DoTI:面向数据业务的TEE融合技术研究  

DoTI:research on data-oriented TEE integration technology

作　　者：马承彦 卢笛[2] 马鑫迪 习宁 王锦锦 马建峰 MA Chengyan;LU Di;MA Xindi;XI Ning;WANG Jinjin;MA Jianfeng(School of Cyber Engineering,Xidian University,Xi’an 710071,China;School of Computer Science and Technology,Xidian University,Xi’an 710071,China;School of Computer Science,University of Birmingham,Birmingham B152TT,UK)

机构地区：[1]西安电子科技大学网络与信息安全学院,陕西西安710071 [2]西安电子科技大学计算机科学与技术学院,陕西西安710071 [3]伯明翰大学计算机科学学院,英国伯明翰B152TT

出　　处：《通信学报》2025年第2期18-28,共11页Journal on Communications

基　　金：国家重点研发计划基金资助项目(No.2023YFE0111100);国家自然科学基金资助项目(No.62232013,No.62220106004,No.92167203,No.92267204,No.62402364);陕西省重点研发计划基金资助项目(No.2023-ZDLGY-52)。

摘　　要：协同平台面临系统和数据安全的挑战,可信执行环境(TEE)通过硬件隔离技术实现基于明文的机密计算,确保代码和数据的机密性与完整性。然而,异构的TEE技术使得同一份代码或程序无法直接在不同TEE架构中直接运行并相互提供可信的数据操作接口,导致跨TEE场景下任务协同执行的安全问题。为了解决上述问题,提出一种基于数据操纵语言的TEE融合技术DoTI,从数据处理的业务层解决跨TEE的数据安全交互问题,并结合基于属性加密的密码学方法保持多TEE协同的隔离性。实验结果表明,在DoTI环境下迁移至TEE的数据库性能约为原始数据库的119.15%,且网络通信能力优于现有方案,能够满足协同平台数据共享的可用性和安全性要求。Collaborative platforms face the challenges of system and data security.Trusted execution environment(TEE)implements plaintext-based confidential computing through hardware isolation technology,ensuring the confidentiality and integrity of code and data.However,heterogeneous TEE technologies lead to security issues in data interoperability across TEE.To address the aforementioned issues,a TEE integration technology based on data manipulation language was proposed,combined with the cryptography method of attribute-based encryption to maintain the isolation of TEE.The experimental results show that the performance of the database migrated to TEE in DoTI is about 119.15%of the original database,and the network communication performance is better than existing solutions,which can meet the availability and security of data sharing in the collaborative platform.

关 键 词：协同平台 可信执行环境 数据操纵语言 基于属性的加密 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]