom (Tramèr and Boneh, 2019), ICLR, 2019] | SOI | Inference | TEE |  Frei., SC PRNG |  IO (model, intput) | exe | ✗ | Malicious Server | ✓ |  Dataset: ImageNet Models: VGG16, MobileNet Platforms: Intel SGX, TensowFlow Baseline: Fully in Enclave | 4-20x speedup
[0.1pt/0.6pt] [TensorSCONE (Kunkel et al., 2019), arXiv, 2019] | SOT | Training | TEE | TLS | IO, exe | IO, exe | ✓ | Malicious Server | ✗ |  Dataset: CIFAR-10 Models: InceptionV4 Platforms: Intel SGX, SCONE, TensorFlow Baseline: Plaintext Model | 0.8-0.9x slowdown
[0.1pt/0.6pt] [Occlumency (Lee et al., 2019), MobiCom, 2019] | SOI | Inference | TEE | AES, TLS | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: ImageNet Models: AlexNet, GoogleNet, ResNet50/101/152, VGG16/19, YOLO Platforms: Intel SGX, Caffe |  Fully in Enclave: 3.6x speedup Plaintext Model: 0.72x slowdown
[0.1pt/0.6pt] [Origami (Narra et al., 2019), arXiv, 2019] | SOI | Inference | TEE | - | IO | - | ✗ | Malicious Server | ✗ |  Dataset: ImageNet Models: VGG16/19 Baseline:Slalom | 11-15.1x speedup
[0.1pt/0.6pt] [Telekine (Hunt et al., 2020), NSDI, 2020] | SOT, SOI |  Training Inference | GPU TEE+OP |  AES-GCM, MAC, LTS | IO, pattern | IO, exe | ✓ | Malicious Server | ✗ |  Dataset: ImageNet Models: ResNet, InceptionV3, DenseNet Platforms: AMD’s ROCm 1.8, MXNet Baseline: Plaintext Model |  Training: 1.08-1.23x slowdown Inference: 1.0-10x slowdown
[0.1pt/0.6pt] [eNNclave (Schlögl and Böhme, 2020), AISec, 2020] | SOI | Inference | TEE | AES-GCM | IO | IO | ✗ | Malicious Server/Client | ✗ |  Dataset: MIT67, Flowers, Amazon review data Models: VGG-16, VGG-19, CNN Baseline: Plaintext Model | 17x-65x slowdown
[0.1pt/0.6pt] [Vessels (Kim et al., 2020), SoCC, 2020] | SOI | Inference | TEE | - | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: ImageNet Models: AlexNet, ResNet101, ResNet152, DenseNet201, ResNext152, DarkNet53, InceptionV3, VGG16, YoloV3 Baseline: Plaintext Model | Inference: 5.01-20.9x slowdown
[0.1pt/0.6pt] [ShadowNet (Sun et al., 2020), arXiv, 2020] | SDT |  Training Inference | TEE | - | Model | - | ✗ | Malicious Server/Client | ✓ |  Dataset: ImageNet, CIFAR-10 Models: MobileNets, ResNet-44, AlexNet, MiniVGG Platforms: TensowFlow Lite Baseline: Fully in Enclave | 0.61-2.21 speedup
[0.1pt/0.6pt] [TrustFL (Zhang et al., 2020), INFOCOM, 2020] | SDT | Training | TEE | PRF, HMAC | IO, exe | IO, exe | ✗ |  Semi-honest Server Dishonest Participant | ✗ |  Dataset: CIFAR10, ImageNet Models: VGG16/19, ResNet Baseline: Fully in Enclave | 10-100x speedup
[0.1pt/0.6pt] [DarkneTZ (Mo et al., 2020), MobiSys, 2020] | SDT |  Training Inference | TEE | AES-GCM | IO, exe | IO, exe | ✗ | Malicious Client | ✗ |  Dataset: CIFAR100, ImageNet Tiny Models: AlexNet, VGG7 Platforms: ARM TrustZone Baseline: Plaintext Model | 0.03-0.1x slowdown

  * •

GPO: General-purpose Oblivious, DO: Data Oblivious, Frei.: Freivalds’
algorithm, SC: Stream ciphers, PRNG: Pseudo Random Number Generator, AE:
Authenticated Encryption, MPC: Multiple Party Computation

Schemes | Settings | Methodology | Security | Performance
---|---|---|---|---
Security Goals |  Adversarial Models |  Formal proof
Framework | Function | Technologies | Primitives | Privacy | Integrity | Freshness | Configurations | Costs
[secureTF (Quoc et al., 2020), Middleware, 2020] | SDT |  Training Inference | TEE | ECDH, TLS | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: CIFAR10, MNIST Models: Inception v3/v4, DeseNet Platforms: Intel SGX, TensowFlow Baseline: Plaintext Model | 14x slowdown
[0.1pt/0.6pt] [AegisDNN (Xiang et al., 2021), RTSS, 2021] | SOI | Inference | TEE | - | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: - Models: lenet, Alexnet, ResNet-18, Pilotnet Platforms: Intel SGX, TenseFlow, Caffe, Pytorch Baseline: Pliantext Model | 0.8-1.2 slowdown
[0.1pt/0.6pt] [AsymML (Niu et al., 2021), arXiv, 2021] | SOT, SOI |  Training Inference | TEE | - | IO (model, intput) | - | ✗ | Malicious Server | ✗ |  Dataset: ImageNet, CIFAR-10 Models: VGG16/19, ResNet18/34 Baseline: Fully in Enclave |  Training: 11.2x speedup Inference: 7.6x speedup
[0.1pt/0.6pt] [SEAR (Zhao et al., 2021), TDSC, 2021] | SDT | Training | TEE |  AES-GCM, Elliptic Curve | IO, exe | IO, exe | ✗ |  Semi-honest Server/Client | ✗ |  Dataset: MNIST, CIFAR-10 Models: CNN, ResNet56 Baseline: ASS-based solution | 4-6x speedup
[0.1pt/0.6pt] [SecDeep (Liu et al., 2021), IoTDI, 2021] | SDT |  Training Inference | TEE | AES-CTR, MD5 | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: MNIST, CIFAR-10 Models: SqueezeNet, MobileNet V1/V2, GoogleNet, Yolo Tiny, ResNet50, Inception BN Platforms: HiKey960 board, ARM TrustZone Baseline: Pliantext Model | 16-172x slowdown
[0.1pt/0.6pt] [Citadel (Zhang et al., 2021b), SoCC, 2021] | SDT | Training | TEE |  AES-CBC-256 ZSM, TSH | IO, exe | IO, exe | ✗ |  Semi-honest Server/Client | ✗ |  Dataset: MNIST, SMS messiage Models: AlexNetS, AlexNetL, SpamNet, MNIST Platforms: Intel SGX, TensowFlow Baseline: Fully in Enclave | Training: 1.09-1.73x slowdown
[0.1pt/0.6pt] [Mlcapsule (Hanzlik et al., 2021), CVPR, 2021] | SDT |  Training Inference | TEE | - | IO, exe | IO, exe | ✗ | Malicious Client | ✗ |  Dataset: CIFAR100 Models: VGG-16 Baseline: Plaintext Model | Inference: 1.2-3x overhead
[0.1pt/0.6pt] [StarFL (Huang et al., 2021), ACM TIST, 2021] | SDT | Trainting | TEE | AES-GCM | IO, exe | IO, exe | ✗ | Malicious Client | ✗ |  Dataset: CIFAR100, ImageNet Tiny Models: AlexNet, VGG7 Platforms: ARM TrustZone Baseline: Plaintext Model | less than 5% slowdown
[0.1pt/0.6pt] [Model Protection (Hou et al., 2021), TDSC, 2021] | SDT |  Training Inference | TEE | - | Model Privacy | IO, exe | ✗ |  Honest Server Semi-honest Client | ✗ |  Dataset: CIFAR10/100, ImageNet Models: InceptionResNetV2, VGG19, MobileNetV2, NASNet Platflorm: Intel SGX, TensowFlow Baseline: DarkneTZ | 2.2-7.8x speedup
[0.1pt/0.6pt] [SecureFL (Kuznetsov et al., 2021), SEC, 2021] | SDT |  Training Inference | TEE | AES | IO, exe | IO, exe | ✗ |  Semi-honest Server/Client | ✗ |  Dataset: MNIST, CIFAR10, Tiny ImageNet Models: LeNet, VGG7/16 Platform: Intel SGX, Raspberry Pi 3B+ Baseline: Plaintext Model | 0.1-0.3x slowdown
[0.1pt/0.6pt] [Darknight (Hashemi et al., 2021), MICRO, 2021] | SOT, SOI |  Training Inference | TEE | MM | IO, exe | IO, exe | ✗ | Malicious Server | ✓ |  Dataset: CIFAR10, ImageNet Models: VGG16, ResNet50, MobileNetV2 Platform: Intel SGX, GTX1080 Ti Baseline: Fully in Enclave |  Training: 6.5x speedup Inference: 12.5x speedup
[0.1pt/0.6pt] [Plinius (Yuhala et al., 2021), DSN, 2021] | SOT, SOI |  Training Inference | TEE |  AES-GCM, PM | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: MNIST Models: CNN Platform: Intel SGX SDK Baseline: Fully in Enclave | 2.5-3.5x Speedup
[0.1pt/0.6pt] [Goten (Ng et al., 2021), AAAI, 2021] | SOT, SOI |  Training Inference | TEE | ASS | IO, exe | IO, exe | ✗ | Semi-honest server | ✗ |  Dataset: CIFAR10 Models: VGG11 Baseline: CaffeScone, Falcon | 6.84-132.64x speedup

