Trusted Execution for Spatial Workloads

Secure multi-party computation and homomorphic encryption buy privacy with arithmetic; a trusted execution environment buys it with hardware. Inside an enclave the data is plaintext, spatial joins run at close to native speed, and the entire cryptographic apparatus reduces to one question: can you prove to the data owner that the code holding their coordinates is the code they approved? That proof is remote attestation, and it is both the enabling mechanism and the whole of the residual risk. This guide covers where enclaves fit in a spatial pipeline, under Secure Multi-Party Computation in Spatial Analytics, and it complements the arithmetic approaches in homomorphic encryption basics and secret sharing for coordinates.

The scenario: a transit authority and a retail analytics firm want a joint footfall study. Neither may see the other’s raw trajectories, and the study needs a real spatial join over tens of millions of points — a workload where three-party MPC would take hours and an enclave takes minutes.

The attestation handshake that has to happen before any coordinate moves A sequence diagram with three columns: a data owner on the left, an enclave in the centre, and the hardware vendor's attestation service on the right. Step one, the enclave generates an ephemeral key pair and requests a quote over its code measurement and that public key. Step two, the vendor service signs the quote. Step three, the enclave sends the quote to the data owner. Step four, the data owner verifies the signature chain and, critically, compares the code measurement against the exact build it approved. Step five, only after that check passes, the owner encrypts its data to the ephemeral key and uploads. Step six, the enclave decrypts inside the protected region, runs the join, and releases only a differentially private aggregate. A side note marks that a measurement mismatch must abort the upload, and that the enclave never writes plaintext outside the protected region. Attestation first, data second — never the other way round Data owner Enclave Vendor attestation 1 · quote over code measurement + ephemeral pubkey 2 · vendor-signed quote 3 · quote forwarded to the owner 4 · verify signature chain AND compare the measurement mismatch → abort, do not upload

5 · data encrypted to the ephemeral key

6 · decrypt inside the enclave spatial join at native speed release: DP aggregate only

no plaintext is ever written outside the protected region

Prerequisites

  • Hardware with a supported enclave and a live attestation service. The guarantee depends on a vendor endpoint being reachable and on the platform’s TCB being current; both are operational dependencies, not one-time setup.
  • A reproducible build. The data owner verifies a measurement — a hash of the enclave binary. If your build is not reproducible, the owner cannot check that the measurement corresponds to source they reviewed, and the attestation degrades to “some binary is running in some enclave”.
  • A minimal enclave codebase. Everything inside the enclave is inside the trust boundary, including its dependencies. A geospatial library pulled in for one convenience function brings its whole attack surface with it.
  • A DP release path on the way out. An enclave protects data at rest and in use; it does nothing about what the computation reveals. Aggregates leaving the enclave still need the same noise and thresholds a central-DP pipeline would apply.

Step 1: Fix what the enclave is trusted for

Write this down before any code. An enclave provides confidentiality and integrity of computation against a compromised host operating system and hypervisor. It does not provide:

Four ways to compute on data you may not see A four-row comparison of a trusted server, a hardware enclave, three-party secure computation and homomorphic encryption, across who must be trusted, the cost of a ten-million-point join, and the output guarantee. The trust column improves down the table while the performance column worsens. The output guarantee is identical in every row: none of these techniques bounds what the published result reveals. Four ways to compute on data you may not see every row still needs a differential-privacy release path trusts join of 10M points output guarantee Trusted server the operator minutes needs DP TEE enclave hardware vendor minutes needs DP 3-party MPC nobody (below t) hours needs DP Homomorphic encryption nobody impractical needs DP
The last column is the one teams skip. Confidentiality of the inputs and disclosure control on the outputs are different problems, and every row needs both.
  • protection against a flawed enclave program (a bug that writes plaintext out is a bug, not an attack the hardware prevents);
  • protection against inference from the output (that is DP’s job);
  • protection against the hardware vendor, whose signing key roots the whole chain;
  • protection against side channels — timing, cache, page-fault and memory-access patterns — which for spatial workloads are unusually informative, because access patterns follow geography.

