{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T23:02:29Z","timestamp":1784329349383,"version":"3.55.0"},"publisher-location":"Singapore","reference-count":29,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819230112","type":"print"},{"value":"9789819230129","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-92-3012-9_17","type":"book-chapter","created":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T22:02:35Z","timestamp":1784325755000},"page":"401-421","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Shielding MCP Tool: A Secure Execution Framework Using TEE and\u00a0Automated Trimming"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6859-6005","authenticated-orcid":false,"given":"Ruidong","family":"Han","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9256-6930","authenticated-orcid":false,"given":"Chengyan","family":"Ma","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4562-8208","authenticated-orcid":false,"given":"Ye","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6794-4970","authenticated-orcid":false,"given":"Yuqing","family":"Niu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4367-7201","authenticated-orcid":false,"given":"David","family":"Lo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,18]]},"reference":[{"key":"17_CR1","unstructured":"Anthropic, Model Context Protocol (MCP). https:\/\/modelcontextprotocol.io\/docs\/getting-started\/intro. Accessed 2025"},{"issue":"3","key":"17_CR2","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2799647","volume":"33","author":"A Baumann","year":"2015","unstructured":"Baumann, A., Peinado, M., Hunt, G.: Shielding applications from an untrusted cloud with haven. ACM Trans. Comput. Syst. (TOCS) 33(3), 1\u201326 (2015)","journal-title":"ACM Trans. Comput. Syst. (TOCS)"},{"key":"17_CR3","doi-asserted-by":"crossref","unstructured":"Casell, B., et al.: A performance analysis for confidential federated learning. In: 2024 IEEE Security and Privacy Workshops (SPW), pp. 40\u201347 (2024)","DOI":"10.1109\/SPW63631.2024.00009"},{"key":"17_CR4","doi-asserted-by":"crossref","unstructured":"Cerdeira, D., Santos, N., Fonseca, P., Pinto, S.: SoK: understanding the prevailing security vulnerabilities in trustzone-assisted tee systems. In: Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP), pp. 1416\u20131432 (2020)","DOI":"10.1109\/SP40000.2020.00061"},{"key":"17_CR5","unstructured":"Corporation, I.: Intel Software Guard Extensions (SGX). https:\/\/www.intel.com\/content\/www\/us\/en\/architecture-and-technology\/software-guard-extensions.html. Accessed 2025"},{"key":"17_CR6","unstructured":"Fang, J., Yao, Z., Wang, R., Ma, H., Wang, X., Chua, T.-S.: We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems. arXiv preprint arXiv:2506.13666 (2025)"},{"issue":"6","key":"17_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3456631","volume":"54","author":"S Fei","year":"2021","unstructured":"Fei, S., Yan, Z., Ding, W., Xie, H.: Security vulnerabilities of SGX and countermeasures: a survey. ACM Comput. Surv. (CSUR) 54(6), 1\u201336 (2021)","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"17_CR8","doi-asserted-by":"publisher","first-page":"1267","DOI":"10.1109\/TIFS.2023.3333687","volume":"19","author":"K Gao","year":"2023","unstructured":"Gao, K., Bai, J., Wu, B., Ya, M., Xia, S.-T.: Imperceptible and robust backdoor attack in 3D point cloud. IEEE Trans. Inf. Forensics Secur. (TIFS) 19, 1267\u20131282 (2023)","journal-title":"IEEE Trans. Inf. Forensics Secur. (TIFS)"},{"issue":"1","key":"17_CR9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3534972","volume":"16","author":"I Giechaskiel","year":"2022","unstructured":"Giechaskiel, I., Tian, S., Szefer, J.: Cross-VM covert-and side-channel attacks in cloud FPGAs. ACM Trans. Reconfig. Technol. Syst. 16(1), 1\u201329 (2022)","journal-title":"ACM Trans. Reconfig. Technol. Syst."},{"key":"17_CR10","unstructured":"Guo, Y., et al.: Systematic analysis of MCP security. arXiv preprint arXiv:2508.12538 (2025)"},{"key":"17_CR11","unstructured":"Han, R., et al.: AutoTEE: Automated Migration and Protection of Programs in Trusted Execution Environments. arXiv preprint arXiv:2502.13379 (2025)"},{"key":"17_CR12","doi-asserted-by":"crossref","unstructured":"Hasan, M.M., Li, H., Fallahzadeh, E., Rajbahadur, G.K., Adams, B., Hassan, A.E.: Model context protocol (MCP) at first glance: studying the security and maintainability of MCP servers. arXiv preprint arXiv:2506.13538 (2025)","DOI":"10.1145\/3814959"},{"key":"17_CR13","doi-asserted-by":"crossref","unstructured":"Hou, X., Zhao, Y., Wang, S., Wang, H.: Model context protocol (MCP): landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278 (2025)","DOI":"10.1145\/3796519"},{"key":"17_CR14","doi-asserted-by":"crossref","unstructured":"Jing, H., et al.: MCIP: protecting MCP safety via model contextual integrity protocol. In: Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pp. 1177\u20131194 (2025)","DOI":"10.18653\/v1\/2025.emnlp-main.62"},{"key":"17_CR15","doi-asserted-by":"crossref","unstructured":"Kumar, S., Girdhar, A., Patil, R., Tripathi, D.: MCP