  * •

ECDH: Elliptic Curve Diffie-Hellman, ZSM: Zero-sum Masking, TSH: Tree-
structured Hierachical, ASS: Additive Secret Sharing, MM: Matrix Masking;

Schemes | Settings | Methodology | Security | Performance
---|---|---|---|---
Security Goals |  Adversarial Models |  Formal proof
Framework | Function | Technologies | Primitives | Privacy | Integrity | Freshness | Configurations | Costs
[PPFL (Mo et al., 2021), MobiSys, 2021] | SDT | Training | TEE | AES-GCM | IO, exe | IO, exe | ✗ |  Semi-honest Server/Client | ✗ |  Dataset: MNIST, CIFAR10 Models: LeNet, AlexNet, VGG19 Platform: ARM TrustZone Baseline: Fully in Enclave | 1.5-3x slowdown
[0.1pt/0.6pt] [Perun (Ozga et al., 2021), DBSec, 2021] | SOT, SOI |  Training Inference | TEE | - | IO, exe | IO, exe | ✗ | Semi-honest | ✗ |  Dataset: CIFAR10, Medical dataset Models: 2D-U-Net Platform: TensowFlow, Intel SGX |  Plaintext Model: 0.96x slowdown secureTF : 1560x
[0.1pt/0.6pt] [Soteria (Brito et al., 2021), ePrint, 2021] | SDT | Training | TEE | AES-GCM | IO, exe | IO, exe | ✗ | Malicious Server | ✗ |  Dataset: no given Models: ALS, PCA, GBT, LR, Naïve Bayes, LDA, K-means Platform: Intel SGX SDK, Aparch spark Baseline: Fully in Enclave | 1.7x speedup
[0.1pt/0.6pt] [FAML (Park et al., 2022), WWW, 2022] | SOI | Inference | TEE | - | IO | IO | ✗ | Malicious Server | ✗ |  Dataset: Adult, Bank, COMPAS, German, LSAC Models: LR, SVM, NN Baseline: Plaintext Model | 1.18-2.43x slowdown
[0.1pt/0.6pt] [AsymML (Niu et al., 2022), PETS, 2022] | SOT | Training | TEE | DP | IO, exe | IO, exe | ✗ | Malicious Server | ✓ |  Dataset: CIFAR10, ImageNet Models: VGG16/19, ResNet18/34 Platforms: Intel SGX, Pytorch Baseline: Fully in Enclave | 5.8-7.6x speedup
[0.1pt/0.6pt] [GINN, (Asvadishirehjini et al., 2022), CODASPY, 2022] | SOT | Training | TEE |  SKE/PKE SHA256 | IO, exe | IO, exe | ✗ | Malicious Server | ✓ |  Dataset: MNIST, CIFAR10 Models: VGG16/19, ResNet152, ResNet34s Baseline: Fully in Enclave | 2x-20x speedup

  * •

PM: Persistent Memory, DP: Differential Privacy, SKE: Symmetric Encryption,
PKE: Public Key Encryption;

Besides, CryptFlow (Kumar et al., 2020) leverages secret sharing to distribute
the sensitive input data to several servers and then achieves correctness and
confidentiality by cryptographic primitives and integrity by TEE technologies.
CryptFlow views the inference as one iteration of training, therefore their
method is also suitable for secure multiparty training.

###  4.4. Comparisons

A comprehensive comparison is made in Table 2 to compare existing secure
computation protocols for machine learning tasks (including training and
inference) with regard to our assessment criteria. It is not hard to employ
TEE to achieve basic confidentiality and integrity, thus most of the protocols
are designed against malicious parties. However, the references against side-
channel attacks and replay attacks are very scarce, except for (Ohrimenko et
al., 2016; Hunt et al., 2020). Besides, the references (Gu et al., 2018;
Tramèr and Boneh, 2019; Sun et al., 2020; Hashemi et al., 2021; Niu et al.,
2022; Asvadishirehjini et al., 2022) also present formal proof security
analysis for their proposals. As for performance, we observe that most of the
references compare their protocol with either the plaintext or the fully in
enclave baseline.