The honest framing for a data owner is: “your coordinates are readable only by this specific, reviewed program, and you can verify that; the residual risks are the program’s own correctness, the inference from what it outputs, and the vendor.”

Step 2: Attest before uploading, and bind the key to the quote

The single most common implementation error is uploading data over TLS to a host that says it has an enclave, then attesting afterwards. The order matters: the attestation must produce a public key that is generated inside the enclave and included in the signed quote, and the data must be encrypted to that key. Otherwise the host can terminate TLS outside the enclave and forward plaintext at its leisure.

python
from __future__ import annotations

import hashlib
import hmac
from dataclasses import dataclass


class AttestationError(RuntimeError):
    """Raised whenever a quote fails any check. Never downgrade this to a warning."""


@dataclass(frozen=True)
class Quote:
    """A vendor-signed statement about what is running and which key it holds."""

    measurement: str          # hash of the enclave binary
    ephemeral_pubkey: bytes   # generated INSIDE the enclave
    tcb_version: int
    vendor_signature: bytes


@dataclass(frozen=True)
class OwnerPolicy:
    """What this data owner will accept before releasing coordinates."""

    approved_measurements: frozenset[str]
    min_tcb_version: int
    vendor_key: bytes

    def verify(self, quote: Quote) -> None:
        """Verify a quote. Every branch here must fail closed.

        The measurement check is the one that carries the guarantee: a valid vendor
        signature only proves that SOME enclave produced the quote, not that it is
        running the code this owner reviewed.
        """
        expected = hmac.new(
            self.vendor_key,
            quote.measurement.encode() + quote.ephemeral_pubkey + str(quote.tcb_version).encode(),
            hashlib.sha256,
        ).digest()
        if not hmac.compare_digest(expected, quote.vendor_signature):
            raise AttestationError("vendor signature invalid — do not upload")
        if quote.tcb_version < self.min_tcb_version:
            raise AttestationError(
                f"TCB version {quote.tcb_version} is below the accepted floor "
                f"{self.min_tcb_version} — the platform is missing security updates"
            )
        if quote.measurement not in self.approved_measurements:
            raise AttestationError(
                f"measurement {quote.measurement[:16]}… is not an approved build; "
                "a signed quote alone proves nothing about WHICH code is running"
            )
        if len(quote.ephemeral_pubkey) < 32:
            raise AttestationError("ephemeral key missing or too short")


def seal_for_enclave(payload: bytes, quote: Quote, policy: OwnerPolicy) -> bytes:
    """Verify, then encrypt to the attested key. Refuses to do the second without the first.

    The API deliberately offers no way to encrypt without verifying: separating the
    two is how deployments end up shipping data to an unattested host during an
    incident and never noticing.
    """
    policy.verify(quote)
    stream = hashlib.blake2b(quote.ephemeral_pubkey, digest_size=len(payload)).digest()
    return bytes(a ^ b for a, b in zip(payload, stream))   # stand-in for a real AEAD

Step 3: Keep the enclave small and its output narrow

Two disciplines make an enclave defensible in review.

Minimise the code. Every library inside the enclave is trusted. A spatial join needs point-in- polygon tests and a grid index, not a full GIS stack. Where a dependency is unavoidable, pin it, vendor it, and include it in the reproducible build so it appears in the measurement.

Narrow the output. An enclave that returns a joined dataset has moved the disclosure problem rather than solved it. The output should be an aggregate, noised inside the enclave, with the same suppression thresholds a central pipeline would apply. The enclave’s advantage is that the noise can be added before anything leaves, so the host never sees the exact aggregate either.

Step 4: Compare honestly against the cryptographic alternatives

An enclave is often adopted because it is fast, and defended afterwards on privacy grounds. Doing the comparison properly, in advance, produces a much more durable decision — and occasionally a different one.

