Trusted Execution Environment (TEE)

A TEE creates a secure enclave—a private region of memory isolated by the CPU. Code and data inside the enclave are inaccessible to the host OS, hypervisor, or other applications, even if they have root privileges. This protects sensitive federated aggregation logic from malicious insiders or compromised infrastructure. The isolation is enforced by the processor's memory management unit, not software.

Remote attestation is a cryptographic mechanism that allows a remote party to verify the identity and integrity of the TEE before sending sensitive data. The TEE produces a signed attestation report containing a hash of its code and configuration, which is verified against the manufacturer's public key. This assures a hospital that the aggregation server is running the correct, unmodified software.

All data within a TEE enclave is encrypted at rest in memory using an on-die memory encryption engine. This prevents cold-boot attacks, DMA attacks, or snooping by a malicious hypervisor. Additionally, integrity trees detect tampering—any unauthorized modification to enclave memory causes the CPU to halt execution, preventing data corruption.

TEEs provide sealed storage, allowing data to be encrypted and persisted to disk in a way that binds it to the specific enclave and platform that created it. The decryption key is derived from the CPU's unique, fused-in-manufacturing root key. This ensures that aggregated model weights stored for later rounds can only be decrypted by the exact same TEE instance.

The Trusted Computing Base of a TEE is drastically smaller than a full OS. It typically includes only the CPU, the enclave code, and a thin runtime. By excluding the massive, bug-prone OS kernel and hypervisor from the TCB, the attack surface is minimized. This is critical for healthcare compliance, where a smaller TCB simplifies security audits.

Modern TEEs incorporate hardware and microarchitectural defenses against side-channel attacks (e.g., cache timing, branch prediction). Techniques include partitioning CPU caches, disabling performance counters for enclave threads, and constant-time cryptographic implementations. This prevents an untrusted OS from inferring private model updates by observing execution patterns.

A cryptographic protocol that allows a central server to compute the sum of encrypted model updates from multiple clients without inspecting any individual contribution. When combined with a TEE, SecAgg ensures that even the trusted hardware cannot view raw updates before aggregation, providing defense-in-depth against side-channel attacks on the enclave.

A cryptographic scheme enabling computation directly on encrypted data, producing an encrypted result that matches operations on plaintext. Unlike TEEs which protect data in use via hardware isolation, HE protects data in computation via mathematical guarantees. Hybrid architectures often use TEEs to accelerate HE's heavy ciphertext operations.

A mathematical framework injecting calibrated statistical noise into model updates to provide a provable guarantee against membership inference. While TEEs prevent the aggregator from seeing raw data, DP prevents the released model from memorizing individual records. The epsilon budget quantifies the privacy loss, with lower values enforcing stronger guarantees.

A cryptographic subfield enabling multiple parties to jointly compute a function over private inputs without revealing them. Unlike TEEs which rely on hardware trust, SMPC relies on information-theoretic or computational hardness assumptions. Modern federated systems often combine SMPC with TEEs for hybrid trust models.

The resilience property ensuring a distributed system operates correctly even when some nodes exhibit arbitrary or malicious behavior. In TEE-protected aggregation, BFT protocols defend against compromised enclaves or dishonest clients submitting poisoned model updates designed to corrupt the global model.

A cryptographic mechanism allowing a client to verify the identity and integrity of a remote TEE before transmitting sensitive data. The enclave generates a signed quote containing a cryptographic hash of its code and state, which the client validates against the hardware manufacturer's trusted root certificate.