Initial Situation

While data is now frequently encrypted during transmission and storage, it usually must be available in RAM for traditional processing. This allows individuals or attackers with extensive system privileges to potentially access sensitive data or processes. For applications requiring high levels of protection, this creates a gap between data in transit, data at rest, and data in use.

Diagramm, das die Verbindung der Polkadot-Relaychain mit Sidechains, Validatoren und Unternehmenskunden veranschaulicht.

Project Overview

Client / Customer
Integritee, Web3 Foundation (Zug), and Polkadot Council

Area
Cybersecurity & Reliability

Solution
Confidential computing with blockchain and Trusted Execution.

System Environment
Trusted Execution Environments, Integritee in the Polkadot ecosystem, TEE-validated sidechains, remote attestation

Protection Goal
Confidentiality and public traceability when processing sensitive data (“data in use”)

The SCS Contribution

On behalf of Integritee, Web3 Foundation, and Polkadot Council, SCS developed a framework that combines Trusted Execution with blockchain technology and significantly reduces technical complexity for developers.

Protected Execution Environment

A Trusted Execution Environment isolates code and data from the rest of the system within a hardware-backed execution environment. Application keys and memory areas are protected against access from outside the enclave.

Remotely Verifiable Execution

Remote attestation allows for cryptographic verification of whether an application is running in an authentic TEE and with the expected program state, even if the hardware is located in a remote data center.

Confidential and Publicly Verifiable

The blockchain serves as a publicly verifiable anchor of trust, while the actual processing of sensitive data takes place within the TEEs. TEE-validated sidechains combine confidential processing with traceable state changes.

Protection for "Data in Use"

This allows sensitive data to be processed for clearly defined calculations within a protected execution environment without having to disclose it to the operator of the underlying infrastructure. For example, health data could be released for a defined analysis while the raw data remains confidential.

Result

The developed framework combines the confidentiality of hardware-backed Trusted Execution Environments with the public traceability of a blockchain. This enables developers to build applications where sensitive raw data remains protected during processing and the execution environment used is cryptographically verifiable. This allows for the implementation of “Security by Design” without having to expose sensitive processing to the operator infrastructure.

Data in Use

Sensitive data protected even during processing.

Remote Attestation

Execution environment and program state cryptographically verifiable.

TEE-Validated Sidechains

Confidential processing with a publicly traceable basis of trust.

Services Provided

Information Security

Blockchain

High-Level Software

Cybersecurity & Reliability

Lächelnde Person mit kurzen braunen Haaren und Brille, die einen dunklen Pullover trägt, vor weißem Hintergrund.

Your Contact Person

Sabine Proll

Lead Blockchain
+41 43 456 16 00

For questions regarding blockchain, Trusted Execution, and confidential computing.

Further Case Studies

  • Ein verschwommener Zug rast unter einem bewölkten Abendhimmel über die Gleise.

    ÖBB

    Blockchain for Safety-Critical Interlocking Logic

    Private blockchain for interlocking logic on standard computers.

  • Eine Hand, die ein Tablet mit einer Rezept-App bedient; im Hintergrund liegen Äpfel und Obst auf einem Schneidebrett.

    V-ZUG AG

    Secure Communication Thanks to the V-ZUG PKI

    PKI for securing networked household appliances.

  • A boy blows into a medical device, strengthening his digital resilience, while an adult watches him in a bright room.

    ndd Medizintechnik AG

    Cloud Platform for Medical Measurement Data

    Cloud integration of existing medical devices with patient records.