{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T14:20:57Z","timestamp":1769005257609,"version":"3.49.0"},"reference-count":90,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372218"],"award-info":[{"award-number":["62372218"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24A6009"],"award-info":[{"award-number":["U24A6009"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"HK RGC Collaborative Research Fund","award":["C5032-23GF"],"award-info":[{"award-number":["C5032-23GF"]}]},{"DOI":"10.13039\/501100004377","name":"Hong Kong Polytechnic University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004377","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,1]]},"DOI":"10.1109\/tdsc.2025.3615787","type":"journal-article","created":{"date-parts":[[2025,9,30]],"date-time":"2025-09-30T17:40:54Z","timestamp":1759254054000},"page":"1308-1325","source":"Crossref","is-referenced-by-count":0,"title":["Building Confidential Accelerator Computing Environment for Arm CCA"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7039-033X","authenticated-orcid":false,"given":"Chenxu","family":"Wang","sequence":"first","affiliation":[{"name":"Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1320-6389","authenticated-orcid":false,"given":"Kun","family":"Lu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Southern University of Science and Technology, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3365-2526","authenticated-orcid":false,"given":"Fengwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0885-4185","authenticated-orcid":false,"given":"Yunjie","family":"Deng","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4001-3442","authenticated-orcid":false,"given":"Kevin","family":"Leach","sequence":"additional","affiliation":[{"name":"Institute for Software Integrated Systems, Vanderbilt University, Nashville, TN, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2725-2529","authenticated-orcid":false,"given":"Jiannong","family":"Cao","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7763-1079","authenticated-orcid":false,"given":"Zhenyu","family":"Ning","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-9580-5395","authenticated-orcid":false,"given":"Shoumeng","family":"Yan","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}]},{"given":"Tao","family":"Wei","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-7682-1019","authenticated-orcid":false,"given":"Zhengyu","family":"He","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Confidential computing solution brief","year":"2023"},{"key":"ref2","article-title":"Azure confidential computing","year":"2022"},{"key":"ref3","article-title":"Azure confidential computing","year":"2023"},{"key":"ref4","article-title":"Confidential computing","year":"2023"},{"key":"ref5","article-title":"Intel trust domain extensions","year":"2022"},{"key":"ref6","article-title":"AMD secure encrypted virtualization (SEV)","year":"2022"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3447786.3456243"},{"key":"ref8","article-title":"Arm confidential compute architecture","year":"2023"},{"key":"ref9","article-title":"Arm realm management extension (RME) system architecture","year":"2023"},{"key":"ref10","article-title":"Arm architecture reference manual supplement Armv9, for Armv9-A architecture profile","year":"2022"},{"key":"ref11","article-title":"Graphics cards","year":"2023"},{"key":"ref12","article-title":"Arm mali graphics processing units (GPUs)","year":"2023"},{"key":"ref13","article-title":"Ethos-N78","year":"2023"},{"key":"ref14","article-title":"FPGA leadership across multiple process nodes","year":"2023"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3089801.3089804"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3302424.3303949"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2964284.2973801"},{"key":"ref18","article-title":"Mali texture compression tool","year":"2022"},{"key":"ref19","article-title":"VR best practice","year":"2022"},{"key":"ref20","article-title":"Introducing arm confidential compute architecture guide","year":"2023"},{"key":"ref21","first-page":"3423","article-title":"ACAI: Extending arm confidential computing architecture protection from CPUs to accelerators","volume-title":"Proc. USENIX Conf. Secur. Symp.","author":"Sridhara","year":"2024"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.5555\/3291168.3291219"},{"key":"ref23","first-page":"1073","article-title":"CURE: A security architecture with CUstomizable and resilient enclaves","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Bahmani","year":"2021"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00054"},{"key":"ref25","article-title":"NVIDIA confidential computing","year":"2022"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304021"},{"key":"ref27","first-page":"155","article-title":"Honeycomb: Secure and efficient GPU executions via static validation","volume-title":"Proc. 17th USENIX Symp. Operating Syst. Des. Implementation","author":"Mai","year":"2023"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560627"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO56248.2022.00019"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3552326.3567483"},{"key":"ref31","article-title":"Tegra X1","year":"2022"},{"key":"ref32","article-title":"Discover metal enhancements for A14 bionic","year":"2022"},{"key":"ref33","article-title":"Adreno graphics processing units","year":"2022"},{"key":"ref34","article-title":"Fixed virtual platforms","year":"2023"},{"key":"ref35","article-title":"Juno r2 ARM development platform SoC","year":"2016"},{"key":"ref36","article-title":"AMD