Trusted Execution Environment (TEE)

The TEE creates a strict physical boundary between the secure world and the normal world. All memory pages assigned to the enclave are hardware-encrypted and inaccessible to the OS, hypervisor, or DMA attacks.

• Memory Encryption: Data in DRAM is encrypted, preventing cold-boot and bus-snooping attacks.
• Address Space Separation: The enclave's memory is mapped to a protected physical address range invisible to non-secure peripherals.
• Interrupt Handling: Secure interrupts are routed directly to the enclave, preventing the OS from observing or manipulating execution state during context switches.

A cryptographic mechanism that allows a remote client to verify the identity and integrity of the TEE before provisioning secrets or sending sensitive data. The enclave produces a signed measurement of its initial state.

• Measurement Hash: A cryptographic hash of the enclave's code, data, and configuration is generated at load time.
• Attestation Report: The processor signs this hash with a device-specific key fused at manufacture, creating a verifiable report.
• Verification Service: A third-party service validates the signature against the manufacturer's certificate chain, assuring the client the enclave is genuine and unmodified.

A method for securely persisting enclave data to untrusted storage. Data is encrypted with a key derived from the enclave's identity and the processor's unique key, binding it to that specific TEE on that specific device.

• Seal to Enclave Identity: Data can only be decrypted by the exact same enclave binary on the same CPU.
• Seal to Signing Authority: Data can be decrypted by any enclave signed by the same developer, enabling secure data migration across versions.
• Anti-Rollback Protection: Sealed data includes version counters to prevent an attacker from restoring a previous, vulnerable state.

The TEE manages its own execution context independently of the host OS scheduler. This prevents timing side-channel attacks where the OS observes cache misses or execution latency to infer enclave secrets.

• Asynchronous Exit (AEX): When an interrupt occurs, the processor saves the enclave's register state to a protected area and clears registers before handing control to the OS handler.
• State Sanitization: All architectural state visible to the non-secure world is scrubbed on enclave exit, preventing data leakage through shared resources.
• Deterministic Execution: Enclave code can be written to execute in constant time, eliminating data-dependent timing variations observable by the OS.

A dedicated hardware unit integrated into the memory controller that transparently encrypts and decrypts all enclave data moving between the processor cache and external RAM.

• AES-XTS Encryption: Uses a tweakable block cipher mode where the physical memory address is part of the tweak, preventing an attacker from relocating ciphertext blocks.
• Integrity Tree: A Merkle tree structure stored in memory verifies that data read from RAM has not been tampered with, detecting replay and splicing attacks.
• Zero Latency Overhead: Modern implementations operate at full memory bandwidth, making the performance impact negligible for inference workloads.

TEEs incorporate hardware and microarchitectural defenses against attacks that observe physical phenomena like power consumption, electromagnetic emanations, or cache access patterns to extract secrets.

• Cache Partitioning: Enclaves can be assigned dedicated cache ways, preventing the OS from priming or probing shared cache sets to observe enclave access patterns.
• Power Analysis Mitigation: Hardware-level techniques like randomized clocking and balanced logic styles reduce the signal-to-noise ratio of power traces.
• Speculation Barriers: Instructions like Intel's LFENCE or ARM's DSB prevent speculative execution from accessing enclave memory, closing Spectre-class vulnerabilities at the enclave boundary.

Allows computation directly on ciphertext, producing an encrypted result that only the data owner can decrypt. When paired with a TEE, the model is decrypted inside the enclave but processes homomorphically encrypted user inputs, ensuring the host OS never sees either the model weights or the raw query. This provides a zero-trust inference pipeline.

TEEs protect against logical memory access but remain vulnerable to microarchitectural side channels—timing, power analysis, and electromagnetic emanations. Mitigations include constant-time programming, cache partitioning, and inserting noise in power traces. Modern TEEs like Intel TDX and ARM CCA incorporate hardware-level defenses against cache-based attacks like Prime+Probe.

An active defense mechanism that immediately and irrevocably erases cryptographic keys and model weights from memory upon detecting a physical tampering event. In TEE contexts, zeroization is triggered by tamper sensors monitoring voltage, temperature, or enclosure integrity. This ensures that even if an attacker physically extracts the DRAM, the sensitive data is already destroyed.

The process of cryptographically securing a stored model artifact so it can only be loaded by an authorized TEE. The model is encrypted at rest using a key derived from the enclave's unique identity, binding the ciphertext to a specific hardware instance. This prevents offline analysis of model weights and ensures only attested, trusted runtimes can decrypt the IP.