guardian: a security-first layer for safeguarding MCP-based AI system. arXiv preprint arXiv:2504.12757 (2025)","DOI":"10.2139\/ssrn.5259751"},{"key":"17_CR16","doi-asserted-by":"crossref","unstructured":"Kwon, W., et al.: Efficient memory management for large language model serving with paged attention. In: Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles (2023)","DOI":"10.1145\/3600006.3613165"},{"key":"17_CR17","doi-asserted-by":"crossref","unstructured":"Li, M., Yang, Y., Chen, G., Yan, M., Zhang, Y.: SoK: understanding design choices and pitfalls of trusted execution environments. In: Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, pp. 1600\u20131616 (2024)","DOI":"10.1145\/3634737.3644993"},{"key":"17_CR18","doi-asserted-by":"crossref","unstructured":"Li, Z., Li, K., Ma, B., Xu, M., Zhang, Y., Cheng, X.: We urgently need privilege management in MCP: a measurement of API usage in MCP ecosystems. arXiv preprint arXiv:2507.06250 (2025)","DOI":"10.1109\/MASS66014.2025.00090"},{"key":"17_CR19","doi-asserted-by":"crossref","unstructured":"Ma, C., et al.: BiTDB: constructing a built-in TEE secure database for embedded systems. IEEE Trans. Knowl. Data Eng. 36(9), 4472\u20134485 (2024)","DOI":"10.1109\/TKDE.2024.3380367"},{"key":"17_CR20","doi-asserted-by":"crossref","unstructured":"Marku, E., Boyd, C., Bicz\u00f3k, G.: SafeLib: a comprehensive framework for secure outsourcing of network functions. IEEE Trans. Netw. Serv. Manage. (2024)","DOI":"10.1109\/TNSM.2024.3520817"},{"key":"17_CR21","doi-asserted-by":"crossref","unstructured":"Paju, A., Javed, M.O., Nurmi, J., Savim\u00e4ki, J., McGillion, B., Brumley, B.B.: SoK: a systematic review of tee usage for developing trusted applications. In: Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES), pp. 1\u201315 (2023)","DOI":"10.1145\/3600160.3600169"},{"key":"17_CR22","doi-asserted-by":"crossref","unstructured":"Radosevich, B., Halloran, J.: MCP safety audit: LLMs with the model context protocol allow major security exploits. arXiv preprint arXiv:2504.03767 (2025)","DOI":"10.1117\/12.3097390"},{"key":"17_CR23","doi-asserted-by":"crossref","unstructured":"Rubinov, K., Rosculete, L., Mitra, T., Roychoudhury, A.: Automated partitioning of android applications for trusted execution environments. In: Proceedings of the 38th International Conference on Software Engineering (ICSE), pp. 923\u2013934 (2016)","DOI":"10.1145\/2884781.2884817"},{"key":"17_CR24","doi-asserted-by":"crossref","unstructured":"Song, H., et al.: Beyond the protocol: unveiling attack vectors in the model context protocol ecosystem. arXiv preprint arXiv:2506.02040 (2025)","DOI":"10.1109\/TSE.2026.3694876"},{"key":"17_CR25","unstructured":"Anil, R., et al.: Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 (2023)"},{"key":"17_CR26","unstructured":"Tsai, C.-C., Son, J., Jain, B., McAvey, J., Popa, R.A., Porter, D.E.: Civet: an efficient java partitioning framework for hardware enclaves. In: 29th USENIX Security Symposium (USENIX Security 2020), pp. 505\u2013522 (2020)"},{"issue":"3","key":"17_CR27","doi-asserted-by":"publisher","first-page":"2936","DOI":"10.1109\/TCC.2023.3243891","volume":"11","author":"J Wang","year":"2023","unstructured":"Wang, J., et al.: SvTPM: SGX-based virtual trusted platform modules for cloud computing. IEEE Trans. Cloud Comput. 11(3), 2936\u20132953 (2023)","journal-title":"IEEE Trans. Cloud Comput."},{"key":"17_CR28","doi-asserted-by":"crossref","unstructured":"Wang, Y., Zhou, J., Cao, Z., Dong, X., Choo, K.-K.R.: Mueoc: efficient SGX-based multi-key homomorphic outsourcing computation for e-health system. IEEE Trans. Dependable Secure Comput. (2024)","DOI":"10.1109\/TDSC.2024.3476483"},{"key":"17_CR29","doi-asserted-by":"crossref","unstructured":"Zhang, Z., et al.: No privacy left outside: on the (in-) security of tee-shielded DNN partition for on-device ML. In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), pp. 3327\u20133345 (2024)","DOI":"10.1109\/SP54263.2024.00052"}],"container-title":["Lecture Notes in Computer Science","Information Security and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-3012-9_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T22:02:40Z","timestamp":1784325760000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-3012-9_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9789819230112","9789819230129"],"references-count":29,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-3012-9_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"18 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ACISP","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australasian Conference on Information Security and Privacy","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Perth, WA","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australia","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"6 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"31","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"acisp2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/acisp-conference.github.io\/acisp2026\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}