DataSHIELD Conference, Liverpool, 6–9 October at Hope Street Hotel. Talks, training and networking.

DataSHIELD Conference, Liverpool, 6–9 October at Hope Street Hotel. Talks, training and networking.

Fine-tuning large language models (LLMs) on domain-specific datasets has become a standard paradigm for adapting LLMs to specialized applications. However, recent work has shown that even fine-tuning on benign task-specific data can substantially weaken the safety capabilities of LLMs. While existi…

DataSHIELD Conference, Liverpool, 6–9 October at Hope Street Hotel. Talks, training and networking.

Introduction: Saudi Arabia’s cybersecurity landscape is rapidly shifting toward homegrown innovation as local developers gain critical distribution channels. SITE’s new partnership with AmiViz across the Kingdom marks a pivotal expansion for its integrated product portfolio—Rakeen, Metras, and SITE Datashield—bringing sovereign security capabilities directly to enterprise customers. This article explores the technical underpinnings of these solutions and provides actionable implementation guides for security teams looking to operationalize similar locally-developed tools.

Tools for wrapping 'DataSHIELD' analyses into RO-Crate (Research Object Crate) objects. Provides functions to create structured metadata for federated data analysis projects, enabling governance tracking of data access, project membership, analysis execution and output validation across distributed data sources.

Tools for wrapping 'DataSHIELD' analyses into RO-Crate (Research Object Crate) objects. Provides functions to create structured metadata for federated data analysis projects, enabling governance tracking of data access, project membership, analysis execution and output validation across distributed data sources.

Tools for wrapping 'DataSHIELD' analyses into RO-Crate (Research Object Crate) objects. Provides functions to create structured metadata for federated data analysis projects, enabling governance tracking of data access, project membership, analysis execution and output validation across distributed data sources.

Base 'DataSHIELD' functions for the client side. 'DataSHIELD' is a software package which allows you to do non-disclosive federated analysis on sensitive data. 'DataSHIELD' analytic functions have been designed to only share non disclosive summary statistics, with built in automated output checking based on statistical disclosure control. With data sites setting the threshold values for the automated output checks. For more details, see citation('dsBaseClient').

This paper introduces TZ-DATASHIELD, a new tool for securing embedded systems using data-flow-based compartmentalization. The increasing reliance on embedded systems in critical sectors highlights the need for robust data protection on MCUs. Existing security methods face challenges due to computational and energy limitations, making data confidentiality and integrity difficult to maintain. TZ-DATASHIELD leverages ARM TrustZone and implements fine-grained compartmentalization focused on sensitive data flow. It addresses limitations in existing compartment units, inadequate isolation within the Trusted Execution Environment (TEE), and shared data exposure. A novel intra-TEE isolation mechanism validates compartment access to TEE resources at runtime. The tool allows for automatic generation of TrustZone-ready firmware through source code annotation. Evaluations using real-world applications show significant memory and gadget reductions within the TEE address space. The runtime overhead is manageable, with and without control-flow integrity and data-flow integrity enforcement. This research aims to advance the application and deployment of security technologies in embedded systems. The Network and Distributed System Security Symposium (NDSS) provides a platform for such advancements. NDSS facilitates information exchange between researchers and practitioners in network and distributed system security.

NDSS 2025 - Automated Data Protection For Embedded Systems Via Data Flow Based Compartmentalization Session 7B: Trusted Hardware and Execution Authors, Creators & Presenters: Zelun Kong (University of Texas at Dallas), Minkyung Park (University of Texas at Dallas), Le Guan (University of Georgia), Ning Zhang (Washington University in St. Louis), Chung Hwan Kim (University of Texas at Dallas) PAPER TZ-DATASHIELD: Automated Data Protection For Embedded Systems Via Data-Flow Based Compartmentalization As reliance on embedded systems grows in critical domains such as healthcare, industrial automation, and unmanned vehicles, securing the data on micro-controller units (MCUs) becomes increasingly crucial. These systems face significant challenges related to computational power and energy constraints, complicating efforts to maintain the confidentiality and integrity of sensitive data. Previous methods have utilized compartmentalization techniques to protect this sensitive data, yet they remain vulnerable to breaches by strong adversaries exploiting privileged software. In this paper, we introduce TZ-DATASHIELD, a novel LLVM compiler tool that enhances ARM TrustZone with sensitive data flow (SDF) compartmentalization, offering robust protection against strong adversaries in MCU-based systems. We address three primary challenges: the limitations of existing compartment units, inadequate isolation within the Trusted Execution Environment (TEE), and the exposure of shared data to potential attacks. TZ-DATASHIELD addresses these challenges by implementing a fine-grained compartmentalization approach that focuses on sensitive data flow, ensuring data confidentiality and integrity, and developing a novel intra-TEE isolation mechanism that validates compartment access to TEE resources at runtime. Our prototype enables firmware developers to annotate source code to generate TrustZone-ready firmware images automatically. Our evaluation using real-world MCU applications demonstrates that TZ-DATASHIELD achieves up to 80.8% compartment memory and 88.6% ROP gadget reductions within the TEE address space. It incurs an average runtime overhead of 14.7% with CFI and DFI enforcement, and 7.6% without these measures. ABOUT NDSS The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies. Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel. Permalink