Confidential Persistent Storage

Libraries like Gramine's Protected Files and the Open Enclave SDK provide transparent file system abstractions that automatically seal and unseal data on read/write operations.

• Applications use standard POSIX file APIs; the library handles encryption, integrity, and rollback protection transparently.
• Files are encrypted with random data encryption keys (DEKs), which are themselves sealed to the enclave.
• Enables existing applications to use confidential storage with minimal code changes.

The core mechanism enabling confidential persistent storage. Sealing encrypts data using a key derived from the enclave's identity (MRENCLAVE) and the platform's hardware root of trust. The sealed blob can only be decrypted by the exact same application running on the exact same platform, preventing the host OS or a malicious administrator from reading stored data.

• Seal Key Derivation: Fuses the enclave measurement with a CPU-specific fuse key
• Seal Policy: Can bind to the enclave identity, the sealing authority, or a combination
• Anti-Rollback: Integrates with monotonic counters to prevent replay of stale sealed data

The cryptographic process by which a Trusted Execution Environment proves its identity and integrity to a remote party before receiving secrets or persisting data. A successful attestation report contains the enclave measurement, platform TCB status, and a signature from the hardware root of trust.

• Local Attestation: Verification between enclaves on the same platform
• Remote Attestation: Verification by an external service, often via Intel DCAP or AMD SEV-SNP attestation
• Attestation Token: A signed JWT containing claims about the enclave's code and environment

The immutable foundation of security for confidential storage. This is a set of cryptographic keys burned into the silicon during manufacturing that anchors all subsequent trust chains. The CPU uses this root to derive platform-specific keys for memory encryption and sealing.

• Fuse Key: A symmetric key physically embedded in the CPU package
• Key Derivation: Platform-bound keys are never exposed to firmware or software
• Supply Chain Assurance: Verifies the silicon itself hasn't been tampered with before deployment

A virtual machine whose entire memory is encrypted by hardware, isolating it from the hypervisor and cloud provider. Technologies like Intel TDX and AMD SEV-SNP extend the TEE boundary to encompass a full guest OS, allowing unmodified applications to benefit from data-in-use encryption.

• Memory Encryption Engine: Transparently encrypts/decrypts cache lines to DRAM
• Integrity Protection: Detects replay and relocation attacks on encrypted memory pages
• Live Migration: Secure transfer of an encrypted VM between physical hosts without exposing plaintext

A key management system that integrates directly with the attestation flow. It releases decryption keys only after cryptographically verifying the enclave's identity and health. This decouples the sealing key from the physical hardware, enabling secure key rotation and disaster recovery for confidential persistent storage.

• Conditional Key Release: Keys are gated on a successful attestation report
• Key Hierarchy: Master keys unwrap data encryption keys only inside the verified enclave
• Integration: Works with SPIRE, HashiCorp Vault, and cloud-native KMS offerings

A Retrieval-Augmented Generation architecture where both the vector search and the LLM inference execute entirely within a TEE. The confidential persistent storage holds the encrypted vector index and knowledge base. The enclave decrypts the relevant context in protected memory, guaranteeing that the user query and the proprietary retrieved data are never visible to the infrastructure provider.

• Encrypted Vector Store: Embeddings are sealed at rest and decrypted only inside the enclave
• End-to-End Protection: Query, retrieval, and generation all occur within the TEE boundary
• Model Provenance: Attestation verifies the exact model and RAG pipeline are running