##  5\. Conclusions and Future Directions

The Trusted Execution Environment (TEE) has become increasingly popular for
both academic research and industrial adoption to achieve secure computation
with confidentiality and integrity guarantees. This survey provided a
comprehensive overview of state-of-the-art TEE-enabled secure computation
protocols. Rest on the proposed taxonomy and systematical assessment criteria,
we conducted comprehensive comparisons on TEE-enabled secure computation for
both general-purpose function and specific ones, including secure machine
learning and secure database queries which have wide applications in practice.
With the maturing and further development of TEE technologies, we envisage
that TEE-enabled secure computation would become a mainstream for practical
adoption in the near future. Below we discuss several remaining challenges and
future research directions of this promising technology.

  * •

General-purpose computation on large-scale data. As shown in the survey,
existing solutions for general-purpose secure computation are only runnable on
small-scale data. However, it is still very challenging to design general-
purpose protocols for large-scale data sets. Although moderately weakening the
security level to gain performance improvement is a viable strategy, balancing
the trade-off between security and performance is known non-trivial task for a
long time (Deutch et al., 2021).

  * •

Incremental computation for real-time systems. Since data is growing daily, it
is more practical to perform secure computation based on the previously
computed results and the new data. Incremental computation (Naor et al., 2019)
takes the new data and the previous results as inputs to derive the updated
results. We observe that many existing real-time systems employ the
incremental algorithm to achieve real-time response. Employing TEE to design
secure incremental computation protocols is very interesting and promising for
securing real-time applications. Besides, the technique could also be applied
to privacy preserving continual learning and reinforcement learning.

  * •

Mobile-friendly computation. Globally, mobile devices are significantly
outnumbering desktops and laptops. Although the computing power of mobile
devices have kept being improved, they still have limitations in terms of
capacity and resource, such as limited power supply and limited space for
cooling, etc. Utilizing TEE in mobile computing (Chakraborty et al., 2019;
Atamli-Reineh et al., 2016) and designing a mobile-firendly secure computation
framework (e.g., offloading (Kumar et al., 2013)) has not been well
investigated and is worth exploring.

  * •

System protection against untrusted computation. Secure computation assumes
that TEE’s host is malicious and thus achieves confidential computing on
sensitive data. In contrast, the untrusted computation means that the program
loaded into the TEE is destructive (e.g. Trojan Horse) and thus steals
sensitive information from the host. Designing novel approaches to prevent
TEE-based untrusted computation is another topic that demands further
investigation (Hunt et al., 2016; Park et al., 2020).

  * •

TEE trust management. TEE provides the confidentiality and integrity guarantee
of secure computation. However, in practice, not all parties fully trust the
TEE. For instance, parties may worry that the TEE is comprised/controlled by
another party and thus have no trust on TEE (Wu et al., 2022). On the other
hand, the minimal trust on TEE proposed in (Kumar et al., 2020) means that
secure computation protocols only make trust assumptions on the integrity
protection of the hardware, and the confidential computing is shifted to the
protocol design. Weakening or diversifying the trust on TEE is a promising
direction for future research.

###### Acknowledgements.

This reserch is supported by the AXA Research Fund and the National Natural
Science Foundation of China, No. 62202358.