virtex UltraScale FPGA VCU118 evaluation kit","year":"2023"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/IISWC.2009.5306797"},{"key":"ref38","article-title":"CAGE: Complementing arm CCA with GPU extensions","volume-title":"Proc. 31st Annu. Netw. Distrib. Syst. Secur. Symp.","author":"Wang","year":"2024"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3528535.3531513"},{"key":"ref40","article-title":"Open source Mali midgard GPU kernel drivers","year":"2022"},{"key":"ref41","article-title":"Xilinx DMA IP reference drivers","year":"2023"},{"key":"ref42","article-title":"OpenCL","year":"2022"},{"key":"ref43","article-title":"Arm system memory management unit architecture specification","year":"2023"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2017.10"},{"key":"ref45","article-title":"Arm CCA security model 1.0","year":"2023"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3079856.3080232"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3079856.3080230"},{"key":"ref48","article-title":"NVIDIA sends out signed firmware images for GP108 pascal GPUs","author":"Larabel","year":"2017"},{"key":"ref49","article-title":"AMD vega firmware signing","year":"2017"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23448"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483554"},{"key":"ref52","first-page":"4111","article-title":"Elasticlave: An efficient memory model for enclaves","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Yu","year":"2022"},{"key":"ref53","first-page":"6257","article-title":"SHELTER: Extending arm CCA with isolation in user space","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Zhang","year":"2023"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00025"},{"key":"ref55","article-title":"S905 datasheet","year":"2016"},{"key":"ref56","article-title":"Rockchip RK3288 technical reference manual Part1","year":"2017"},{"key":"ref57","article-title":"GPU device tree configuration","year":"2022"},{"key":"ref58","article-title":"Arm-trusted-Firmware","year":"2025"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS54860.2022.00116"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1976.1055638"},{"key":"ref61","volume-title":"Guide to Elliptic Curve Cryptography","author":"Menezes","year":"2004"},{"key":"ref62","first-page":"177","article-title":"PAC it up: Towards pointer integrity using ARM pointer authentication","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Liljestrand","year":"2019"},{"key":"ref63","first-page":"177","article-title":"PTAuth: Temporal memory safety via robust points-to authentication","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Farkhani","year":"2021"},{"key":"ref64","article-title":"Trusted Firmware-A release v2.8","year":"2023"},{"key":"ref65","article-title":"cloc","year":"2021"},{"key":"ref66","article-title":"TF-RMM","year":"2023"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/2490301.2451145"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507733"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18074.2021.9586207"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref71","article-title":"SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and $< $< 0.5MB model size","author":"Iandola","year":"2016"},{"key":"ref72","article-title":"MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications","author":"Howard","year":"2017"},{"key":"ref73","article-title":"cloudFPGA","year":"2024"},{"key":"ref74","article-title":"Amazon EC2 F1 instances","year":"2024"},{"key":"ref75","doi-asserted-by":"crossref","first-page":"349","DOI":"10.1145\/3489517.3530439","article-title":"GuardNN: Secure accelerator architecture for privacy-preserving deep learning","volume-title":"Proc. 59th ACM\/IEEE Des. Automat. Conf.","author":"Hua","year":"2022"},{"key":"ref76","article-title":"DMA\/Bridge subsystem for PCI express product guide (PG195)","year":"2023"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2016.7446062"},{"key":"ref78","first-page":"109","article-title":"Detection of illegitimate access to JTAG via statistical learning in chip","volume-title":"Proc. Des. Automat. Test Europe Conf. Exhib.","author":"Ren","year":"2015"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2018.2802866"},{"key":"ref80","article-title":"Integrity and data encryption (IDE) ECN deep dive","year":"2020"},{"key":"ref81","article-title":"System architecture","year":"2023"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00053"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3450268.3453524"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623197"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00013"},{"key":"ref86","article-title":"IDE and TDISP: An overview of PCIe technology security features","year":"2022"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3620678.3624659"},{"key":"ref88","first-page":"501","article-title":"Confidential computing within an AI accelerator","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Vaswani","year":"2023"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA56546.2023.10071091"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/3719653"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11354469\/11184878.pdf?arnumber=11184878","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,20]],"date-time":"2026-01-20T23:23:41Z","timestamp":1768951421000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11184878\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1]]},"references-count":90,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3615787","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1]]}}}