Data-in-Use Protection

The foundational mechanism that transparently encrypts data as it moves between the processor cache and main memory (RAM). Unlike software-based encryption, this is performed by a dedicated memory encryption engine integrated into the CPU's memory controller.

• Total Memory Encryption (TME): Encrypts all data leaving the processor package with a single ephemeral key, protecting against cold-boot and DIMM-sniffing attacks.
• Multi-Key Total Memory Encryption (MKTME): Extends TME to support multiple encryption keys, allowing different virtual machines or enclaves to be isolated with unique cryptographic keys.
• Secure Encrypted Virtualization (SEV): AMD's implementation that encrypts VM memory with a key unique to each guest, preventing the hypervisor from accessing plaintext data.

A protocol that allows a Trusted Execution Environment to prove its identity, integrity, and security posture to a remote relying party before any secrets are provisioned. Attestation establishes a hardware root of trust that anchors the entire security chain.

• Local Attestation: Two enclaves on the same platform verify each other's identity and integrity before establishing a secure communication channel.
• Remote Attestation: An enclave generates a cryptographically signed report (a quote) containing its measurement hash, which a remote verifier validates against a trusted reference.
• DCAP (Data Center Attestation Primitives): Intel's infrastructure allowing enterprises to run their own attestation services without depending on Intel's cloud-hosted verification, enabling scalable privacy-preserving deployment.

A hardware-enforced boundary that carves out a private region of memory—an enclave—inaccessible to any software outside it, including the operating system, hypervisor, and even other enclaves.

• SGX Enclave Page Cache (EPC): A dedicated, encrypted memory region where enclave code and data reside. Access violations trigger hardware-level faults.
• AMD SEV-SNP Reverse Map Table: A hardware structure that prevents the hypervisor from remapping guest memory pages, blocking malicious page-table manipulation attacks.
• ARM CCA Realm: A dynamically created, hardware-backed address space that isolates sensitive workloads from the hypervisor, managed by a new security abstraction layer called the Realm Management Monitor (RMM).

A mechanism that cryptographically binds data to a specific enclave's identity, allowing sensitive information to be securely persisted to untrusted storage and retrieved only by the exact same enclave on the same platform.

• Seal Key Derivation: The enclave derives a unique encryption key from its MRENCLAVE (code identity) or MRSIGNER (author identity) fused with a hardware-embedded root key.
• Identity Binding: Sealing to MRENCLAVE ensures only the exact same code version can unseal; sealing to MRSIGNER allows updates from the same vendor to access persisted data.
• Monotonic Counters: Hardware-backed counters prevent rollback attacks, ensuring an attacker cannot restore an old sealed data blob to bypass security patches.

Defensive techniques that neutralize information leakage through physical side channels—timing variations, power consumption, or electromagnetic emissions—that could otherwise extract secrets from a theoretically secure enclave.

• Constant-Time Programming: Algorithms designed to execute in identical cycles regardless of input values, eliminating timing-based oracle attacks on cryptographic operations.
• Speculative Execution Barriers: Instructions like LFENCE that serialize execution and prevent speculative side-channel attacks (e.g., Spectre, Meltdown) from leaking enclave secrets.
• Ciphertext Integrity Verification: AMD SEV-SNP's VM-Provided Memory Encryption adds an integrity tree that detects ciphertext tampering, preventing malicious hypervisors from launching replay or remapping attacks.

The application of data-in-use protection to machine learning pipelines, ensuring that proprietary models, sensitive training data, and user inference inputs remain confidential during active computation.

• Private Inference: A client's input data and the server's model weights remain mutually confidential during inference, with both decrypted only inside an attested enclave.
• Model Protection: Encrypted model weights are decrypted exclusively within the TEE, preventing intellectual property theft by cloud operators or malicious insiders.
• NVIDIA Confidential Computing: Extends TEE protections to GPU-accelerated workloads, enabling secure AI training and inference on protected data with hardware-enforced isolation between the CPU and GPU memory spaces.

The transparent, hardware-level mechanism that enforces data-in-use protection by encrypting a process's or VM's entire memory space. Unlike application-level encryption, runtime encryption operates below the OS, ensuring data is never exposed in plaintext while loaded in RAM.

• Transparent: No application code changes required
• Continuous: Memory pages are encrypted on-the-fly by the memory controller
• Hardware-rooted: Keys are generated from a physically unclonable hardware root of trust

A secure area within a main processor that guarantees confidentiality and integrity for code and data loaded inside. The TEE is the foundational hardware primitive that enables data-in-use protection by isolating sensitive computation from all other software, including privileged system components.

• Isolation: Hardware-enforced boundary prevents external inspection
• Attestation: Cryptographically proves its identity to remote parties
• Sealing: Securely persists data to untrusted storage bound to the TEE's identity

The cryptographic process that establishes trust in a data-in-use protection environment. Before a client sends sensitive data for processing, remote attestation verifies that the target TEE is genuine, runs the correct software, and hasn't been tampered with. This closes the trust gap in distributed confidential workloads.

• Measurement: Cryptographic hash of enclave code and configuration
• Verification: Remote party validates the measurement against a known-good value
• Provisioning: Secrets are only released to an attested, trustworthy enclave

The application of data-in-use protection specifically to machine learning pipelines. It protects the confidentiality and integrity of model weights (intellectual property), training data (privacy), and inference inputs (user queries) during active computation. This enables secure multi-party AI without exposing sensitive assets.

• Private Inference: Client input and server model remain mutually confidential
• Model Protection: Weights are only decrypted inside an attested enclave
• Federated Learning Security: Aggregation occurs in a protected environment

A class of non-invasive attacks that threaten data-in-use protection by exploiting physical information leakage—timing variations, power consumption, electromagnetic emissions, or cache access patterns—from a computing device. Even theoretically secure TEEs must be hardened against these attacks to maintain true data-in-use confidentiality.

• Timing attacks: Infer secrets from execution time differences
• Power analysis: Monitor energy consumption to extract cryptographic keys
• Cache-based: Exploit shared CPU cache states across security boundaries
• Constant-time programming and microarchitectural mitigations are critical defenses