Trusted Execution Environment (TEE)

The TEE carves out a distinct physical region of the CPU, separated from the normal world (Rich Execution Environment). This is not a software sandbox; it is enforced by the processor's memory management unit and bus architecture. Even a compromised OS kernel or hypervisor cannot read or tamper with the TEE's memory pages. This creates a hardware root of trust that shrinks the attack surface to the silicon itself.

A critical cryptographic mechanism that allows a remote party to verify the exact identity and integrity of the software stack running inside the TEE. The processor generates a signed attestation report containing a cryptographic hash of the enclave's initial state and memory. This proves to a client that they are communicating with a genuine, unmodified application running on a specific TEE hardware platform, not a simulator or compromised host.

All data leaving the CPU package for external RAM is automatically encrypted and integrity-protected by a dedicated hardware engine (e.g., Memory Encryption Engine). This prevents physical attackers from performing cold-boot attacks, DMA attacks, or snooping on the memory bus. The TEE ensures that even if an attacker physically probes the DRAM modules, they only obtain unintelligible ciphertext, not plaintext model parameters or user data.

A mechanism that allows an enclave to encrypt data and bind it to a specific combination of the enclave's identity and the platform's hardware identity. Data can be sealed so that it can only be decrypted by the exact same enclave code on the exact same physical machine. This protects data at rest, ensuring that if an attacker steals the hard drive, the sealed data remains cryptographically inaccessible without the original TEE context.

Establishes a trusted path between the TEE and peripheral devices like keyboards, displays, or accelerators. Without secure I/O, an attacker controlling the host OS could intercept keystrokes or manipulate screen output. TEEs like Intel SGX and ARM TrustZone implement protected channels that prevent the host from injecting or eavesdropping on data in transit between the user and the secure enclave, closing a critical side-channel vector.

The TEE architecture deliberately minimizes the amount of code that must be trusted for security. The TCB typically includes only the application code inside the enclave and the processor package itself. Critically, it excludes the massive, bug-prone host operating system, device drivers, and hypervisor. This radical reduction in TCB size drastically limits the potential for exploitable vulnerabilities in the secure execution path.

A hardware-isolated region within a CPU that protects code and data from the host OS, hypervisor, and other applications. Enclaves use encrypted memory pages accessible only within the CPU package.

• Intel SGX: Application-level enclaves with 128-256 MB encrypted memory
• AMD SEV-SNP: Full VM encryption with integrity protection
• ARM CCA: Realm-based isolation for confidential containers

Attestation verifies enclave identity cryptographically before secrets are provisioned.

A cryptographic protocol that proves to a remote party that specific code is executing inside a genuine TEE on an authentic platform. The process generates a signed measurement of the enclave's initial state.

• Local Attestation: Two enclaves on the same platform verify each other
• Remote Attestation: External verifier validates enclave identity via quoting service
• DCAP: Data Center Attestation Primitives for flexible verification without Intel's live service

Prevents provisioning secrets to compromised or emulated environments.

Defenses against attacks that infer enclave secrets by observing physical side effects of computation—timing, power consumption, cache access patterns, or electromagnetic emanations.

• Constant-time programming: Eliminates data-dependent branching in cryptographic operations
• Cache partitioning: CAT (Cache Allocation Technology) isolates enclave cache lines
• Speculative execution barriers: LFENCE instructions prevent Spectre-class attacks
• Data-oblivious algorithms: Access patterns independent of secret values

Modern TEEs like Intel TDX and AMD SEV-SNP include hardware mitigations against cache-timing and page-fault attacks.

A hardware unit integrated into the memory controller that transparently encrypts and integrity-protects data moving between the CPU and RAM. Critical for preventing cold-boot attacks and physical bus snooping.

• Intel MKTME: Multi-Key Total Memory Encryption with per-VM keys
• AMD SME: Secure Memory Encryption with single ephemeral key
• AMD SEV: Secure Encrypted Virtualization with per-VM key isolation

Encryption occurs at DRAM bandwidth speeds with negligible latency overhead.

The security boundary defining what a TEE protects against and what remains out of scope. The trusted computing base (TCB) includes the CPU package, enclave code, and attestation infrastructure.

• In-scope threats: Malicious OS, hypervisor, firmware, DMA attacks, cold-boot attacks, compromised cloud administrators
• Out-of-scope threats: Denial-of-service, physical probing of CPU die, microarchitectural side-channels (partially mitigated)
• Trust assumptions: CPU manufacturer's key provisioning process, attestation service availability

Understanding this model is essential for risk assessment in confidential AI deployments.