标题： 基于可信执行环境的键值存储：综述 显示英文标题

标题： TEE-based Key-Value Stores: a Survey

摘要： 键值存储（KVSs）是No-SQL数据库，它们将数据作为键值对存储，并因其简单性、可扩展性和快速检索能力而受到欢迎。 然而，在KVSs中存储敏感数据需要强大的安全特性，以防止数据泄露和未经授权的篡改。 虽然基于软件（SW）的加密技术常用于保持数据的机密性和完整性，但它们存在一些缺点。 它们强烈依赖对托管系统栈的信任，并且除非使用性能消耗大的技术（例如，同态加密），否则不会在处理过程中保护数据。 另外，可信执行环境（TEEs）提供了一种解决方案，在CPU级别上强制执行代码和数据的机密性和完整性，使用户能够在不可信环境中构建可信应用程序。 它们还通过提供一个称为飞地的封装处理环境来保护正在使用中的数据。 然而，TEEs也有自己的缺点，包括由于内存大小限制和CPU上下文切换导致的性能问题。 本文研究了基于TEE的保密KVSs的最新技术，并突出了KVSs在利用TEE安全特性的同时克服其固有局限性的常用设计策略。 这项工作旨在全面理解TEEs在KVSs中的应用，并确定未来工作的研究方向。 显示英文摘要

摘要： Key-Value Stores (KVSs) are No-SQL databases that store data as key-value pairs and have gained popularity due to their simplicity, scalability, and fast retrieval capabilities. However, storing sensitive data in KVSs requires strong security properties to prevent data leakage and unauthorized tampering. While software (SW)-based encryption techniques are commonly used to maintain data confidentiality and integrity, they suffer from several drawbacks. They strongly assume trust in the hosting system stack and do not secure data during processing unless using performance-heavy techniques (e.g., homomorphic encryption). Alternatively, Trusted Execution Environments (TEEs) provide a solution that enforces the confidentiality and integrity of code and data at the CPU level, allowing users to build trusted applications in an untrusted environment. They also secure data in use by providing an encapsulated processing environment called enclave. Nevertheless, TEEs come with their own set of drawbacks, including performance issues due to memory size limitations and CPU context switching. This paper examines the state of the art in TEE-based confidential KVSs and highlights common design strategies used in KVSs to leverage TEE security features while overcoming their inherent limitations. This work aims to provide a comprehensive understanding of the use of TEEs in KVSs and to identify research directions for future work.