## References

  * (1)
  * Allen et al. (2019) Joshua Allen, Bolin Ding, Janardhan Kulkarni, Harsha Nori, Olga Ohrimenko, and Sergey Yekhanin. 2019\.  An algorithmic framework for differentially private data analysis on trusted processors.  _Advances in Neural Information Processing Systems, (NeurIPS)_ 32 (2019).
  * Anati et al. (2013) Ittai Anati, Shay Gueron, Simon Johnson, and Vincent Scarlata. 2013\.  Innovative technology for CPU based attestation and sealing. In _Proc. on hardware and architectural support for security and privacy, (HASP)_ , Vol. 13.
  * Andrychowicz et al. (2014) Marcin Andrychowicz, Stefan Dziembowski, Daniel Malinowski, and Lukasz Mazurek. 2014.  Secure multiparty computations on bitcoin. In _IEEE Symposium on Security and Privacy, (S &P)_. 443–458.
  * Arasu et al. (2015) Arvind Arasu, Ken Eguro, Manas Joglekar, Raghav Kaushik, Donald Kossmann, and Ravi Ramamurthy. 2015\.  Transaction processing on confidential data using cipherbase. In _International Conference on Data Engineering, (ICDE)_. 435–446.
  * Asvadishirehjini et al. (2022) Aref Asvadishirehjini, Murat Kantarcioglu, and Bradley Malin. 2022\.  GINN: Fast GPU-TEE Based Integrity for Neural Network Training. In _Proceedings of the Twelveth ACM Conference on Data and Application Security and Privacy_. 4–15.
  * Atamli-Reineh et al. (2016) Ahmad Atamli-Reineh, Ravishankar Borgaonkar, Ranjbar A Balisane, Giuseppe Petracca, and Andrew Martin. 2016.  Analysis of trusted execution environment usage in samsung KNOX. In _Proc. of Workshop on System Software for Trusted Execution_. 1–6.
  * Bahmani et al. (2017) Raad Bahmani, Manuel Barbosa, Ferdinand Brasser, Bernardo Portela, Ahmad-Reza Sadeghi, Guillaume Scerri, and Bogdan Warinschi. 2017\.  Secure multiparty computation from SGX. In _International Conference on Financial Cryptography and Data Security, (FC)_. 477–497.
  * Bailleu et al. (2021) Maurice Bailleu, Dimitra Giantsidi, Vasilis Gavrielatos, Vijay Nagarajan, Pramod Bhatotia, et al. 2021\.  Avocado: A Secure In-Memory Distributed Storage System. In _2021 USENIX Annual Technical Conference, (USENIX ATC)_. 65–79.
  * Bailleu et al. (2019) Maurice Bailleu, Jorg Thalheim, Pramod Bhatotia, Christof Fetzer, Michio Honda, and Kapil Vaswani. 2019.  SPEICHER: Securing LSM-based Key-Value Stores using Shielded Execution. In _USENIX Conference on File and Storage Technologies, (FAST)_. 173–190.
  * Balnojan (2020) Sven Balnojan. 2020\.  _The Future Of Good Data — What You Should Know Now!_ Retrieved Oct 9, 2022 from https://towardsdatascience.com/the-future-of-good-data-what-you-should-know-now-f2a312a0e469
  * Bao et al. (1998) Feng Bao, Robert H Deng, and Wenbo Mao. 1998.  Efficient and practical fair exchange protocols with off-line TTP. In _Proc. IEEE Symposium on Security and Privacy, (S &P)_. 77–85.
  * Barbosa et al. (2016) Manuel Barbosa, Bernardo Portela, Guillaume Scerri, and Bogdan Warinschi. 2016.  Foundations of hardware-based attested computation and application to SGX. In _IEEE European Symposium on Security and Privacy, (EuroS &P)_. 245–260.
  * Bater et al. (2017) Johes Bater, Gregory Elliott, Craig Eggen, Satyender Goel, Abel N Kho, and Jennie Rogers. 2017\.  SMCQL: Secure Query Processing for Private Data Networks.  _Proc. VLDB Endow._ 10, 6 (2017), 673–684.
  * Bater et al. (2018) Johes Bater, Xi He, William Ehrich, Ashwin Machanavajjhala, and Jennie Rogers. 2018.  Shrinkwrap: efficient sql query processing in differentially private data federations.  _Proc. of the VLDB Endowment_ 12, 3 (2018).
  * Baumann et al. (2015) Andrew Baumann, Marcus Peinado, and Galen Hunt. 2015\.  Shielding applications from an untrusted cloud with haven.  _ACM Transactions on Computer Systems, (TOCS)_ 33, 3 (2015), 1–26.
  * Bellare et al. (2001) Mihir Bellare, Marc Fischlin, Shafi Goldwasser, and Silvio Micali. 2001.  Identification protocols secure against reset attacks. In _Proc. of EUROCRYPT_. 495–511.
  * Benhamouda et al. (2015) Fabrice Benhamouda, Geoffroy Couteau, David Pointcheval, and Hoeteck Wee. 2015.  Implicit zero-knowledge arguments and applications to the malicious setting. In _Annual Cryptology Conference, (CRYPTO)_. 107–129.
  * Bentov et al. (2019) Iddo Bentov, Yan Ji, Fan Zhang, Lorenz Breidenbach, Philip Daian, and Ari Juels. 2019\.  Tesseract: Real-time cryptocurrency exchange using trusted hardware. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 1521–1538.
  * Blum (1983) Manuel Blum. 1983\.  How to exchange (secret) keys.  _ACM Transactions on computer systems, (TOCS)_ 1, 2 (1983), 175–193.
  * Bogdanov et al. (2008) Dan Bogdanov, Sven Laur, and Jan Willemson. 2008.  Sharemind: A framework for fast privacy-preserving computations. In _European Symposium on Research in Computer Security, (ESORICS)_. 192–206.
  * Boulemtafes et al. (2020) Amine Boulemtafes, Abdelouahid Derhab, and Yacine Challal. 2020.  A review of privacy-preserving techniques for deep learning.  _Neurocomputing_ 384 (2020), 21–45.
  * Bowe et al. (2020) Sean Bowe, Alessandro Chiesa, Matthew Green, Ian Miers, Pratyush Mishra, and Howard Wu. 2020\.  Zexe: Enabling decentralized private computation. In _IEEE Symposium on Security and Privacy, (S &P)_. 947–964.
  * Brito et al. (2021) Cláudia Brito, Pedro Ferreira, Bernardo Portela, Rui Oliveira, and João Paulo. 2021\.  Soteria: Privacy-Preserving Machine Learning for Apache Spark.  _Cryptology ePrint Archive_ (2021).
  * Büscher et al. (2018) Niklas Büscher, Daniel Demmler, Stefan Katzenbeisser, David Kretzmer, and Thomas Schneider. 2018\.  HyCC: Compilation of hybrid protocols for practical secure computation. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 847–861.
  * Canetti et al. (2007) Ran Canetti, Yevgeniy Dodis, Rafael Pass, and Shabsi Walfish. 2007.  Universally composable security with global setup. In _Theory of Cryptography Conference, (TCC)_. 61–85.
  * Chakraborty et al. (2019) Dhiman Chakraborty, Lucjan Hanzlik, and Sven Bugiel. 2019\.  simTPM: User-centric TPM for Mobile Devices. In _USENIX Security Symposium_. 533–550.
  * Champagne and Lee (2010) David Champagne and Ruby B Lee. 2010.  Scalable architectural support for trusted software. In _The International Symposium on High-Performance Computer Architecture, (HPCA)_. 1–12.
  * Chang et al. (2022) Zhao Chang, Dong Xie, Sheng Wang, and Feifei Li. 2022\.  Towards Practical Oblivious Join.  (2022).
  * Choi and Butler (2019) Joseph I Choi and Kevin RB Butler. 2019.  Secure multiparty computation and trusted hardware: Examining adoption challenges and opportunities.  _Security and Communication Networks_ (2019).
