ARM CCA

The foundational hardware extension that introduces a new security state and physical address space. RME enables the creation of Realms—isolated execution environments that sit beside the Normal and Secure worlds. It uses Granule Protection Tables (GPT) to enforce access control at the physical memory level, ensuring the hypervisor cannot access Realm memory even with the highest privilege level.

ARM CCA implements a hardware-rooted attestation model where the Realm Initial Measurement (RIM) is cryptographically verified before any secrets are released. The CCA Token provides a signed, verifiable claim about the Realm's initial state, firmware integrity, and platform identity. This allows remote parties to establish trust before provisioning sensitive data or model weights into the Realm.

A hardware-enforced access control structure that governs memory at a granule granularity (typically 4KB). The GPT assigns each physical page to one of four security states: Non-Secure, Secure, Realm, or Root. This prevents the hypervisor from mapping Realm memory into its own page tables, closing a critical attack vector where a compromised hypervisor could read confidential workload data.

Unlike traditional virtualization where the hypervisor controls all resources, ARM CCA introduces a Realm Manager that runs in the Normal world but operates under strict architectural constraints. The hypervisor must explicitly delegate memory and CPU resources to the Realm Manager, which then assigns them to Realms. This separation of duties ensures the host cannot unilaterally inspect or modify Realm state.

ARM CCA enables model confidentiality by loading proprietary neural network weights directly into Realm memory, invisible to the cloud operator. Client input data is encrypted in transit and decrypted only inside the attested Realm. The inference results are encrypted before leaving the TEE, ensuring end-to-end protection of both the model intellectual property and the user's sensitive queries.

A narrow, well-defined API boundary between the Realm and the host. The RSI provides essential services like attestation reporting and measurement extension without exposing the Realm's internal state. This minimal interface reduces the attack surface compared to traditional paravirtualized drivers, aligning with the principle of a small Trusted Computing Base (TCB).

The hardware-enforced memory access control mechanism in ARM CCA. Physical memory is divided into fixed-size units called granules, and each granule is tagged with a state: RMM-managed, Host-managed, or Realm-managed. The memory management unit (MMU) performs a Granule Protection Check on every memory access, ensuring:

• The host cannot read or write Realm-private memory
• A Realm cannot access another Realm's granules
• State transitions require explicit RMM authorization This provides deterministic isolation enforced at the silicon level.

ARM CCA enables end-to-end confidential AI workloads by protecting both model weights and input data during inference. A Realm can load a proprietary model, receive encrypted user queries, and return results—all while the cloud provider's hypervisor remains blind to the computation. Key benefits:

• Model IP protection: Weights never appear in plaintext to the host
• User privacy: Queries and responses are isolated from the infrastructure
• Attestable lineage: Clients verify the exact model hash before sending data This is foundational for sovereign AI deployments on ARM-based cloud instances.