Trusted Execution Environment (TEE)

The TEE establishes a secure enclave—a private region of memory physically isolated from the main operating system, hypervisor, and other applications. This is enforced by the processor's memory management unit, not software policy.

• Bus-level protection: On-chip memory bus transactions are tagged and filtered to prevent snooping.
• Untrusted OS resistance: Even a compromised kernel with root privileges cannot read or modify enclave memory.
• Physical RAM encryption: Memory pages belonging to the enclave are encrypted in DRAM, defending against cold-boot attacks.

A cryptographic mechanism that allows a remote party to verify the identity, integrity, and authenticity of the code executing inside a TEE before trusting it with secrets.

• Measurement: The TEE generates a cryptographically secure hash of its initial state (code, data, configuration).
• Attestation Report: This hash is signed by a hardware-derived key fused into the CPU at manufacture.
• Verification Service: The remote party validates the signature against the manufacturer's certificate chain to confirm the enclave is genuine and unmodified.

The TEE guarantees that data processed within the enclave cannot be observed (confidentiality) or tampered with (integrity) by any external entity, including the cloud provider.

• Encryption in use: Data is decrypted only inside the CPU package; it remains encrypted in memory, storage, and transit.
• Integrity trees: Hardware mechanisms like Merkle trees detect and prevent replay attacks or unauthorized modifications to enclave memory.
• Sealing: Data can be encrypted to a specific enclave's identity, ensuring it can only be decrypted by that exact code on that specific CPU.

The TCB is the set of all hardware, firmware, and software components critical to the enclave's security. A TEE radically reduces the TCB compared to a full operating system.

• Exclusion of OS: The hypervisor and OS are explicitly excluded from the TCB.
• Small attack surface: The TCB comprises only the enclave code, the processor package, and a thin security monitor.
• Formal verification: The reduced complexity of the TCB makes it feasible to mathematically prove the absence of certain vulnerability classes.

A mechanism for encrypting persistent data such that it can only be decrypted by the exact same enclave on the exact same platform that sealed it.

• Identity binding: Sealing keys are derived from the enclave's measurement hash and the CPU's unique root key.
• Policy-based unsealing: Data can be sealed to a specific enclave version or to any enclave signed by the same author.
• Migration protection: Sealed data is cryptographically bound to the hardware, preventing offline brute-force attacks on a different machine.

Protection for data paths between the TEE and peripherals (keyboard, display, network) to prevent eavesdropping or injection by a compromised OS.

• Encrypted channels: Direct encrypted tunnels between the enclave and trusted I/O devices.
• Display protection: Framebuffer regions are encrypted, ensuring only the TEE can render sensitive information to the screen.
• Input integrity: Keystrokes or sensor data are encrypted end-to-end from the peripheral to the enclave, bypassing the untrusted OS input stack.

A hardware-based security paradigm that protects data in use by performing computation within a TEE. Unlike encryption for data at rest or in transit, confidential computing encrypts the workload while it is being processed in main memory. This ensures that even the cloud provider, hypervisor, or operating system cannot access sensitive code or data. Major implementations include Intel SGX, AMD SEV-SNP, and AWS Nitro Enclaves. The Confidential Computing Consortium defines this as the protection of data during its entire lifecycle, with the TEE providing a hardware-rooted trust boundary that isolates the workload from the host stack.

A cryptographic protocol that allows a remote party to verify the identity and integrity of the software running inside a TEE. The process generates a signed attestation report containing a hash of the enclave's memory and code, signed by a hardware-rooted key. A relying party validates this against a trusted attestation service (e.g., Intel IAS, AMD KDS) to confirm the enclave is genuine and unmodified. This is the foundational mechanism for establishing trust in a TEE without physical access to the hardware.

An isolated memory region within a TEE that contains protected code and data. The enclave is encrypted at the hardware level and inaccessible to any process outside its boundary, including the host OS, hypervisor, or DMA accesses. Key properties include:

• Isolation: Strict memory access controls enforced by the CPU
• Sealing: Ability to encrypt data for persistent storage bound to the enclave's identity
• Measurement: A cryptographic hash of the enclave's initial state used in attestation Enclaves are the fundamental unit of trust in architectures like Intel SGX.

An attack that extracts secrets from a TEE by observing physical side effects of computation rather than breaking the cryptographic primitives directly. Common vectors include:

• Cache-timing attacks: Measuring access latencies to infer memory access patterns
• Power analysis: Monitoring power consumption to deduce cryptographic operations
• Electromagnetic emanations: Capturing EM signals to reconstruct data TEEs include hardware and microcode mitigations, but side-channel resistance remains an active research area. Speculative execution vulnerabilities like Spectre and Meltdown are notable examples.

The set of all hardware, firmware, and software components that are critical to the security of a TEE. A vulnerability in any TCB component can compromise the entire system. TEEs aim to minimize the TCB by excluding the operating system, hypervisor, and other large attack surfaces. For example, Intel SGX's TCB includes only the CPU package and the enclave code itself, while AMD SEV's TCB includes the SoC, PSP firmware, and the guest VM. A smaller TCB reduces the attack surface and simplifies formal verification.

A hardware unit integrated into the CPU's memory controller that transparently encrypts and decrypts data moving between the processor and main memory. This is the core mechanism that protects TEE data from physical attacks like cold boot attacks or DMA snooping. Technologies include:

• Intel TME/MKTME: Total Memory Encryption with multi-key support
• AMD SME/SEV: Secure Memory Encryption and Secure Encrypted Virtualization
• ARM CCA: Realm Management Extension with memory encryption The engine operates at line speed with minimal latency overhead.