  * Choi et al. (2019) Joseph I Choi, Dave Tian, Grant Hernandez, Christopher Patton, Benjamin Mood, Thomas Shrimpton, Kevin RB Butler, and Patrick Traynor. 2019\.  A hybrid approach to secure function evaluation using SGX. In _Proc. of ACM Asia Conference on Computer and Communications Security, (AsiaCCS)_. 100–113.
  * Choudhuri et al. (2017) Arka Rai Choudhuri, Matthew Green, Abhishek Jain, Gabriel Kaptchuk, and Ian Miers. 2017\.  Fairness in an unfair world: Fair multiparty computation from public bulletin boards. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 719–728.
  * Cleve (1986) Richard Cleve. 1986\.  Limits on the security of coin flips when half the processors are faulty. In _Proc. ACM symposium on Theory of computing, (STOC)_. 364–369.
  * Correia et al. (2020) Cláudio Correia, Miguel Correia, and Luís Rodrigues. 2020.  Omega: a secure event ordering service for the edge. In _Annual IEEE/IFIP International Conference on Dependable Systems and Networks, (DSN)_. 489–501.
  * Costan and Devadas (2016) Victor Costan and Srinivas Devadas. 2016.  Intel SGX explained.  _Manuscript_ (2016).
  * Costan et al. (2016) Victor Costan, Ilia Lebedev, and Srinivas Devadas. 2016\.  Sanctum: Minimal hardware extensions for strong software isolation. In _USENIX Security Symposium_. 857–874.
  * Cramer et al. (2000) Ronald Cramer, Ivan Damgård, and Ueli Maurer. 2000\.  General secure multi-party computation from any linear secret-sharing scheme. In _Proc. of EUROCRYPT_. 316–334.
  * Damgård et al. (2013) Ivan Damgård, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P Smart. 2013\.  Practical covertly secure MPC for dishonest majority–or: breaking the SPDZ limits. In _European Symposium on Research in Computer Security, (ESORICS)_. 1–18.
  * Damgård et al. (2012) Ivan Damgård, Valerio Pastro, Nigel Smart, and Sarah Zakarias. 2012.  Multiparty computation from somewhat homomorphic encryption. In _Annual Cryptology Conference, (CRYPTO)_. 643–662.
  * Dang et al. (2017) Hung Dang, Tien Tuan Anh Dinh, Ee-Chien Chang, and Beng Chin Ooi. 2017.  Privacy-Preserving Computation with Trusted Computing via Scramble-then-Compute.  _Proc. Priv. Enhancing Technol. (PET)_ 2017, 3 (2017), 21\.
  * Dang et al. (2019) Hung Dang, Dat Le Tien, and Ee-Chien Chang. 2019.  Towards a marketplace for secure outsourced computations. In _European Symposium on Research in Computer Security_. 790–808.
  * Dave et al. (2020) Ankur Dave, Chester Leung, Raluca Ada Popa, Joseph E Gonzalez, and Ion Stoica. 2020\.  Oblivious coopetitive analytics using hardware enclaves. In _Proc. of the European Conference on Computer Systems_. 1–17.
  * Demmler et al. (2015) Daniel Demmler, Thomas Schneider, and Michael Zohner. 2015\.  ABY-A framework for efficient mixed-protocol secure two-party computation.. In _Network and Distributed System Security, (NDSS)_.
  * Deutch et al. (2021) Daniel Deutch, Ariel Frankenthal, Amir Gilad, and Yuval Moskovitch. 2021.  On optimizing the trade-off between privacy and utility in data provenance. In _Proc. of International Conference on Management of Data, (SIDMOD)_. 379–391.
  * Ding and Suel (2011) Shuai Ding and Torsten Suel. 2011.  Faster top-k document retrieval using block-max indexes. In _Proc. ACM conference on Research and development in Information Retrieval, (SIGIR)_. 993–1002.
  * Dinh et al. (2015) Tien Tuan Anh Dinh, Prateek Saxena, Ee-Chien Chang, Beng Chin Ooi, and Chunwang Zhang. 2015\.  M2R: Enabling Stronger Privacy in MapReduce Computation. In _USENIX Security Symposium_. 447–462.
  * Doerner and Shelat (2017) Jack Doerner and Abhi Shelat. 2017.  Scaling ORAM for secure computation. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 523–535.
  * Duan et al. (2019) Huayi Duan, Cong Wang, Xingliang Yuan, Yajin Zhou, Qian Wang, and Kui Ren. 2019\.  LightBox: Full-stack protected stateful middlebox at lightning speed. In _Proc. of the ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 2351–2367.
  * Duy et al. (2021) Kha Dinh Duy, Taehyun Noh, Siwon Huh, and Hojoon Lee. 2021\.  Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective.  _IEEE Access_ 9 (2021), 168656–168677.
  * Eskandarian and Zaharia (2019) Saba Eskandarian and Matei Zaharia. 2019.  ObliDB: oblivious query processing for secure databases.  _Proc. of the VLDB Endowment_ 13, 2 (2019), 169–183.
  * Fei et al. (2021) Shufan Fei, Zheng Yan, Wenxiu Ding, and Haomeng Xie. 2021\.  Security vulnerabilities of SGX and countermeasures: A survey.  _ACM Computing Surveys, (CSUR)_ 54, 6 (2021), 1–36.
  * Felsen et al. (2019) Susanne Felsen, Ágnes Kiss, Thomas Schneider, and Christian Weinert. 2019.  Secure and private function evaluation with Intel SGX. In _Proc. of ACM SIGSAC Conference on Cloud Computing Security Workshop, (CCSW)_. 165–181.
  * Ferreira et al. (2020) Bernardo Ferreira, Bernardo Portela, Tiago Oliveira, Guilherme Borges, Henrique Joao Domingos, and Joao Leitao. 2020.  Boolean searchable symmetric encryption with filters on trusted hardware.  _IEEE Transactions on Dependable and Secure Computing_ (2020).  https://doi.org/10.1109/TDSC.2020.3012100
  * Fuhry et al. (2017) Benny Fuhry, Raad Bahmani, Ferdinand Brasser, Florian Hahn, Florian Kerschbaum, and Ahmad-Reza Sadeghi. 2017.  HardIDX: Practical and secure index with SGX. In _IFIP Annual Conference on Data and Applications Security and Privacy, (DBSec)_. 386–408.
  * Futral and Greene (2013) William Futral and James Greene. 2013.  Fundamental Principles of Intel® TXT.  In _Intel® Trusted Execution Technology for Server Platforms_. 15–36.
  * Gentry (2009) Craig Gentry. 2009\.  Fully homomorphic encryption using ideal lattices. In _Proc. of ACM symposium on Theory of computing, (STOC)_. 169–178.
  * Goldreich et al. (1987) Oded Goldreich, Silvio Micali, and Avi Wigderson. 1987\.  How to play any mental game, or a completeness theorem for protocols with honest majority.  In _Proc. of ACM symposium on Theory of computing, (STOC)_. 307–328.
  * Goldreich and Ostrovsky (1996) Oded Goldreich and Rafail Ostrovsky. 1996.  Software protection and simulation on oblivious RAMs.  _Journal of the ACM (JACM)_ 43, 3 (1996), 431–473.
  * Grover et al. (2018) Karan Grover, Shruti Tople, Shweta Shinde, Ranjita Bhagwan, and Ramachandran Ramjee. 2018\.  Privado: Practical and secure DNN inference with enclaves.  _arXiv preprint:1810.00602_ (2018).
  * Gu et al. (2018) Zhongshu Gu, Heqing Huang, Jialong Zhang, Dong Su, Ankita Lamba, Dimitrios Pendarakis, and Ian Molloy. 2018.  Securing input data of deep learning inference systems via partitioned enclave execution.  _arXiv preprint arXiv:1807.00969_ (2018).
