Trusted Execution Environment (TEE)

The TEE creates a secure enclave—a private region of memory within the main processor. Code and data inside this enclave are cryptographically isolated from everything outside, including the OS kernel, hypervisor, and DMA accesses. Even a root-level attacker on the host cannot read or modify enclave memory. This is enforced by the CPU's memory management unit and on-die memory encryption engines.

• Intel SGX: Uses Enclave Page Cache (EPC) with Memory Encryption Engine (MEE)
• AMD SEV: Encrypts entire VM memory with per-VM keys managed by the Platform Security Processor (PSP)
• ARM TrustZone: Splits the SoC into Secure World and Normal World via hardware bus fabric

A cryptographic mechanism that allows a remote party to verify that a specific piece of software is running inside a genuine TEE on an authentic platform. The TEE hardware generates a signed attestation report containing a cryptographic hash of the enclave's initial state (measurement) and platform identity. This proves to a client that the code hasn't been tampered with before secrets are provisioned.

• EPID/DCAP (Intel): Anonymous or linkable attestation using Enhanced Privacy ID or Data Center Attestation Primitives
• SEV-SNP Attestation (AMD): Reports signed by the AMD root key with guest policy enforcement
• Verification Service: Third-party services like Intel Trust Authority or custom attestation proxies validate reports

All data within the TEE is encrypted at the hardware level when it leaves the CPU cache and is written to main memory (DRAM). This prevents cold boot attacks, bus snooping, and physical memory scraping. Advanced implementations also provide integrity protection, detecting replay attacks or unauthorized modifications to encrypted memory pages.

• Total Memory Encryption (TME): Encrypts all data leaving the CPU package
• Multi-Key TME (MKTME): Allows per-VM or per-enclave encryption keys
• Integrity Trees: Merkle tree structures that detect tampering with encrypted memory blocks

A mechanism for securely persisting enclave data to untrusted storage. Data is sealed—encrypted with a key derived from the enclave's identity and the platform's hardware root key—before being written to disk. Only the exact same enclave on the exact same platform can unseal it. Optional sealing policies can bind data to the enclave author's signing identity, allowing upgrades.

• Seal to Enclave Identity: Data bound to the specific enclave measurement (MRENCLAVE)
• Seal to Signing Identity: Data bound to the enclave author's public key (MRSIGNER), enabling version migration
• Monotonic Counters: Hardware counters prevent rollback attacks on sealed data

The TEE drastically reduces the Trusted Computing Base (TCB)—the set of hardware, firmware, and software components critical to security. In a traditional stack, the TCB includes the entire OS and hypervisor. With a TEE, the TCB shrinks to just the enclave code, the CPU package, and a thin shim layer. This minimizes the attack surface and simplifies formal verification.

• Excluded from TCB: Host OS, hypervisor, device drivers, other VMs
• Included in TCB: Enclave application code, processor microcode, platform root of trust
• Formal Verification: Smaller TCB enables mathematical proofs of security properties using tools like seL4 or F*

Modern TEE implementations incorporate hardware and microarchitectural defenses against side-channel attacks—techniques that infer secrets by observing physical characteristics like timing, power consumption, or cache access patterns. While no system is immune, TEEs include mitigations against speculative execution attacks (Spectre, Meltdown) and cache-timing leaks.

• Cache Partitioning: Dedicated cache ways for secure world (ARM TrustZone)
• Speculation Barriers: LFENCE and other serializing instructions prevent speculative leaks
• Constant-Time Cryptography: Libraries within the enclave use algorithms resistant to timing analysis
• ASLR Inside Enclave: Address Space Layout Randomization within the enclave itself

A hardware component integrated into modern CPUs that automatically encrypts and decrypts data as it moves between the processor cache and main memory. This is the foundational mechanism that makes TEEs possible.

• AMD Secure Memory Encryption (SME): Encrypts entire DRAM with a single ephemeral key generated at boot
• Intel Total Memory Encryption (TME): Provides full physical memory encryption using an AES-XTS engine on the memory path
• Transparent to applications: No code changes required for basic memory encryption

A cryptographic protocol that allows a remote party to verify the identity, integrity, and trustworthiness of a TEE before sending sensitive data to it. The TEE generates a signed measurement of its internal state.

• Produces a cryptographic quote signed by a hardware-rooted key
• Verifies the exact hash of the enclave code loaded into memory
• Prevents man-in-the-middle attacks where a malicious host impersonates a legitimate TEE
• Essential for establishing trust without physical inspection of the remote machine

A dedicated, encrypted region of physical RAM reserved exclusively for TEE operations. The processor enforces strict access controls preventing any non-enclave code—including the OS kernel, hypervisor, or DMA devices—from reading or writing to EPC pages.

• Limited size: Typically 64MB to 512MB per socket, creating engineering constraints
• EPC paging: Swapping encrypted pages to unprotected memory with integrity guarantees
• Cache coherency: EPC pages are excluded from standard snooping mechanisms to prevent side-channel leakage

Defensive techniques that mitigate attacks exploiting physical leakage vectors such as timing variations, power consumption patterns, and electromagnetic emanations to infer secrets processed inside a TEE.

• Constant-time algorithms: Code paths that execute in identical cycles regardless of secret data values
• Cache partitioning: Isolating TEE cache lines from untrusted processes to prevent prime-and-probe attacks
• Microarchitectural flushing: Clearing branch predictors and prefetch buffers on enclave exit
• Intel SGX LVI mitigations: Silicon-level fixes for Load Value Injection speculative execution attacks

A TEE paradigm that encrypts an entire virtual machine's memory and CPU state, protecting it from the hypervisor and host OS. Unlike process-based enclaves, CVMs require no application refactoring.

• AMD SEV-SNP: Adds integrity protection and attestation to encrypted VMs
• Intel TDX: Extends TEE guarantees to full virtual machines with secure interrupt handling
• Lift-and-shift compatibility: Existing workloads run unmodified inside a CVM
• Guest attestation: The VM can prove its identity and integrity to external services before receiving secrets