Confidential Computing

A secure enclave within the CPU that isolates sensitive data and code from the host operating system. Unlike software-based encryption that protects data at rest or in transit, a TEE creates a hardware-enforced boundary that prevents privileged users, malicious insiders, or compromised OS kernels from accessing data during active computation.

• Intel SGX: Creates private memory regions called enclaves
• AMD SEV-SNP: Encrypts entire virtual machines with secure nested paging
• ARM Confidential Compute Architecture (CCA): Introduces hardware-isolated realms
• NVIDIA Confidential Computing: Extends TEE protection to GPU-accelerated workloads

The TEE encrypts all data within the enclave's memory pages using transparent memory encryption engines integrated into the memory controller. This prevents cold-boot attacks, DMA attacks, and memory bus snooping.

• Total Memory Encryption (TME): AMD's full physical memory encryption
• Multi-Key Total Memory Encryption (MKTME): Intel's per-VM memory encryption
• Integrity Protection: Hardware detects unauthorized modifications to encrypted pages
• Encrypted Page Swap: Enclave memory pages remain encrypted when swapped to disk

The defining capability of Confidential Computing: protecting data while it is being processed. Traditional encryption protects data at rest (storage encryption) and in transit (TLS), but data in use has historically been vulnerable to memory scraping, privileged user access, and hypervisor exploits.

• Hypervisor Isolation: Even the cloud provider's hypervisor cannot inspect enclave memory
• Administrator Immunity: Root users and system administrators have no access to TEE contents
• Side-Channel Resistance: Modern TEEs include mitigations against cache-timing and speculative execution attacks
• Zero-Trust Compute: Enables computation on untrusted infrastructure without trusting the operator

Extending TEE protection beyond individual applications to entire virtual machines and container runtimes. This allows organizations to lift-and-shift existing workloads into confidential environments without application modification.

• Confidential VMs: AMD SEV-SNP and Intel TDX encrypt entire VM state
• Confidential Containers (CoCo): CNCF project running Kubernetes pods within TEEs
• Kata Containers: Lightweight VMs that can leverage hardware TEEs for container isolation
• Live Migration Support: Encrypted VM state transfer between physical hosts

Confidential Computing serves as a hardware root of trust for multi-party data collaboration. Organizations can jointly analyze sensitive datasets without revealing raw data to any participant, including the cloud provider hosting the computation.

• Confidential AI Training: Multiple hospitals training diagnostic models on combined patient data
• Financial Crime Detection: Banks sharing transaction patterns without exposing customer records
• Supply Chain Analytics: Manufacturers pooling proprietary production data for optimization
• Data Clean Room: Marketing analytics across competitors without data leakage

A cryptographic process that allows a relying party to verify the identity and integrity of a TEE before sending sensitive data. The TEE generates a signed attestation report containing a hash of its memory state and firmware version. The process:

• The CPU produces a hardware-rooted quote
• An attestation service validates the quote against known-good measurements
• A verifiable trust chain is established

This prevents data from being sent to a compromised or spoofed enclave.

A hardware component integrated into the memory controller that transparently encrypts and decrypts data moving between the CPU and RAM. Critical capabilities:

• Total Memory Encryption (TME): Encrypts all memory with a single ephemeral key
• Multi-Key TME (MKTME): Allows distinct encryption keys per virtual machine or enclave
• Prevents cold-boot attacks and DIMM interposers

This ensures data remains encrypted even if an attacker physically accesses the memory bus.

A hardware-isolated memory region within a TEE that hosts a specific application or workload. The enclave's memory pages are encrypted and cannot be read by:

• The host operating system
• Other virtual machines
• The hypervisor
• System administrators

Lifecycle: Enclaves are created, measured, verified via attestation, and destroyed. Data is sealed to the enclave's identity for secure persistent storage.

The third pillar of the data encryption triad, protecting data while it is actively being processed in CPU registers and cache. The three states:

• Data-at-Rest: Protected by disk encryption (AES-256)
• Data-in-Transit: Protected by TLS/mTLS
• Data-in-Use: Protected by TEEs and memory encryption

Confidential Computing is the primary mechanism for closing the data-in-use gap, preventing exposure during computation.

Secure Encrypted Virtualization-Secure Nested Paging is AMD's hardware TEE implementation. It adds memory integrity protection to prevent malicious hypervisor attacks. Key features:

• Reverse map table to block page remapping attacks
• VM-level attestation reports
• Interrupt injection restrictions

SEV-SNP is widely used in confidential VMs on Azure and Google Cloud, enabling lift-and-shift of entire workloads without code modification.