Trusted Execution Environment (TEE)

Data confidentiality ensures that information inside the enclave is unreadable to any entity outside it. The CPU encrypts all enclave memory (the Enclave Page Cache or EPC) using hardware-managed encryption keys. Even a malicious operating system, hypervisor, or DMA attack cannot read plaintext data. This is the foundational property that enables privacy-preserving computation on untrusted cloud infrastructure.

Data integrity guarantees that enclave memory cannot be modified by unauthorized external actors. The hardware memory encryption engine attaches a cryptographic Message Authentication Code (MAC) to each cache line written to DRAM. Upon read, the MAC is verified. Any tampering—such as a bus snooping attack or malicious hypervisor write—is detected and causes the processor to halt enclave execution, preventing corrupted results.

Code integrity ensures that only the exact, unmodified code loaded into the enclave can execute. The enclave's initial state is cryptographically measured during a process called attestation, producing a hash that uniquely identifies the code and data. Any attempt to alter the enclave binary after measurement—such as a just-in-time code injection attack—will produce a different measurement, breaking the trust chain and preventing the release of secrets.

Remote attestation is the mechanism by which an enclave proves its identity and integrity to a remote party. The process involves:

• The CPU generating a cryptographically signed report containing the enclave's measurement hash
• The report is verified by a trusted service (e.g., Intel DCAP, AMD SEV-SNP's AMD-SP)
• The remote party can then establish an encrypted channel directly into the enclave This allows a client to verify they are sending secrets to genuine, unmodified code running in a genuine TEE.

Hardware isolation is the physical enforcement mechanism that separates the trusted world from the untrusted world. The CPU enforces access controls at the silicon level: non-enclave code cannot access enclave memory pages, even if executing at the highest privilege level (ring 0). This is distinct from software-based isolation like containers or VMs, which rely on a trusted hypervisor. In a TEE, the CPU itself is the root of trust, reducing the Trusted Computing Base (TCB) to the processor and the enclave code.

Sealed storage allows an enclave to encrypt data for persistence outside the TEE, such as on disk. The encryption key is derived from the CPU's unique, fused hardware key and the enclave's measurement hash. This binds the data to that specific CPU and that specific enclave code. Key properties:

• Sealing to Enclave Identity: Data can only be decrypted by the same enclave on the same CPU
• Sealing to Signing Identity: Data can be decrypted by any enclave signed by the same author This prevents offline attacks on persisted enclave state.

A hardware-isolated memory region within the CPU that prevents access even from privileged software layers. The enclave encrypts its memory pages and verifies integrity at boot via remote attestation. Key properties:

• Isolated execution from OS/hypervisor
• Memory encryption engine (MEE) for DRAM protection
• Sealed storage for persistent data protection
• Measured boot with cryptographic hash chain

A cryptographic protocol that proves to a remote party that specific code is running inside a genuine TEE on an authentic platform. The process:

• Enclave generates a measurement hash of its initial state
• Hardware signs the measurement with a provisioned attestation key
• Verifier validates the signature against the manufacturer's certificate chain
• Establishes trust without revealing enclave contents

Secure Encrypted Virtualization with Secure Nested Paging — AMD's TEE for full virtual machine isolation. Unlike SGX's application-level enclaves, SEV encrypts entire VMs with hardware-managed keys. Features:

• Reverse map table prevents hypervisor remapping attacks
• VM-level attestation via signed launch measurement
• Transparent encryption of all guest memory pages
• No code modification required for existing applications
• Stronger resistance to certain side-channel vectors vs. SGX

TEEs face sophisticated attacks that infer secrets through physical leakage vectors rather than logical flaws. Critical attack classes:

• Cache timing attacks — measuring access latencies to detect enclave memory patterns
• Controlled-channel attacks — malicious OS observes page fault sequences
• Power analysis — monitoring CPU power draw during cryptographic operations
• Speculative execution attacks — exploiting transient instructions (Spectre, Foreshadow)

Modern TEEs incorporate constant-time algorithms and hardware mitigations against these vectors.