Where the enclave's speed advantage actually matters Two rising lines of join wall-clock against the number of points, both on logarithmic axes. The enclave join stays in seconds up to a hundred million points. Three-party secure computation is roughly two orders of magnitude slower throughout, crossing an hour around ten million points, which is where the architectural choice usually gets made. Where the enclave's speed advantage actually matters wall-clock for a cell-keyed spatial join 10000 100000 1000000 10000000 100000000 0 5000 10000 15000 points joined seconds enclave join 3-party MPC join
Below a few million points MPC is affordable and its weaker trust assumption usually wins. Above it, the round complexity decides.

Against secure multi-party computation. MPC assumes no trusted party at all: security follows from the protocol, and a break requires collusion above the threshold. An enclave assumes a hardware vendor whose signing key roots every attestation, and whose platform has a documented history of microarchitectural vulnerabilities. In exchange, the enclave runs a spatial join at close to native speed while three-party MPC over the same data spends its time on round trips. The honest framing for a data owner is that MPC has a weaker trust assumption and a worse cost curve, and the crossover is workload size: below a few million records MPC is usually affordable, and above it the round complexity dominates.

Against homomorphic encryption. HE removes the trusted party as well, and it is far more restrictive: the circuit must be fixed, its multiplicative depth counted in advance, and the cost per operation is orders of magnitude above plaintext. For a spatial join with irregular control flow — point-in-polygon tests against complex geometries, adaptive index traversal — HE is not merely slow but structurally awkward, because data-dependent branching is exactly what it cannot express. An enclave runs ordinary code.

Against a plain trusted server. This is the comparison most worth being precise about, because it is where the enclave’s value actually lies. A trusted server and an enclave both hold plaintext. The difference is that the enclave’s plaintext is inaccessible to the host operating system, the hypervisor, the storage layer and the operator, and that the code holding it is verifiable by the data owner rather than asserted by its operator. That is a genuine and substantial improvement in the insider-threat and compromised-infrastructure cases, and it is not a privacy guarantee about the outputs, which is why the DP release path remains mandatory.

In combination. The strongest practical designs use more than one. Two enclaves operated by different organisations running an MPC protocol between them survive either a hardware break or a protocol break. An enclave that adds differential-privacy noise inside the protected region gives a confidentiality guarantee for the inputs and a disclosure guarantee for the outputs. Each combination costs operational complexity, and each is justified exactly when a single trust assumption is not acceptable to the parties involved — which, for a study between two commercial organisations under regulatory scrutiny, it frequently is not.

Threat model considerations

  • Access patterns follow geography. An enclave’s memory access sequence during a spatial join reveals which grid cells were touched and in what order, and the host can observe page faults at 4 KB granularity. For clustered spatial data this is a strong signal. Mitigate with oblivious access patterns — pad every cell’s processing to a fixed cost, or scan the full index rather than seeking — accepting the substantial slowdown that implies.
  • Timing correlates with density. A join that takes longer in one region because more points fell there leaks that density. Where the output is coarse enough for this to matter, make the runtime data-independent by processing a fixed number of candidate cells regardless of occupancy.
  • The vendor is in the trust boundary. A compromise or a legal compulsion at the vendor breaks every enclave rooted in their key. For a two-party study this is often acceptable and must still be documented; for adversarial parties, MPC’s no-trusted-party model is materially different.
  • TCB rollbacks. An older, vulnerable platform version can still produce valid quotes. Pin a minimum TCB version in the owner’s policy and fail closed when it regresses — a check that is easy to omit and silently voids the guarantee.
  • Sealed data outlives the review. Data sealed to a platform key can be unsealed by a future enclave with a different measurement unless the sealing policy binds to the measurement. Seal to the measurement, not to the signer, unless upgrades genuinely require otherwise.

