Accepted — ETTIS 2026Springer / Scopus-indexed

Runtime Data Shadowing (RDS)

A TEE Approach for Secure Medical Data Sharing

A trusted-execution-environment approach for sharing medical data under role-aware access control, built on Intel SGX enclaves and authenticated encryption.

Intel SGXTEEAES-128-GCM

8.93 μsMean query latency

2.9×Overhead

112,046Throughputops/sec

15×Latency degradationbeyond 128 MB EPC boundary

01Client

02Encrypted Patient Data

03SGX Enclave

04Role-Aware Shadow View

05Authorized Result

PROBLEM

Medical data sharing requires strict role-based access control while remaining resistant to a compromised host OS or hypervisor — the party operating the infrastructure should not be able to read plaintext patient data.

APPROACH

Runtime Data Shadowing runs the access-control and view-derivation logic inside an Intel SGX enclave. Patient data stays encrypted (AES-128-GCM) outside the enclave; the enclave decrypts, derives a role-aware "shadow view" of the record for the requesting party, and re-encrypts only the authorized result before it leaves the trusted boundary.

THREAT MODEL

Assumes a malicious or compromised host OS/hypervisor with physical access to memory outside the enclave, but trusts the SGX hardware root of trust and the enclave's measured code.

IMPLEMENTATION

Implemented as an SGX enclave application with AES-128-GCM for data confidentiality/integrity, evaluated for query latency and throughput under varying enclave page cache (EPC) pressure.

RESULTS

Mean query latency of 8.93 μs with a 2.9× overhead versus a non-enclave baseline, sustaining 112,046 ops/sec. Latency degrades sharply (15×) once working-set size exceeds the 128 MB EPC boundary, which is the dominant scalability constraint.

LIMITATIONS

Performance is bounded by SGX's EPC size — workloads that exceed 128 MB incur substantial paging overhead. The evaluation targets a single-enclave deployment rather than a distributed multi-party setting.