Runtime Encryption

The CPU's integrated memory controller automatically encrypts and decrypts data as it moves between the processor cache and main memory (RAM). This process is transparent to applications, requiring no code modifications. Technologies like AMD SME and Intel TME use AES-XTS hardware engines operating at memory bandwidth speed, ensuring that a physical attacker with a DRAM interposer or a cold-boot attack sees only ciphertext. The encryption key is generated by a hardware random number generator at each boot cycle and never leaves the processor package.

Advanced implementations extend transparent encryption with cryptographic isolation between virtual machines or individual processes:

• AMD SEV: Assigns a unique encryption key to each virtual machine, preventing the hypervisor or a neighboring VM from accessing encrypted memory pages.
• Intel MKTME: Allows software to assign distinct keys to different memory pages, enabling per-process or per-container encryption domains.
• ARM Realm Extension: Creates hardware-backed address spaces where data is encrypted with a unique key inaccessible to the hypervisor. This ensures that even a compromised operating system cannot read the memory of a protected workload.

Encryption alone does not prevent an attacker with physical access from replaying stale ciphertext or corrupting memory to induce faults. Runtime encryption is therefore paired with cryptographic integrity verification:

• AMD SEV-SNP: Adds a reverse map table that cryptographically verifies that data read from a guest page is the exact data last written by that guest, preventing replay and data corruption attacks.
• Intel TDX: Implements a secure extended page table with integrity metadata, ensuring that any unauthorized modification to encrypted memory triggers a machine check exception.
• MAC-based verification: Hardware computes a Message Authentication Code on each cache line write and verifies it on read, detecting bit-flip attacks.

The encryption keys used for runtime protection are never exposed to software. They are derived from a physically unclonable function (PUF) or a fused hardware secret burned into the silicon during manufacturing. The key hierarchy flows as follows:

• A Hardware Root of Trust generates a device-unique seed.
• At boot, the CPU firmware derives ephemeral memory encryption keys from this seed combined with a random nonce.
• Keys are stored in on-die registers accessible only to the memory encryption engine.
• A system reset or power cycle destroys the keys, rendering any captured DRAM contents permanently indecipherable.

Runtime encryption protects data across the entire memory bus—the physical pathway between the CPU socket and DRAM modules. This is critical because:

• Inter-socket links on multi-socket servers (e.g., AMD Infinity Fabric, Intel UPI) carry cache-coherent traffic that can be passively sniffed.
• CXL-attached memory and accelerators extend the memory bus beyond the motherboard, creating new attack surfaces.
• DDR5 interposers and logic analyzers can capture raw memory traffic in real-time. Hardware encryption engines sit between the last-level cache and the memory controller, ensuring that all data leaving the processor socket is ciphertext, regardless of the destination.

Runtime encryption is the foundational layer that enables Confidential Computing. It works in concert with attestation to build a complete trust chain:

• During remote attestation, the TEE provides a cryptographic report that includes a hash of the memory encryption key state, proving that runtime encryption is active.
• A verifier can confirm that the workload is running with SEV-SNP or TDX protections enabled before provisioning secrets.
• The attestation report binds the workload's identity to the encryption key, ensuring that decrypted data is only accessible within the attested environment. This closes the loop: encryption protects the data, and attestation proves the encryption is in place.

A secure area of a main processor that guarantees code and data loaded inside is protected with respect to confidentiality and integrity. The TEE isolates sensitive computation from the host operating system, hypervisor, and other applications. This is the hardware foundation upon which runtime encryption operates—without a TEE, memory encryption keys could be extracted by a compromised OS.

• Key property: Hardware-enforced isolation
• Examples: Intel SGX enclaves, AMD SEV VMs, ARM TrustZone
• Threat model: Protects against privileged software attacks

A hardware-based security paradigm that protects data in use by performing computation within a hardware-enforced TEE. Runtime encryption is the mechanism that enables Confidential Computing—it transparently encrypts the entire memory space of a VM or process so that even the cloud provider cannot inspect the workload.

• Three states of data protection: At rest (disk encryption), in transit (TLS), in use (Confidential Computing)
• Zero-trust cloud model: The cloud operator is removed from the trust boundary
• Industry standard: Defined by the Confidential Computing Consortium

Intel Trust Domain Extensions provides VM-level runtime encryption, extending Confidential Computing to entire virtual machines without requiring application code modifications. Unlike process-based enclaves (SGX), TDX encrypts the full VM memory space, enabling lift-and-shift migration of legacy workloads.

• Granularity: Full virtual machine
• Key advantage: No code changes required for existing applications
• Integrity protection: Prevents hypervisor-based data replay and memory remapping attacks
• Comparison to SGX: Larger TCB but easier adoption path

AMD Secure Encrypted Virtualization-Secure Nested Paging adds strong memory integrity protection to runtime encryption. Beyond basic memory encryption, SEV-SNP prevents malicious hypervisors from remapping guest memory pages or replaying stale encrypted data—attacks that would otherwise bypass confidentiality protections.

• Reverse map table: Prevents hypervisor from aliasing guest pages
• Page validation: Guest can verify memory mappings before use
• Attestation: Integrated with AMD's PSP for hardware-rooted identity verification