一句话：提出独立于 CPU TEE 的云 FPGA 可信执行环境 ShEF，含安全启动、远程证明和可定制 Shield。
云 FPGA 被用于加速金融、医疗等敏感数据应用，但其安全执行面临挑战。ShEF 为云上可重构加速器提供独立于 CPU TEE 的可信执行环境，威胁模型允许攻击者控制与 FPGA 相连的 CPU 上所有软件、物理接触 FPGA，并攻陷云提供商的 FPGA 接口逻辑。ShEF 仅依赖现有 FPGA 机制实现安全启动与远程证明，并用 Shield 组件在加速器使用期间提供安全数据访问；Shield 可定制扩展，以适配不同加速器的访存模式、带宽和安全需求。作者在现有云 FPGA 上实现原型，将其映射到存储应用，并用五个额外加速器测量可定制安全方案带来的性能收益。
FPGAs are now used in public clouds to accelerate a wide range of applications, including many that operate on sensitive data such as financial and medical records. We present ShEF, a trusted execution environment (TEE) for cloud-based reconfigurable accelerators. ShEF is independent from CPU-based TEEs and allows secure execution under a threat model where the adversary can control all software running on the CPU connected to the FPGA, has physical access to the FPGA, and can compromise the FPGA interface logic of the cloud provider. ShEF provides a secure boot and remote attestation process that relies solely on existing FPGA mechanisms for root of trust. It also includes a Shield component that provides secure access to data while the accelerator is in use. The Shield is highly customizable and extensible, allowing users to craft a bespoke security solution that fits their accelerator's memory access patterns, bandwidth, and security requirements at minimum performance and area overheads. We describe a prototype implementation of ShEF for existing cloud FPGAs, map ShEF to a performant and secure storage application, and measure the performance benefits of customizable security using five additional accelerators.