  * Gupta et al. (2016) Debayan Gupta, Benjamin Mood, Joan Feigenbaum, Kevin Butler, and Patrick Traynor. 2016.  Using intel software guard extensions for efficient two-party secure function evaluation. In _International Conference on Financial Cryptography and Data Security, (FC)_. 302–318.
  * Halpern and Teague (2004) Joseph Halpern and Vanessa Teague. 2004.  Rational secret sharing and multiparty computation. In _Proc. of ACM symposium on Theory of computing, (STOC)_. 623–632.
  * Hanzlik et al. (2021) Lucjan Hanzlik, Yang Zhang, Kathrin Grosse, Ahmed Salem, Maximilian Augustin, Michael Backes, and Mario Fritz. 2021.  Mlcapsule: Guarded offline deployment of machine learning as a service. In _Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition, (CVPR)_. 3300–3309.
  * Hashemi et al. (2021) Hanieh Hashemi, Yongqin Wang, and Murali Annavaram. 2021\.  DarKnight: An accelerated framework for privacy and integrity preserving deep learning using trusted hardware. In _MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture_. 212–224.
  * Hesamifard et al. (2018) Ehsan Hesamifard, Hassan Takabi, Mehdi Ghasemi, and Rebecca N Wright. 2018.  Privacy-preserving machine learning as a service.  _Proc. Priv. Enhancing Technol._ 2018, 3 (2018), 123–142.
  * Hou et al. (2021) Jiahui Hou, Huiqi Liu, Yunxin Liu, Yu Wang, Peng-Jun Wan, and Xiang-Yang Li. 2021\.  Model Protection: Real-time Privacy-preserving Inference Service for Model Privacy at the Edge.  _IEEE Transactions on Dependable and Secure Computing_ (2021).
  * Huang et al. (2021) Anbu Huang, Yang Liu, Tianjian Chen, Yongkai Zhou, Quan Sun, Hongfeng Chai, and Qiang Yang. 2021.  StarFL: Hybrid federated learning architecture for smart urban computing.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ 12, 4 (2021), 1–23.
  * Hunt et al. (2020) Tyler Hunt, Zhipeng Jia, Vance Miller, Ariel Szekely, Yige Hu, Christopher J Rossbach, and Emmett Witchel. 2020.  Telekine: Secure Computing with Cloud GPUs. In _USENIX Symposium on Networked Systems Design and Implementation, (NSDI)_. 817–833.
  * Hunt et al. (2018) Tyler Hunt, Congzheng Song, Reza Shokri, Vitaly Shmatikov, and Emmett Witchel. 2018.  Chiron: Privacy-preserving machine learning as a service.  _arXiv preprint:1803.05961_ (2018).
  * Hunt et al. (2016) Tyler Hunt, Zhiting Zhu, Yuanzhong Xu, Simon Peter, and Emmett Witchel. 2016.  Ryoan: A Distributed Sandbox for Untrusted Computation on Secret Data. In _USENIX Symposium on Operating Systems Design and Implementation, (OSDI)_. 533–549.
  * Jacomme et al. (2017) Charlie Jacomme, Steve Kremer, and Guillaume Scerri. 2017\.  Symbolic models for isolated execution environments. In _IEEE European Symposium on Security and Privacy, (EuroS &P)_. 530–545.
  * Kaplan et al. (2016) David Kaplan, Jeremy Powell, and Tom Woller. 2016\.  AMD memory encryption.  _White paper_ (2016).
  * Kaptchuk et al. (2017) Gabriel Kaptchuk, Ian Miers, and Matthew Green. 2017\.  Giving state to the stateless: Augmenting trustworthy computation with ledgers.  _Network and Distributed System Security, (NDSS)_ (2017).
  * Kato et al. (2021) Fumiyuki Kato, Yang Cao, and Mastoshi Yoshikawa. 2021.  PCT-TEE: Trajectory-based Private Contact Tracing System with Trusted Execution Environment.  _ACM Transactions on Spatial Algorithms and Systems, (TSAS)_ 8, 2 (2021), 1–35.
  * Kim et al. (2020) Kyungtae Kim, Chung Hwan Kim, Junghwan” John” Rhee, Xiao Yu, Haifeng Chen, Dave Tian, and Byoungyoung Lee. 2020.  Vessels: efficient and scalable deep learning prediction on trusted processors. In _Proc. of the 11th ACM Symposium on Cloud Computing_. 462–476.
  * Kim et al. (2019) Taehoon Kim, Joongun Park, Jaewook Woo, Seungheun Jeon, and Jaehyuk Huh. 2019.  Shieldstore: Shielded in-memory key-value storage with sgx. In _Proc. of EuroSys_. 1–15.
  * Kolesnikov and Kumaresan (2013) Vladimir Kolesnikov and Ranjit Kumaresan. 2013.  Improved OT extension for transferring short secrets. In _Annual Cryptology Conference, (CRYPTO)_. 54–70.
  * Krastnikov et al. (2021) Simeon Krastnikov, Florian Kerschbaum, and Douglas Stebila. 2021\.  Efficient Oblivious Database Joins.  _Proc. of the VLDB Endowment_ 13, 11 (2021).
  * Kreuter et al. (2012) Benjamin Kreuter, Abhi Shelat, and Chih-Hao Shen. 2012\.  Billion-Gate Secure Computation with Malicious Adversaries. In _21st USENIX Security Symposium, (USENIX Security)_. 285–300.
  * Kumar et al. (2013) Karthik Kumar, Jibang Liu, Yung-Hsiang Lu, and Bharat Bhargava. 2013.  A survey of computation offloading for mobile systems.  _Mobile networks and Applications_ 18, 1 (2013), 129–140.
  * Kumar et al. (2020) Nishant Kumar, Mayank Rathee, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. 2020\.  Cryptflow: Secure tensorflow inference. In _IEEE Symposium on Security and Privacy, (S &P)_. 336–353.
  * Kunkel et al. (2019) Roland Kunkel, Do Le Quoc, Franz Gregor, Sergei Arnautov, Pramod Bhatotia, and Christof Fetzer. 2019\.  Tensorscone: A secure tensorflow framework using intel sgx.  _arXiv preprint:1902.04413_ (2019).
  * Kuznetsov et al. (2021) Eugene Kuznetsov, Yitao Chen, and Ming Zhao. 2021.  SecureFL: Privacy preserving federated learning with sgx and trustzone. In _2021 IEEE/ACM Symposium on Edge Computing (SEC)_. IEEE, 55–67.
  * Lee et al. (2020) Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanović, and Dawn Song. 2020\.  Keystone: An open framework for architecting trusted execution environments. In _Proc. of European Conference on Computer Systems, (EuroSys)_. 1–16.
  * Lee et al. (2019) Taegyeong Lee, Zhiqi Lin, Saumay Pushp, Caihua Li, Yunxin Liu, Youngki Lee, Fengyuan Xu, Chenren Xu, Lintao Zhang, and Junehwa Song. 2019\.  Occlumency: Privacy-preserving remote deep-learning inference using SGX. In _Annual International Conference on Mobile Computing and Networking, (MobiCom)_. 1–17.
  * Lie et al. (2000) David Lie, Chandramohan Thekkath, Mark Mitchell, Patrick Lincoln, Dan Boneh, John Mitchell, and Mark Horowitz. 2000.  Architectural support for copy and tamper resistant software.  _ACM SIGPLAN Notices_ 35, 11 (2000), 168–177.
  * Limited (2009) ARM Limited. 2009\.  _ARM Security Technology-Building a Secure System using TrustZone Technology_.  Technical Report.
  * Lind et al. (2018) Joshua Lind, Oded Naor, Ittay Eyal, Florian Kelbert, Peter Pietzuch, and Emin Gün Sirer. 2018.  Teechain: Reducing storage costs on the blockchain with offline payment channels. In _Proc. of ACM International Systems and Storage Conference, (SYSTOR)_. 125–125.
