Intel SGX

The Memory Encryption Engine is the hardware component that transparently encrypts and decrypts all data moving between the CPU and main memory (DRAM). It uses a 128-bit AES-GCM cipher with a unique key generated by the CPU for each power cycle. This provides:

• Confidentiality: Enclave data is unreadable outside the CPU package.
• Integrity: Any tampering with encrypted memory is detected, causing the enclave to abort.
• Anti-replay protection: Prevents replaying old memory states. This protects against physical bus snooping and cold-boot attacks.

Remote Attestation is a cryptographic protocol that allows a remote party (a service provider) to verify the identity and integrity of an enclave running on an untrusted machine. The process involves:

• The enclave generates a measurement (cryptographic hash) of its initial code and data.
• The CPU's Quoting Enclave signs this measurement with a hardware-based attestation key.
• The remote verifier checks this signature against Intel's attestation service to confirm the enclave is genuine and unmodified. This is critical for establishing trust in cloud and edge computing scenarios.

Sealing is the process of encrypting enclave data for persistent storage outside the enclave (e.g., on disk). The encryption key is derived from:

• The enclave's identity (MRENCLAVE measurement), making data accessible only to the exact same enclave code version.
• The platform's identity (MRSIGNER), allowing data to be accessed by different versions of an enclave from the same developer. This allows enclaves to securely save state across power cycles or application restarts without exposing sensitive data to the host filesystem.

The Enclave Page Cache is a reserved, encrypted region of physical memory (DRAM) managed by the processor. All enclave code and data must reside in the EPC when being executed or accessed. Key characteristics:

• Size is limited (e.g., 128MB per package), a primary constraint for SGX applications.
• Managed by the CPU's SGX Memory Management Unit (SGX MMU).
• Pages are swapped to unprotected memory via a process called Enclave Page Cache Mapping (EPCM) and paging, which involves encryption and integrity verification.
• Access is controlled by hardware metadata structures to prevent unauthorized mapping.

SGX is designed for a specific threat model where the attacker controls all software on the platform, including the OS and BIOS, and may have physical access to the memory bus. It is not designed to protect against:

• Side-channel attacks (e.g., cache-timing, Spectre). Mitigations are implemented in software.
• Denial-of-service attacks from the host.
• Attacks on the CPU microarchitecture. Primary use cases include:
• Privacy-Preserving Machine Learning: Training on encrypted data.
• Digital Rights Management (DRM): Protecting media decryption keys.
• Blockchain & Confidential Computing: Executing smart contracts privately.
• Database Encryption: Performing queries on encrypted data.

Federated Learning is a decentralized machine learning paradigm where a global model is collaboratively trained across multiple client devices (e.g., smartphones, IoT sensors) holding local data samples, without exchanging the raw data itself. Instead, only model updates (e.g., gradients) are shared. SGX can be integrated to further protect these updates during aggregation on a central server.

• Primary Goal: Train models on decentralized data while preserving data privacy.
• SGX Integration: The aggregation server's logic can run inside an SGX enclave, ensuring updates are decrypted and processed in a trusted environment, shielding them from the server operator.

Homomorphic Encryption is a form of encryption that allows specific types of computations to be performed directly on ciphertext, generating an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. While SGX protects data in-use within an enclave, Homomorphic Encryption protects data in-computation everywhere else.

• Comparison with SGX: HE enables computation on encrypted data without a trusted environment but is computationally intensive. SGX is more performant but requires trust in the CPU manufacturer and the enclave code's integrity.
• Synergistic Use: HE can be used to encrypt data before sending it to an SGX enclave for processing, adding an extra layer of protection.

Differential Privacy is a rigorous mathematical framework for quantifying and limiting the privacy loss incurred by an individual when their data is included in a statistical analysis or machine learning model. It works by adding carefully calibrated noise to the outputs (e.g., query results, model gradients).

• Relationship to SGX: SGX and DP address different threat models. SGX protects the raw data and computation from the infrastructure provider. DP protects the output from revealing information about any individual in the dataset, even if the output itself is exposed. They are often used together for defense-in-depth.

Secure Multi-Party Computation is a subfield of cryptography that enables a group of distrusting parties to jointly compute a function over their private inputs while revealing nothing but the final output. Like federated learning, no party sees another's raw data.

• Cryptographic vs. Hardware Trust: SMPC provides security based on cryptographic assumptions, without requiring trusted hardware. SGX provides a hardware-rooted trusted environment for computation.
• Performance Trade-off: SMPC protocols involve significant communication overhead. SGX can be used to implement a trusted coordinator in an SMPC protocol, simplifying and accelerating certain computations.

On-Device Training is the process of performing machine learning model training locally on an edge device (e.g., smartphone, sensor) using its onboard compute and local data. This is a core component of federated learning and is essential for personalization and privacy.

• SGX's Role: For sensitive on-device training tasks (e.g., on personal health data), SGX can create an enclave to protect the training algorithm, model weights, and intermediate data from other applications or a compromised OS on the same device.
• Edge Context: Enables privacy-preserving edge training where the model improves using local data without the data ever leaving the device in plaintext.