Dual-Phase Optimization for Memory Protection in Keystone: Algorithmic Agility and Lightweight Integrity Structure

The threat landscape facing Trusted Execution Environments (TEEs) has grown increasingly sophisticated, with physical attacks now incorporated into threat models. Keystone has implemented authenticated encryption for memory protection via software, but it suffers from performance limitations. By proposing an algorithmic substitution and a counter-bound Merkle prefix tree (CMPT), this work significantly reduces the performance overhead of security protection modules. Experimental results demonstrate that our approach reduces off-chip memory protection overhead by 29.2% on Keystone while maintaining the original scheme's security. These findings provide new insights for the broader adoption and application of Keystone.