  * Lindell and Pinkas (2007) Yehuda Lindell and Benny Pinkas. 2007.  An efficient protocol for secure two-party computation in the presence of malicious adversaries. In _Annual Cryptology Conference, (CRYPTO)_. 52–78.
  * Liu et al. (2014) Chang Liu, Yan Huang, Elaine Shi, Jonathan Katz, and Michael Hicks. 2014.  Automating efficient RAM-model secure computation. In _IEEE Symposium on Security and Privacy, (S &P)_. 623–638.
  * Liu et al. (2021) Renju Liu, Luis Garcia, Zaoxing Liu, Botong Ou, and Mani Srivastava. 2021.  SecDeep: Secure and Performant On-device Deep Learning Inference Framework for Mobile and IoT Devices. In _Proceedings of the International Conference on Internet-of-Things Design and Implementation_. 67–79.
  * Luby et al. (1983) Michael Luby, Silvio Micali, and Charles Rackoff. 1983\.  How to simultaneously exchange a secret bit by flipping a symmetrically-biased coin. In _Annual Symposium on Foundations of Computer Science, (FOCS)_. 11–22.
  * Maas et al. (2013) Martin Maas, Eric Love, Emil Stefanov, Mohit Tiwari, Elaine Shi, Krste Asanovic, John Kubiatowicz, and Dawn Song. 2013\.  Phantom: Practical oblivious computation in a secure processor. In _Proc. of ACM SIGSAC conference on Computer & communications security, (CCS)_. 311–324.
  * Malka (2011) Lior Malka. 2011\.  Vmcrypt: modular software architecture for scalable secure computation. In _Proc. of ACM conference on Computer and communications security, (CCS)_. 715–724.
  * Martignoni et al. (2012) Lorenzo Martignoni, Pongsin Poosankam, Matei Zaharia, Jun Han, Stephen McCamant, Dawn Song, Vern Paxson, Adrian Perrig, Scott Shenker, and Ion Stoica. 2012.  Cloud terminal: secure access to sensitive applications from untrusted systems. In _USENIX ATC_. 165–182.
  * Mazloom and Gordon (2018) Sahar Mazloom and S Dov Gordon. 2018.  Secure computation with differentially private access patterns. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 490–507.
  * McKeen et al. (2013) Frank McKeen, Ilya Alexandrovich, Alex Berenzon, Carlos V Rozas, Hisham Shafi, Vedvyas Shanbhogue, and Uday R Savagaonkar. 2013.  Innovative instructions and software model for isolated execution.. In _Proc. on hardware and architectural support for security and privacy, (HASP)_ , Vol. 10.
  * Mo et al. (2021) Fan Mo, Hamed Haddadi, Kleomenis Katevas, Eduard Marin, Diego Perino, and Nicolas Kourtellis. 2021\.  PPFL: privacy-preserving federated learning with trusted execution environments. In _Proc. on Mobile Systems, Applications, and Services, (MobiSys)_. 94–108.
  * Mo et al. (2020) Fan Mo, Ali Shahin Shamsabadi, Kleomenis Katevas, Soteris Demetriou, Ilias Leontiadis, Andrea Cavallaro, and Hamed Haddadi. 2020\.  DarkneTZ: towards model privacy at the edge using trusted execution environments. In _Proc. of the International Conference on Mobile Systems, Applications, and Services, (MobiSys)_. 161–174.
  * Naor et al. (2019) Moni Naor, Omer Paneth, and Guy N Rothblum. 2019.  Incrementally verifiable computation via incremental PCPs. In _Theory of Cryptography Conference_. 552–576.
  * Narra et al. (2019) Krishna Giri Narra, Zhifeng Lin, Yongqin Wang, Keshav Balasubramaniam, and Murali Annavaram. 2019.  Privacy-preserving inference in machine learning services using trusted execution environments.  _arXiv preprint arXiv:1912.03485_ (2019).
  * Ng et al. (2020) Jer Shyuan Ng, Wei Yang Bryan Lim, Nguyen Cong Luong, Zehui Xiong, Alia Asheralieva, Dusit Niyato, Cyril Leung, and Chunyan Miao. 2020\.  A survey of coded distributed computing.  _arXiv preprint:2008.09048_ (2020).
  * Ng et al. (2021) Lucien KL Ng, Sherman SM Chow, Anna PY Woo, Donald PH Wong, and Yongjun Zhao. 2021.  Goten: GPU-Outsourcing trusted execution of neural network training. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 35. 14876–14883.
  * Niu et al. (2021) Yue Niu, Ramy E Ali, and Salman Avestimehr. 2021.  AsymML: An Asymmetric Decomposition Framework for Privacy-Preserving DNN Training and Inference.  _arXiv preprint arXiv:2110.01229_ (2021).
  * Niu et al. (2022) Yue Niu, Ramy E Ali, and Salman Avestimehr. 2022.  3LegRace: Privacy-Preserving DNN Training over TEEs and GPUs. In _Proceedings of privacy enhancing technologies_. 1–21.
  * Ohrimenko et al. (2015) Olga Ohrimenko, Manuel Costa, Cédric Fournet, Christos Gkantsidis, Markulf Kohlweiss, and Divya Sharma. 2015.  Observing and preventing leakage in MapReduce. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 1570–1581.
  * Ohrimenko et al. (2016) Olga Ohrimenko, Felix Schuster, Cédric Fournet, Aastha Mehta, Sebastian Nowozin, Kapil Vaswani, and Manuel Costa. 2016.  Oblivious Multi-Party Machine Learning on Trusted Processors. In _USENIX Security Symposium_. 619–636.
  * Ozga et al. (2021) Wojciech Ozga, Do Le Quoc, and Christof Fetzer. 2021\.  Perun: Confidential Multi-stakeholder Machine Learning Framework with Hardware Acceleration Support. In _IFIP Annual Conference on Data and Applications Security and Privacy_. Springer, 189–208.
  * Paillier (1999) Pascal Paillier. 1999\.  Public-key cryptosystems based on composite degree residuosity classes. In _Proc. of EUROCRYPT_. 223–238.
  * Park et al. (2019) Heejin Park, Shuang Zhai, Long Lu, and Felix Xiaozhu Lin. 2019\.  StreamBox-TZ: Secure Stream Analytics at the Edge with TrustZone. In _2019 USENIX Annual Technical Conference (USENIX ATC 19)_. 537–554.
  * Park et al. (2020) Joongun Park, Naegyeong Kang, Taehoon Kim, Youngjin Kwon, and Jaehyuk Huh. 2020.  Nested enclave: supporting fine-grained hierarchical isolation with SGX. In _ACM/IEEE Annual International Symposium on Computer Architecture, (ISCA)_. 776–789.
  * Park et al. (2022) Saerom Park, Seongmin Kim, and Yeon-sup Lim. 2022.  Fairness Audit of Machine Learning Models with Confidential Computing. In _Proceedings of the ACM Web Conference 2022_. 3488–3499.
  * Pass et al. (2017) Rafael Pass, Elaine Shi, and Florian Tramer. 2017.  Formal abstractions for attested execution secure processors. In _Annual International Conference on the Theory and Applications of Cryptographic Techniques, (EUROCRYPT)_. 260–289.
  * Patra et al. (2021) Arpita Patra, Thomas Schneider, Ajith Suresh, and Hossein Yalame. 2021.  ABY2. 0: Improved Mixed-Protocol Secure Two-Party Computation. In _USENIX Security Symposium_. 2165–2182.
  * Paul and Shrivastava (2019) Souradyuti Paul and Ananya Shrivastava. 2019.  Efficient fair multiparty protocols using Blockchain and trusted hardware. In _International Conference on Cryptology and Information Security in Latin America_. 301–320.
