We develop the concept of Trusted and Confidential Program Analysis (TCPA) which enables program certification to be used where previously there was insufficient trust. Imagine a scenario where a producer may not be trusted to certify its own software (perhaps by a foreign regulator), and the producer is unwilling to release its sources and detailed design to any external body. We present a protocol that can, using trusted computing based on encrypted sources, create certification via which all can trust the delivered object code without revealing the unencrypted sources to any party. Furthermore, we describe a realization of TCPA with trusted execution environments (TEE) that enables general and efficient computation. We have implemented the TCPA protocol in a system called TCWasm for web assembly architectures. In our evaluation with 33 benchmark cases, TCWasm managed to finish the analysis with relatively slight overheads.

翻译：我们开发了信任和保密方案分析(TCPA)概念,使以前信任不足的地方能够使用程序认证; 设想一种情景,即生产者可能不信任认证自己的软件(也许由外国监管机构进行),而生产者不愿意向任何外部机构披露其来源和详细设计。 我们提出了一个协议,它可以使用基于加密来源的可信计算,创建证书,让所有人都能够信任交付的物体代码,而不必向任何当事方透露未加密来源。 此外,我们描述了TCPA在可信任的执行环境中的实现情况,这种环境有助于普遍和高效的计算。 我们已经在称为网络组装图的TCWAsm系统中实施了TCPA协议。 在我们的33个基准案例中, TCWCSm 设法用相对轻微的管理器完成了分析。