Validation and compliance checklist

  1. Attestation precedes upload, structurally. Pass criterion: no code path can encrypt to an enclave key without first verifying its quote, enforced by API shape and tested.
  2. Measurements are pinned to reviewed builds. Pass criterion: the approved-measurement list is version-controlled, and adding an entry requires the same review as a code change.
  3. A minimum TCB version is enforced. Pass criterion: a quote from a downlevel platform is rejected in an automated test.
  4. The enclave’s dependency set is enumerated and reproducible. Pass criterion: two independent builds produce the same measurement.
  5. Output is aggregate and noised inside the enclave. Pass criterion: no code path returns per-record data, and the DP parameters are part of the measured binary.
  6. Side-channel posture is stated. Pass criterion: the design document says explicitly whether access patterns are oblivious, and if not, what that leaks.

Failure modes and remediation

  • Attestation is verified but the measurement is not checked. The single most common defect: a valid vendor signature proves an enclave exists, not that it runs your code. Fail closed on an unknown measurement.
  • The enclave runs out of protected memory. Paging protected memory to disk is encrypted but slow and leaks access patterns through page faults. Stream the join in bounded chunks sized to the enclave’s memory rather than loading the full dataset.
  • A dependency update changes the measurement. Expected, and it must invalidate the owner’s approval until re-reviewed. Automate the notification, or owners will approve blindly to unblock a release.
  • The attestation service is unreachable. The correct behaviour is to refuse new uploads, not to proceed with a cached quote of unbounded age. Cache with a short, explicit expiry and document the availability trade.
  • Results are correct but a regulator is unsatisfied. They usually want evidence of who could have seen the data. Produce the measurement, the approved-build history, the attestation logs and the DP parameters together — the attestation quote alone is not an audit story.

A note on how this is presented to a data owner. The persuasive artefact is not the hardware vendor’s marketing material; it is the pair of a reproducible build and an approved-measurement list, because together they let the owner answer the only question they actually have: which code could read my coordinates? Publish the enclave source, publish the build instructions that reproduce the measurement byte for byte, and keep the approved list under the same change control as the code. A deployment that can hand over those three things converts an abstract hardware claim into something a security team can check in an afternoon, and it is what makes the difference between an enclave that is accepted in review and one that is argued about for a quarter.

The same applies to the decommissioning story, which is routinely forgotten: when an enclave build is retired, its measurement must be removed from every owner’s approved list, and any state sealed to that measurement becomes permanently unreadable by design. Plan the migration of long-lived sealed state before the retirement, not after, because there is no recovery path once the build is gone.

Frequently Asked Questions

Is an enclave a substitute for differential privacy?

No. They protect against different things: the enclave stops the host from reading the inputs, while differential privacy bounds what the outputs reveal. An enclave that publishes exact aggregates has a confidentiality story and no disclosure story, and the second is what a data-subject complaint will be about.

When should I use an enclave instead of MPC?

When the workload is large enough that MPC's round complexity is prohibitive, and the parties can agree on trusting a hardware vendor. A join over tens of millions of points is minutes in an enclave and hours in three-party MPC. When the parties are genuinely adversarial or a vendor dependency is unacceptable, MPC's weaker trust assumption wins.

How dangerous are side channels for spatial workloads specifically?

More dangerous than for generic workloads, because spatial data is clustered and access patterns therefore mirror geography closely. An observer who learns which index pages were touched learns which regions the query concerned. If that is unacceptable, the processing must be made data-independent, which typically costs an order of magnitude in performance.

What exactly does the data owner verify?

Four things, all of which must pass: the vendor's signature chain, the platform's TCB version against a floor, the code measurement against a list of builds the owner reviewed, and that the encryption key was generated inside the attested enclave. Omitting the third turns the protocol into theatre.

Can enclaves and MPC be combined?

Yes, and it is a strong pattern: run an MPC protocol between two enclaves operated by different parties, so a break of one hardware platform still leaves an MPC guarantee, and a break of the protocol still leaves the hardware. The cost is operational complexity, and it is justified when neither trust assumption alone is acceptable.

Up one level: Secure Multi-Party Computation in Spatial Analytics.