Intel SGX

An enclave is a protected, hardware-isolated region of memory created by an application. Code and data inside the enclave are encrypted and inaccessible to any other software, including the operating system, hypervisor, BIOS, or system management mode (SMM). This hardware-enforced isolation ensures confidentiality and integrity even if the underlying platform is compromised.

• Memory Encryption Engine (MEE): Transparently encrypts and decrypts enclave pages in the CPU cache.
• Access Control Checks: The CPU's memory management unit (MMU) enforces access policies, preventing unauthorized reads or writes.

Remote Attestation is a cryptographic protocol that allows a remote party (a service provider) to verify that the correct software is running securely inside a genuine Intel SGX enclave on a specific platform. This establishes a chain of trust from the hardware to the application.

• Quote Generation: The enclave produces a signed measurement (a quote) of its identity and initial state.
• Intel Attestation Service (IAS): A trusted third-party service (operated by Intel) verifies the quote's signature and platform status.
• Sealing: After successful attestation, the enclave can derive keys to seal (encrypt) data to its specific identity or to the platform, for persistent secure storage.

Sealed Storage allows an enclave to persistently encrypt data to disk in a way that only the same enclave (or a related enclave on the same platform) can decrypt it later. The encryption key is derived from the enclave's identity and/or the platform's hardware key, not stored in software.

• Identity-Based Sealing: Data is bound to the specific enclave's measurement (MRENCLAVE).
• Platform-Based Sealing: Data is bound to the CPU, allowing different enclaves or newer versions of the same enclave on the same machine to access it.
• This mechanism enables secure, long-term state management for stateless enclaves.

The Enclave Page Cache (EPC) is a limited, dedicated region of physical memory (RAM) managed by the CPU where all enclave pages reside. The CPU's SGX memory encryption engine ensures all EPC pages are encrypted when outside the CPU package.

• EPC Management: The operating system allocates EPC pages to enclaves via an Enclave Page Cache Map (EPCM), a secure structure managed by the CPU.
• Paging Support: EPC pages can be swapped to encrypted storage (on disk) when physical EPC is full, using the Enclave Page Cache Manager (EPCM) in the OS kernel.
• Size Constraints: EPC size is fixed per CPU model (e.g., 128 MB per package), imposing a hard limit on total concurrent enclave memory.

Intel SGX dramatically reduces the size of the Trusted Computing Base (TCB)—the set of hardware, firmware, and software components that must be trusted for the system to be secure. The TCB for an SGX-protected application is minimized to the CPU package itself and the enclave code.

• Untrusted OS & Hypervisor: The operating system, virtual machine monitor, and system firmware are explicitly excluded from the TCB.
• Smaller Attack Surface: By removing billions of lines of OS and hypervisor code from the TCB, the potential for vulnerabilities is significantly reduced.
• Compartmentalization: Each enclave forms its own isolated security domain, limiting the impact of a breach to a single enclave.

Enclave execution is controlled via specific CPU instructions that manage transitions into and out of the protected environment. These transitions are carefully designed to prevent leakage of enclave state.

• EENTER: Asynchronous entry point. The untrusted application calls into a predefined entry point within the enclave. The CPU performs rigorous checks before transferring control.
• EEXIT: Synchronous exit. The enclave returns control to the untrusted application. The CPU securely clears registers to prevent data leakage.
• Asynchronous Enclave Exit (AEX): Occurs due to an interrupt or exception. The CPU saves the enclave's context securely in the State Save Area (SSA) and scrubs registers before handling the event. Control is later restored via ERESUME.

Secure Multi-Party Computation is a cryptographic subfield that enables multiple parties to jointly compute a function over their private inputs while revealing only the final output. It achieves this without a trusted third party.

• Core Guarantee: Input data remains encrypted or secret-shared throughout the computation.
• Comparison to SGX: MPC is a software cryptographic protocol, while SGX is a hardware isolation mechanism. MPC provides stronger cryptographic guarantees but often with higher computational overhead. They are sometimes combined for hybrid security.
• Federated Learning Application: Used for secure aggregation where the server learns the sum of model updates but not any individual client's contribution.

Homomorphic Encryption is a form of encryption that allows computations to be performed directly on ciphertext, generating an encrypted result that, when decrypted, matches the result of operations performed on the plaintext.

• Types: Partially Homomorphic Encryption (PHE, e.g., Paillier) supports only addition or multiplication. Fully Homomorphic Encryption (FHE) supports arbitrary computations but is computationally intensive.
• Use Case: Enables a server to train a model or aggregate updates on encrypted client data without ever decrypting it.
• Relation to SGX: An alternative privacy approach. SGX processes plaintext data but inside a secure, attested enclave, while HE processes encrypted data everywhere. HE avoids the need for hardware trust but incurs significant performance costs.

Differential Privacy is a rigorous mathematical framework for quantifying and limiting the privacy loss incurred by an individual when their data is included in a statistical analysis or machine learning model. It works by adding calibrated noise to outputs.

• Privacy Budget (ε): A parameter controlling the privacy-utility trade-off; smaller ε means stronger privacy.
• Mechanisms: Common techniques include the Gaussian Mechanism for vector outputs and the Exponential Mechanism for non-numeric outputs.
• Synergy with SGX: Often used in conjunction. SGX can provide a trusted environment for applying the precise, correct amount of noise (preventing malicious noise reduction), or for implementing the more complex Local Differential Privacy model where noise is added on the client device before data leaves.

Byzantine Robust Aggregation refers to algorithms for securely aggregating model updates in federated learning that are resilient to a bounded number of malicious clients sending arbitrary or adversarial updates aimed at corrupting the global model.

• Threat Model: Protects against malicious adversaries who arbitrarily deviate from the protocol, unlike 'honest-but-curious' adversaries.
• Techniques: Includes coordinate-wise median, trimmed mean, and Krum aggregation, which identify and filter out statistical outliers among updates.
• Role of SGX: SGX can enhance Byzantine robustness by providing a trusted verifier. The enclave can attest to the correct execution of the robust aggregation algorithm, ensuring that even a compromised server cannot arbitrarily exclude valid updates or include malicious ones undetected.

Remote Attestation is the process by which a trusted hardware component (like an SGX enclave) cryptographically proves to a remote verifier that a specific piece of code is running securely inside a genuine TEE. It establishes trust in a remote, potentially hostile environment.

• SGX Implementation: Uses a digital signature from the Intel Provisioning Certificate Service, combined with a quote containing the enclave's identity (MRENCLAVE) and a hash of its initial state.
• Critical Workflow: 1) Client creates an enclave and loads code. 2) Enclave generates a measurement. 3) A remote party (e.g., a federated learning server) requests attestation. 4) The enclave provides a verifiable quote, proving it's running the expected, unmodified code in a real SGX processor.
• Application: Foundational for trusted federated learning, allowing clients to verify the server's secure aggregation code before submitting their private model updates.