Intel TDX

Intel TDX creates a hardware-enforced cryptographic isolation boundary around each Trust Domain (TD) virtual machine. The CPU manages an encrypted memory region inaccessible to the hypervisor, host OS, or other VMs. This isolation is rooted in a Hardware Root of Trust baked into the silicon, ensuring that even a compromised cloud administrator cannot inspect memory contents. Unlike process-level enclaves, TDX protects the entire guest OS and application stack, enabling lift-and-shift migration of unmodified workloads into a secure execution environment.

TDX leverages Intel's Multi-Key Total Memory Encryption engine to encrypt each Trust Domain's memory with a unique, hardware-generated key. The memory controller transparently encrypts and decrypts data as it moves between the CPU and RAM, ensuring data-in-use remains protected. Key architectural properties include:

• Per-TD key isolation: Each VM gets its own encryption key
• Hardware-managed keys: Keys never exposed to software, including the hypervisor
• Integrity protection: Cryptographic mechanisms detect replay and tampering attacks
• Zero performance tuning: Encryption operates at memory bus speed with minimal latency overhead

TDX introduces a Secure Arbitration Mode (SEAM) — a new CPU mode that sits between the hypervisor and the Trust Domain to mediate all transitions. Key security properties:

• Interrupt injection filtering: The SEAM module validates and sanitizes interrupts before delivery to the TD
• Exception confidentiality: Register states are scrubbed during VM exits to prevent information leakage
• Restricted injection: The hypervisor cannot inject arbitrary interrupts; only SEAM-authorized vectors are permitted
• Side-channel hardening: Architectural mitigations against cache-timing and page-fault side-channel attacks

This design eliminates a class of attacks where malicious hypervisors exploit interrupt handling to extract secrets.

TDX supports TDX Connect Shared Memory for high-performance communication between Trust Domains and accelerators without compromising security. The architecture provides:

• Direct memory access: Accelerators can read/write encrypted TD memory through authenticated channels
• IOMMU enforcement: The I/O Memory Management Unit enforces access controls, preventing DMA attacks
• Scalable I/O virtualization: Support for SR-IOV and Scalable IOV to maintain near-native networking and storage performance
• Zero-copy data paths: Eliminates costly memory copies between the TD and devices

This enables confidential computing for I/O-intensive workloads like databases and real-time analytics without sacrificing throughput.

The overarching hardware-based security paradigm that protects data in use by performing computation within a hardware-enforced Trusted Execution Environment. Intel TDX is a specific implementation of this paradigm at the virtual machine level, shielding entire workloads from the cloud provider, hypervisor, and other tenants. This contrasts with protecting only data at rest (encrypted storage) or data in transit (TLS).

The cryptographic process by which an Intel TDX-enabled platform proves its identity, integrity, and security posture to a remote relying party. Before a client provisions secrets or trusts a TDX-protected VM, the platform generates a verifiable attestation report. This report includes:

• TDX Module measurements: Verifying the trusted firmware version.
• Guest VM measurements: Confirming the exact OS and software stack loaded.
• Platform TCB status: Ensuring all microcode and firmware are up-to-date and not revoked.

The set of all hardware, firmware, and software components critical to a system's security. A vulnerability in any TCB component compromises the entire system. Intel TDX dramatically reduces the TCB by removing the hypervisor and host OS from the trust boundary. The TDX TCB includes:

• The Intel CPU package and microcode.
• The Intel TDX Module (a small, verified firmware layer).
• The guest VM's own operating system and applications. This minimal TCB drastically reduces the attack surface compared to traditional virtualization.

A related Intel TEE technology that operates at the application level rather than the VM level. SGX creates small, isolated memory regions called enclaves for specific code segments, requiring developers to modify applications using a software development kit. In contrast, Intel TDX protects an entire virtual machine, enabling lift-and-shift migration of legacy workloads without code changes. SGX offers finer-grained protection, while TDX prioritizes operational simplicity and broader workload compatibility.

AMD's competing VM-level TEE technology that provides similar protections to Intel TDX. Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) encrypts VM memory and adds strong integrity protection to prevent malicious hypervisor attacks like data replay and memory remapping. Both technologies aim to protect entire VMs from the host, but they differ in their hardware roots of trust, attestation protocols, and specific side-channel mitigations. Multi-cloud strategies often require supporting both.

The application of Confidential Computing hardware—including Intel TDX—to protect the confidentiality and integrity of machine learning models, training data, and inference inputs during active computation. In a TDX-protected VM:

• Model weights remain encrypted in memory, preventing intellectual property theft by the cloud operator.
• Inference requests containing sensitive user data are processed in complete isolation.
• Training pipelines can combine sensitive datasets from multiple parties without exposing raw data to any single entity.