Trusted Execution Environment (TEE)

TEEs employ a dedicated Memory Encryption Engine (MEE) that transparently encrypts all data written to external RAM and decrypts it on read. This prevents cold-boot attacks, DRAM probing, and physical bus snooping from extracting plaintext agent secrets.

• Integrity tree: A Merkle tree structure verifies that encrypted memory blocks haven't been tampered with or replayed
• Counter-mode encryption: Uses hardware-generated nonces to ensure semantic security, so identical plaintext never produces the same ciphertext
• Enclave Page Cache (EPC): A reserved portion of RAM that holds decrypted enclave data, accessible only by the CPU package

Every TEE derives its security guarantees from a hardware root of trust—a set of immutable, factory-provisioned cryptographic keys burned into the silicon during manufacturing. This root anchors the entire chain of trust.

• Fuse-derived keys: Unique device keys are derived from physically unclonable functions (PUFs) or e-fuses that cannot be extracted
• Key derivation hierarchy: The root key derives sealing and attestation keys, ensuring each enclave gets cryptographically isolated key material
• Secure boot: The hardware root verifies the signature of the initial firmware, which then verifies each subsequent stage, preventing persistent malware

Sealing is the TEE mechanism that binds encrypted data to a specific enclave identity on a specific device, ensuring that agent secrets can only be decrypted by the exact same code on the exact same hardware.

• Seal to enclave identity: Data is encrypted with a key derived from the enclave's measurement hash, so any code modification renders the data inaccessible
• Seal to sealing authority: Data can be bound to the enclave author's signing identity, allowing versioned access across updates
• Monotonic counters: Sealing can incorporate hardware counters to prevent rollback attacks where an attacker restores an old, vulnerable state

TEEs implement secure scheduling to prevent the host OS from mounting timing-based side-channel attacks or denying service to security-critical agent workloads. Interrupt handling is carefully designed to avoid leaking enclave state.

• Asynchronous Exit (AEX): When an interrupt occurs during enclave execution, the CPU saves the enclave state to a protected area, clears registers, and only then transfers control to the OS handler
• EDBGRD prevention: Debug registers are sanitized on enclave entry to prevent the host from setting breakpoints that could leak secrets
• Timer protection: The TEE can enforce execution quotas, preventing a malicious OS from starving the enclave of CPU time indefinitely

A hardware-isolated region within a CPU that acts as a private vault for code and data. It is the physical instantiation of a TEE.

• Boundary: The CPU enforces strict access controls at the silicon level; even the kernel cannot read enclave memory.
• Memory Encryption: Data pages are transparently encrypted and integrity-protected when moved to external RAM.
• Examples: Intel SGX enclaves, Apple Secure Enclave Processor, ARM TrustZone secure world.

A hardware unit integrated into the memory controller that transparently encrypts and decrypts data moving between the CPU and system DRAM.

• Function: Prevents physical bus snooping and cold-boot attacks against TEE memory.
• Granularity: Operates at cache-line speed to avoid performance bottlenecks.
• Key Management: Uses ephemeral, hardware-generated keys that are lost on power cycle, ensuring data is cryptographically erased at shutdown.

A critical design requirement for TEEs to prevent attackers from inferring secrets by observing physical byproducts of computation rather than breaking cryptography.

• Attack Vectors: Cache timing, power analysis, electromagnetic emanations, and branch prediction state.
• Mitigations: Constant-time algorithms, cache partitioning, and microarchitectural flushing.
• Relevance: A TEE that leaks an agent's private key through a cache-timing side channel defeats the purpose of hardware isolation.