{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T05:23:09Z","timestamp":1783056189560,"version":"3.54.6"},"reference-count":74,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T00:00:00Z","timestamp":1773705600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T00:00:00Z","timestamp":1773705600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,3,17]]},"DOI":"10.1109\/saner67736.2026.00034","type":"proceedings-article","created":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T19:41:17Z","timestamp":1783021277000},"page":"228-239","source":"Crossref","is-referenced-by-count":0,"title":["What You Trust is Insecure: Demystifying How Developers (Mis)Use Trusted Execution Environments in Practice"],"prefix":"10.1109","author":[{"given":"Yuqing","family":"Niu","sequence":"first","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jieke","family":"Shi","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruidong","family":"Han","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ye","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chengyan","family":"Ma","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yunbo","family":"Lyu","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Lo","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-019-9096-y"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.400"},{"key":"ref3","article-title":"Intel sgx explained","author":"Costan","year":"2016","journal-title":"Cryptology ePrint Archive"},{"key":"ref4","article-title":"A survey of secure computation using trusted execution environments","author":"Li","year":"2023","journal-title":"arXiv preprint"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/MobileCloud.2014.47"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2019.2947124"},{"key":"ref7","first-page":"100","article-title":"Building and maintaining a third-party library supply chain for productive and secure SGX enclave development","author":"Wang","year":"2020","journal-title":"ICSE-SEIP. ACM"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/iscc.2016.7543781"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3031836.3031841"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW61312.2024.00025"},{"key":"ref11","article-title":"Annual Report 2024 of GlobalPlatform","volume-title":"a. c.-d. t. s. o. GlobalPlatform","year":"2024"},{"key":"ref12","article-title":"Trusted Execution Environment Market Research Report 2033","volume-title":"G. M. Reports","year":"2024"},{"key":"ref13","article-title":"Intel SGX SDK Developer Reference","volume-title":"Intel Corporation","year":"2023"},{"key":"ref14","article-title":"OP-TEE Documentation","volume-title":"TrustedFirmware Project","year":"2023"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3313808.3313810"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3600169"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884790"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2814228.2814229"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3735968"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3674805.3686685"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3664486"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380395"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2016.31"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2022.3148379"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3458864.3466628"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3386901.3388946"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3536168.3543299"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-FoSE59343.2023.00010"},{"key":"ref29","article-title":"Diting: A static analyzer for identifying bad partitioning issues in tee applications","author":"Ma","year":"2025","journal-title":"arXiv preprint"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690317"},{"key":"ref31","article-title":"Physical and software based fault injection attacks against TEEs in mobile devices: A systemisation of knowledge","author":"Joy","year":"2024"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00061"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23500"},{"key":"ref34","first-page":"645","article-title":"Graphene-SGX: A practical library OS for unmodified applications on SGX","author":"Tsai","year":"2017","journal-title":"USENIX ATC"},{"key":"ref35","first-page":"689","article-title":"SCONE: Secure linux containers with intel SGX","volume-title":"OSDI","author":"Arnautov","year":"2016"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3342195.3387532"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3589774"},{"key":"ref38","article-title":"AutoTEE: Automated migration and protection of programs in trusted execution environments","author":"Han","year":"2025","journal-title":"arXiv preprint"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3302424.3303951"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382205"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180201"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2019.07.007"},{"key":"ref43","first-page":"252","article-title":"Towards the usability evaluation of security APIs","volume":"10","author":"Gorski","year":"2016","journal-title":"HAISA"},{"key":"ref44","first-page":"137","article-title":"Findings from GitHub: methods, datasets and limitations","author":"Cosentino","year":"2016","journal-title":"MSR. ACM"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ASE63991.2025.00024"},{"issue":"5","key":"ref46","first-page":"360","article-title":"Understanding interobserver agreement: the kappa statistic","volume":"37","author":"Viera","year":"2005","journal-title":"Fam med"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568233"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2011.36"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884833"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00024"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2026.3668858"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.1999.751458"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2023.3321308"},{"key":"ref54","article-title":"Towards software-defined data protection: GDPR compliance at the storage layer is within reach","author":"Istv\u00e1n","year":"2020","journal-title":"arXiv preprint"},{"key":"ref55","article-title":"OpenSsl Cryptography and Ssl\/tls Toolkit","volume-title":"OpenSSL Project","year":"2023"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3380367"},{"key":"ref57","volume-title":"Analysis of TEE technologies as trust anchors","author":"Vuillermoz","year":"2022"},{"key":"ref58","article-title":"Asuswrt merlin","volume-title":"FlashRouters","year":"2025"},{"key":"ref59","article-title":"Mbed-TLS\/mbedtls: An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3\u20136 months between releases","volume-title":"Mbed TLS","year":"2025"},{"key":"ref60","article-title":"OP-TEE\/optee_os","volume-title":"OP-TEE","year":"2025"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2022.3164089"},{"key":"ref62","first-page":"991","article-title":"Foreshadow: Extracting the keys to the intel SGX kingdom with transient Out-of-Order execution","author":"Van Bulck","year":"2018","journal-title":"USENIX Security"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029832"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516693"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/VTC2020-Spring48590.2020.9128749"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/UEMCON47517.2019.8993089"},{"key":"ref67","article-title":"MiniVGGNet: Going Deeper with CNNs - PyImageSearch - pyimagesearch.com","author":"Rosebrock","year":"2025"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179382"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS54860.2022.00051"},{"key":"ref70","first-page":"275","article-title":"A survey of ahead-of-time technologies in dynamic language environments","volume-title":"CASCON","author":"Thom","year":"2018"},{"key":"ref71","first-page":"578","article-title":"TVM: An automated End-to-End optimizing compiler for deep learning","volume-title":"OSDI","author":"Chen","year":"2018"},{"key":"ref72","article-title":"NonceDisrespecting adversaries: Practical forgery attacks on GCM in TLS","volume-title":"WOOT","author":"B\u00f6ck","year":"2016"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.25"},{"key":"ref74","article-title":"Sgxpectre attacks: Leaking enclave secrets via speculative execution","author":"Chen","year":"2018","journal-title":"arXiv preprint"}],"event":{"name":"2026 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)","location":"Limassol, Cyprus","start":{"date-parts":[[2026,3,17]]},"end":{"date-parts":[[2026,3,20]]}},"container-title":["2026 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11576582\/11576527\/11576679.pdf?arnumber=11576679","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T05:14:25Z","timestamp":1783055665000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11576679\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,17]]},"references-count":74,"URL":"https:\/\/doi.org\/10.1109\/saner67736.2026.00034","relation":{},"subject":[],"published":{"date-parts":[[2026,3,17]]}}}