Research Seminars @ Illinois

Abstract: The growing demand for data-driven analytics increasingly clashes with a fundamental reality: vast amounts of high-value data remain inaccessible—not due to lack of data, but because privacy, regulatory, and trust constraints prevent their use. Confidential computing (CC), and in particular Trusted Execution Environments (TEEs), has emerged as a promising foundation for unlocking private-sector and cross-organizational data by protecting data in use. By isolating computation from the surrounding system, TEEs offer strong guarantees on data confidentiality while preserving a familiar programming model.

However, today’s TEEs primarily protect data values and control-flow integrity, where they do not fully conceal data-dependent execution state. Side channels such as memory traces, access patterns, and data-dependent control and communication behavior can still leak sensitive information, limiting the security of rich analytics workloads. A long line of research addresses this problem through data-oblivious algorithms that eliminate such leakage, but at a steep cost: they suppress data-aware optimizations that are central to modern high-performance systems. This exposes a fundamental privacy–performance tension in confidential analytics.

In this talk, I introduce a new opportunity to resolve this tension by building Oblivious Processing Accelerators (OPAs). OPAs extend traditional TEEs beyond protecting data values to also conceal critical data-dependent execution state, such as memory traces and data flows. By doing so, OPAs first create a large “unobservable” region in which aggressive, data-aware optimizations can safely execute. At the same time, the presence of a large unobservable region fundamentally reshapes how oblivious algorithms are designed, which allows us to explore new ways to efficiently support massive workloads that may exceed the region’s physical capacity.   

I will first explain why realizing this vision on traditional CPU architectures is fundamentally challenging, and then show how it becomes feasible when we expand our view to modern accelerator architectures. I will next present BOLT (CCS ’25), our initial realization of this vision: an oblivious key–value store accelerator that demonstrates how OPAs can simultaneously deliver strong privacy guarantees and high throughput. I will then discuss how these insights can be applied to emerging GPU TEE designs, even though current GPU TEEs do not architecturally provide the full guarantees of OPAs. Finally, I will conclude by sharing my perspective on future OPA designs and discussing how they fit into the broader confidential computing ecosystem.

Bio: Chenghong Wang is an Assistant Professor of Computer Science at Indiana University. He received his Ph.D. in Computer Science from Duke University in 2023, where he was advised by Ashwin Machanavajjhala and Kartik Nayak. His research focuses on confidential computing, with an emphasis on designing scalable systems and architectures for privacy-preserving data analytics. His work has produced foundational results in oblivious processing, secure data systems, trusted accelerators, and has been published in top venues across systems, security, and architecture, including SIGMOD, VLDB, CCS, USENIX Security, MICRO, SC, and DAC. He has also published interdisciplinary work connecting confidential computing with data-driven AI applications in leading AI/ML venues such as NeurIPS, IJCAI, EMNLP, and ICCV. Dr. Wang also collaborates closely with domain scientists, national cyberinfrastructure efforts (e.g., Trusted CI), and industry partners (e.g., AMD, Intel, DeepMind and IBM) to translate confidential computing research into practice. His doctoral research was recognized with the Duke Computer Science Outstanding Ph.D. Dissertation Award.