Enclave

The processor physically blocks all software outside the enclave—including the OS kernel and hypervisor—from reading or modifying enclave memory. This is enforced by the CPU's memory encryption engine, which transparently encrypts and integrity-protects enclave cache lines. Any unauthorized access attempt triggers a page fault or machine check, ensuring data-in-use protection even against a compromised host.

Before any external party provisions secrets or trusts an enclave's outputs, the enclave must prove its identity and integrity. The processor generates a cryptographically signed attestation report containing:

• The enclave's measurement (a hash of its code and initial state)
• The platform's TCB version
• User-defined data A remote verifier validates this report against a trusted authority to establish a trust anchor for the workload.

Enclaves cannot access persistent storage directly. Instead, they use data sealing to encrypt secrets and bind them to a specific enclave identity. The processor derives a sealing key from the enclave's measurement and the platform's root of trust. This ensures:

• Only the exact same enclave on the same platform can unseal the data
• Data at rest remains encrypted and tamper-evident
• Secrets survive enclave restarts without exposure to the untrusted OS

Communication between the untrusted host and the enclave occurs only through explicitly defined interfaces:

• ECALLs: Calls from the untrusted application into the enclave to invoke trusted functions
• OCALLs: Calls from the enclave to the untrusted host for necessary system services This narrow interface minimizes the attack surface and allows developers to apply rigorous input validation at every boundary, preventing injection attacks and buffer overflows from compromising enclave integrity.

The Trusted Computing Base (TCB) for an enclave excludes the operating system, hypervisor, and all other applications. Only the enclave's own code and the processor hardware must be trusted. This radical reduction in the TCB means:

• A compromised OS cannot leak enclave secrets
• A malicious cloud administrator cannot inspect workloads
• Security audits focus on a tiny fraction of the total software stack

Modern enclave designs incorporate hardware and microarchitectural defenses against side-channel attacks that exploit timing, power, or cache access patterns. Techniques include:

• Cache partitioning and flushing on enclave exit
• Constant-time cryptographic operations
• Speculative execution barriers While no system is immune, each processor generation adds stronger mitigations against known attack vectors like Spectre and Meltdown variants.

Enclaves enable private inference where both the client's input data and the model owner's proprietary weights remain encrypted during computation. A healthcare provider can submit a patient scan to a diagnostic model running inside an enclave—the model owner never sees the scan, and the hospital never accesses the model architecture. Attestation verifies the enclave's identity before either party releases sensitive data, creating a mutually distrusting yet secure execution environment.

Banks use enclaves to jointly compute anti-money laundering risk scores across institutions without exposing individual customer transactions. Each bank encrypts its data for a specific enclave's public key, the enclave decrypts and processes the combined dataset inside hardware-isolated memory, and only the aggregated risk scores leave the protected environment. The Confidential Consortium Framework (CCF) provides the governance layer, ensuring all parties agree on the code executing inside the enclave.

Cryptocurrency exchanges and custodians deploy enclaves to protect private key material during transaction signing. Keys are generated inside the enclave and never exist in plaintext in host memory. The enclave enforces policy—such as rate limiting or multi-signature requirements—before signing. Even if an attacker compromises the host operating system, they cannot extract the keys. Data sealing allows the enclave to securely persist encrypted key material to disk for recovery.

Cloud databases running inside Confidential VMs encrypt query processing in memory, protecting sensitive data from the cloud provider and malicious insiders. A financial services firm can run complex SQL analytics on customer records in a managed database while the data remains encrypted throughout the query lifecycle. AMD SEV-SNP and Intel TDX enable lift-and-shift migration of existing database workloads without application code changes, reducing the barrier to adoption.

In cross-silo federated learning, multiple hospitals train a shared model without centralizing patient data. The aggregation server—running inside an enclave—receives encrypted model updates from each participant, decrypts them within the protected memory region, computes the weighted average, and discards individual updates. Remote attestation proves to each hospital that the aggregator is running the exact agreed-upon code, preventing a malicious aggregator from inspecting individual gradient contributions.

Decentralized oracle networks use enclaves to prove that external data was fetched and processed honestly before being submitted on-chain. An enclave retrieves a stock price from multiple APIs, computes the median inside hardware-isolated memory, and produces a cryptographic attestation that the reported value matches the computation. Smart contracts verify this attestation before executing, eliminating trust in the oracle operator while maintaining the deterministic execution required by blockchain consensus.