Data is the new fuel of the digital landscape, driving innovation, decision-making, and business strategies across industries. In this data-driven world, information has become a powerful asset, but it also comes with great responsibility. Many datasets contain sensitive personal, financial, or corporate information that requires strict protection. Safeguarding this data is crucial, as breaches can lead to significant privacy violations, financial losses, and damage to trust. Therefore, handling data responsibly is not only a matter of security but also of ethics and compliance in today's interconnected world.
To ensure robust data security, protection measures must be applied across all three states of data: in transit, at rest, and during processing. Data in transit, moving between systems or across networks, is vulnerable to interception and requires encryption and secure transmission protocols. Data at rest, stored on servers, databases, or other storage media, must be safeguarded with strong encryption, access controls, and physical security measures. Meanwhile, data in use, actively being processed by applications or systems, demands strict access controls, monitoring, and secure computing environments to prevent unauthorized access or leaks. Comprehensive security across these states is essential to maintaining confidentiality in an increasingly data-centric world. In particular, Trusted Execution Environments (TEEs) provide secure, isolated computing environments that protect sensitive data and code in main memory from unauthorized access, even from privileged system processes or the operating system. 
This research is divided into two main parts.  
The first part focuses on securing data in use, studying federated learning (FL) as a particular use case for data processing systems. FL is chosen due to its inherent predisposition for privacy-preserving machine learning, despite its susceptibility to security threats. Spyware can monitor the main memory of FL client devices to extract information about the private data used to train the FL model through various leakage attacks. In response to this threat, we developed GradSec, a TEE-based defense mechanism to secure FL against leakage attacks. GradSec leverages ARM TrustZone, a TEE for mobile devices, to secure sensitive FL model layers based on each surveyed leakage attack.  
The second part focuses on securing data at rest, leveraging in-memory key-value stores (KVSs) as a storage medium. The choice of KVSs is driven by their schema-less design, which allows for storing various types of data by serializing them when necessary. In this part, we conducted a comprehensive survey of existing TEE-based KVSs in literature, identifying common architectures and building blocks while emphasizing their vulnerability to side-channel leakage attacks despite TEE protection. To mitigate this vulnerability, we propose TruShare, a confidential distributed KVS that harmoniously combines TEEs and secret sharing to split sensitive data across multiple TEE nodes, making data leakage significantly more challenging for an attacker.  
These research objectives collectively aim to address security challenges, particularly confidentiality, in untrusted environments where data may be processed and stored.