一句话：提出基于 Intel SGX 的沙箱运行时监控框架 Pave，用信息流控制保障远程数据处理中的用户数据隐私。
在线数据处理服务中，用户通常把个人数据交给远程服务器，却无法控制其后续使用，也难以确认数据不会泄漏。Pave 为此提出一种保障远程处理隐私的框架：它让任意数据处理程序运行在沙箱中，并由运行时监控器 PaveBox 拦截所有进出沙箱的数据流，只放行不会危害用户数据的数据流，同时尽量不阻碍良性的数据流以维持程序功能。PaveBox 构建在 Intel SGX 之上，用户可通过远程认证验证其完整性与机密性。作者给出 Pave 的形式化模型，证明其安全性，并通过基于原型的实验进行定量分析。
In online data-processing services, a user typically hands over personal data to a remote server beyond the user's control. In such environments, the user cannot be assured that the data is protected from potential leaks. We introduce Pave, a new framework to guarantee data privacy while being processed remotely. Pave provides an arbitrary data-processing program with a sandboxed execution environment. The runtime monitor, PaveBox, intercepts all data flows into and out of the sandbox, allowing them only if they do not compromise user data. At the same time, it guarantees that the benign flows will not be hampered to preserve the program's functionality. As the PaveBox is built on top of Intel SGX, a user can verify the integrity and confidentiality of the PaveBox by remote attestation. We provide a formal model of Pave and prove its security and carry out the quantitative analysis with prototype-based experiments.
@inproceedings{ParkCLK25,
title = {<scp>Pave:</scp>
Information Flow Control for Privacy-preserving Online Data Processing Services},
author = {Minkyung Park and Jaeseung Choi and Hyeonmin Lee and Taekyoung Kwon},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676641.3716266}
}