一句话：提出 Trust-V，为 TEE 提供运行时存储隔离和密封数据完整性保护，并在 RISC-V 上实现原型。
可信执行环境（TEE）能将安全关键应用及其数据与恶意操作系统隔离，并支持密封后持久存储，但现有方案无法保证密封数据的完整性，恶意 OS 仍可删除或篡改。本文提出 Trusted Storage，一种 TEE 运行时存储隔离机制：将存储划分为可信与非可信区域，通过锁定 MMIO 区域并监控块 I/O 实施访问控制，且无需硬件修改或额外硬件。作者在 RISC-V 上实现原型 Trust-V，并引入 Virtual-M 模式，在机器模式下提供沙箱化特权执行环境以承载监控器，兼容安全特性受限的旧设备。评估显示，Trust-V 最高带来 3.86 倍系统开销，但能让 TEE 软件可靠存取持久数据。
Trusted execution environments (TEEs) provide strong isolation for security-critical applications (enclaves) and their runtime data from potentially malicious operating systems. While TEEs also support secure storage by sealing data and storing it persistently on media, they do not ensure the integrity of sealed data, leaving it vulnerable to deletion or manipulation by an untrusted OS. In this work, we present Trusted Storage, a runtime storage isolation mechanism for TEEs that guarantees the integrity of TEE persistent data. The core design partitions storage into trusted and untrusted regions and enforces access control by locking MMIO regions and monitoring block I/O. To ensure portability, Trusted Storage requires no hardware modifications or additional hardware. We implemented a prototype, Trust-V, on the RISC-V platform. In particular, to support secure operation on legacy devices where security features are limited, Trust-V introduces a Virtual-M mode, a sandboxed privileged execution environment in machine mode, for securely hosting the monitor. Our evaluation demonstrates that, although Trust-V incurs up to 3.86× system overhead, it allows TEE software to reliably store and retrieve persistent data.