  * Platform (2013) Global Platform. 2013\.  Global platform made simple guide: Trusted execution environment (tee) guide.  _Derniere visite_ 12, 4 (2013).
  * Popa et al. (2011) Raluca Ada Popa, Catherine MS Redfield, Nickolai Zeldovich, and Hari Balakrishnan. 2011\.  CryptDB: protecting confidentiality with encrypted query processing. In _Proc. ACM Symposium on Operating Systems Principles_. 85–100.
  * Poulsen (2001) Kevin Poulsen. 2001\.  DirecTV attacks hacked smart cards.  _The Register_ (2001).
  * Priebe et al. (2018) Christian Priebe, Kapil Vaswani, and Manuel Costa. 2018\.  EnclaveDB: A secure database using SGX. In _Proc. IEEE Symposium on Security and Privacy, (S &P)_. 264–278.
  * Quoc et al. (2020) Do Le Quoc, Franz Gregor, Sergei Arnautov, Roland Kunkel, Pramod Bhatotia, and Christof Fetzer. 2020\.  secureTF: a secure TensorFlow framework. In _Proceedings of the 21st International Middleware Conference_. 44–59.
  * Ren et al. (2021) Yixuan Ren, Yixin Jie, Qingtao Wang, Bingbing Zhang, Chi Zhang, and Lingbo Wei. 2021\.  A Hybrid Secure Computation Framework for Graph Neural Networks. In _Proc. on Privacy, Security and Trust, (PST)_. 1–6.
  * RishabhPoddar and Hellerstein (2014) CharlesLin SukritKalra RishabhPoddar and Raluca Ada Popa Joe Hellerstein. 2014\.  Secure Federated Analytics.  (2014).
  * Santos et al. (2012) Nuno Santos, Rodrigo Rodrigues, Krishna P Gummadi, and Stefan Saroiu. 2012.  Policy-Sealed Data: A New Abstraction for Building Trusted Cloud Services. In _USENIX Security Symposium_. 175–188.
  * Sasy et al. (2017) Sajin Sasy, Sergey Gorbunov, and Christopher W Fletcher. 2017\.  Zerotrace: Oblivious memory primitives from intel sgx.  _Network and Distributed System Security, (NDSS)_ (2017).
  * Sasy and Ohrimenko (2019) Sajin Sasy and Olga Ohrimenko. 2019.  Oblivious sampling algorithms for private data analysis.  _Advances in Neural Information Processing Systems_ 32 (2019).
  * Schlögl and Böhme (2020) Alexander Schlögl and Rainer Böhme. 2020.  eNNclave: offline inference with model confidentiality. In _Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security_. 93–104.
  * Schuster et al. (2015) Felix Schuster, Manuel Costa, Cédric Fournet, Christos Gkantsidis, Marcus Peinado, Gloria Mainar-Ruiz, and Mark Russinovich. 2015\.  VC3: Trustworthy data analytics in the cloud using SGX. In _IEEE symposium on security and privacy, (S &P)_. 38–54.
  * Shamir (1979) Adi Shamir. 1979\.  How to share a secret.  _Commun. ACM_ 22, 11 (1979), 612–613.
  * Shan et al. (2018) Zihao Shan, Kui Ren, Marina Blanton, and Cong Wang. 2018\.  Practical secure computation outsourcing: A survey.  _ACM Computing Surveys (CSUR)_ 51, 2 (2018), 1–40.
  * Shao et al. (2020) Jinjin Shao, Shiyu Ji, Alvin Oliver Glova, Yifan Qiao, Tao Yang, and Tim Sherwood. 2020\.  Index obfuscation for oblivious document retrieval in a trusted execution environment. In _Proceedings of the 29th ACM International Conference on Information & Knowledge Management_. 1345–1354.
  * Shaon et al. (2017) Fahad Shaon, Murat Kantarcioglu, Zhiqiang Lin, and Latifur Khan. 2017.  Sgx-bigmatrix: A practical encrypted data analytic framework with trusted processors. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 1211–1228.
  * Singh et al. (2021) Jatinder Singh, Jennifer Cobbe, Do Le Quoc, and Zahra Tarkhani. 2021.  Enclaves in the Clouds.  _Commun. ACM_ 64, 5 (2021), 42–51.
  * Sinha et al. (2019) Rohit Sinha, Sivanarayana Gaddam, and Ranjit Kumaresan. 2019\.  LucidiTEE: A TEE-Blockchain System for Policy-Compliant Multiparty Computation with Fairness.  _Cryptology ePrint Archive_ (2019).
  * Skorobogatov (2016) Sergei Skorobogatov. 2016\.  The bumpy road towards iPhone 5c NAND mirroring.  _arXiv preprint:1609.04327_ (2016).
  * Smartcard (1988) Smartcard 1988.  NIST Special Publication 500-157. Smart Card Technology: New Methods for Computer Access Control.  https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-157.pdf.
  * Son et al. (2021) Jeongseok Son, Griffin Prechter, Rishabh Poddar, Raluca Ada Popa, and Koushik Sen. 2021.  ObliCheck: Efficient Verification of Oblivious Algorithms with Unobservable State. In _USENIX Security Symposium_.
  * Stefanov et al. (2018) Emil Stefanov, Marten Van Dijk, Elaine Shi, T-H Hubert Chan, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas. 2018\.  Path ORAM: an extremely simple oblivious RAM protocol.  _Journal of the ACM (JACM)_ 65, 4 (2018), 1–26.
  * Subramanyan et al. (2017) Pramod Subramanyan, Rohit Sinha, Ilia Lebedev, Srinivas Devadas, and Sanjit A Seshia. 2017.  A formal foundation for secure remote execution of enclaves. In _Proc. of ACM SIGSAC Conference on Computer and Communications Security, (CCS)_. 2435–2450.
  * Sumrall and Novoa (2003) Nancy Sumrall and Manny Novoa. 2003.  Trusted computing group (TCG) and the TPM 1.2 specification. In _Intel Developer Forum_ , Vol. 32.
  * Sun et al. (2021) Yuanyuan Sun, Sheng Wang, Huorong Li, and Feifei Li. 2021\.  Building enclave-native storage engines for practical encrypted databases.  _Proc. of the VLDB Endowment_ 14, 6 (2021), 1019–1032.
  * Sun et al. (2020) Zhichuang Sun, Ruimin Sun, Changming Liu, Amrita Roy Chowdhury, Somesh Jha, and Long Lu. 2020\.  ShadowNet: A secure and efficient system for on-device model inference.  _arXiv preprint arXiv:2011.05905_ (2020).
  * Tamrakar et al. (2017) Sandeep Tamrakar, Jian Liu, Andrew Paverd, Jan-Erik Ekberg, Benny Pinkas, and N Asokan. 2017\.  The circle game: Scalable private membership test using trusted hardware. In _Proc. of ACM on Asia Conference on Computer and Communications Security, (AsiaCCS)_. 31–44.
  * Tramèr and Boneh (2019) Florian Tramèr and Dan Boneh. 2019.  Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware. In _7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019_.
  * Veugen et al. (2015) Thijs Veugen, Frank Blom, Sebastiaan JA de Hoogh, and Zekeriya Erkin. 2015.  Secure comparison protocols in the semi-honest model.  _IEEE Journal of Selected Topics in Signal Processing_ 9, 7 (2015), 1217–1228.
  * Vinayagamurthy et al. (2019) Dhinakaran Vinayagamurthy, Alexey Gribov, and Sergey Gorbunov. 2019\.  StealthDB: a Scalable Encrypted Database with Full SQL Query Support.  _Proc. Priv. Enhancing Technol. (PETS)_ 2019, 3 (2019), 370–388.
  * Volgushev et al. (2019) Nikolaj Volgushev, Malte Schwarzkopf, Ben Getchell, Mayank Varia, Andrei Lapets, and Azer Bestavros. 2019\.  Conclave: secure multi-party computation on big data. In _Proc. of European Conference on Computer Systems, (EuroSys)_. 1–18.