Intel SGX

SGX protects data in use by automatically encrypting enclave memory regions within the processor package. The Memory Encryption Engine (MEE) encrypts and integrity-protects cache lines evicted to DRAM, preventing physical bus snooping and cold-boot attacks. The encryption keys reside within the CPU die and are never exposed to system software.

• Total Memory Encryption: All enclave data is transparently encrypted outside the CPU boundary.
• Integrity Protection: Cryptographic hashes detect tampering or replay attacks on memory contents.
• No Software Key Access: The OS, hypervisor, and DMA devices cannot read the enclave's plaintext memory.

Remote attestation allows a client to cryptographically verify the exact identity and integrity of the software running inside a remote SGX enclave before provisioning secrets. The enclave generates a Quote—a signed measurement of its initial state and platform TCB—that is verified by Intel's attestation service or a third-party attestation provider.

• Cryptographic Identity: The enclave's measurement (MRENCLAVE) acts as a unique fingerprint.
• Trusted Compute Base (TCB) Verification: The attestation verifies the CPU firmware and microcode versions.
• Secret Provisioning: Enables secure delivery of encryption keys or model weights only to verified enclaves.

SGX provides a sealing mechanism that allows an enclave to encrypt data for persistent storage outside the enclave boundary. The sealing key is derived from the enclave's identity and the CPU's hardware root of trust, ensuring only the exact same enclave on the exact same platform can unseal the data.

• Enclave Identity Binding: Sealing to MRENCLAVE restricts access to the specific enclave version.
• Signer Identity Binding: Sealing to MRSIGNER allows data sharing across enclave versions from the same author.
• Secure State Preservation: Protects model parameters and database indexes across enclave restarts.

SGX enforces a reverse sandbox model where the enclave trusts nothing outside its boundary. Even the operating system kernel, hypervisor, and System Management Mode (SMM) code are treated as hostile. The CPU hardware blocks all access to enclave memory from software executing at any privilege level.

• Ring -3 Execution: Enclave code runs at a lower logical privilege than the OS kernel.
• Controlled Entry Points: Enclave calls (ECALLs) and outside calls (OCALLs) are strictly defined at compile time.
• Asynchronous Enclave Exit (AEX): Hardware saves enclave state to encrypted memory on interrupts to prevent register leakage.

Intel SGX incorporates hardware and microcode defenses against cache-timing and speculative execution attacks. The Trusted Compute Base (TCB) Recovery process delivers microcode updates that patch vulnerabilities like L1 Terminal Fault (L1TF) and Microarchitectural Data Sampling (MDS) without requiring application recompilation.

• Cache Allocation Technology (CAT): Partitions last-level cache to prevent cross-enclave cache eviction attacks.
• Speculative Execution Controls: Microcode mitigations prevent Spectre-class attacks from leaking enclave secrets.
• Constant-Time Cryptography: Enclave cryptographic libraries avoid data-dependent memory access patterns.

Flexible Launch Control (FLC) allows data center operators to define their own enclave launch authorization policies instead of relying on Intel's launch enclave. This enables private build infrastructures where the platform owner controls which enclaves are permitted to execute, critical for sovereign cloud deployments.

• Custom Launch Policies: Define which signing identities are authorized to launch enclaves.
• Platform Owner Control: The infrastructure provider, not Intel, governs enclave execution permissions.
• Supply Chain Integrity: Prevents unauthorized or tampered enclaves from running in production environments.

A hardware-enforced secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. TEEs isolate sensitive computation from the host operating system, hypervisor, and even privileged users.

• Intel SGX is the most widely deployed TEE implementation for x86 architectures
• AMD SEV and ARM TrustZone provide alternative TEE implementations
• TEEs protect data in use, complementing encryption at rest and in transit

A dedicated, encrypted region of DRAM that stores enclave code and data. The EPC is physically protected by the Memory Encryption Engine (MEE) , which encrypts all data moving between the processor cache and main memory.

• Current SGX implementations limit EPC to 128-512 MB per socket
• Pages evicted from EPC are encrypted and integrity-protected before writing to unprotected memory
• EPC paging overhead is a key performance consideration for memory-intensive AI workloads
• SGXv2 introduces dynamic EPC allocation to reduce paging latency

Defensive techniques that prevent leakage of enclave secrets through physical measurements such as timing, power consumption, cache access patterns, or electromagnetic emissions.

• SGX enclaves are vulnerable to cache-timing attacks (e.g., Spectre, Meltdown variants)
• Constant-time programming eliminates data-dependent branching in cryptographic code
• Intel's microcode updates and hardware mitigations address speculative execution leaks
• Application-level defenses include data-oblivious algorithms that make memory access patterns independent of secret values

A cryptographic method that allows computation directly on ciphertext, producing encrypted results that match operations on plaintext. HE and SGX represent complementary approaches to data-in-use protection.

• Fully Homomorphic Encryption (FHE) supports arbitrary computation but is orders of magnitude slower than SGX
• SGX provides near-native performance but requires trust in Intel's hardware root of trust
• Hybrid architectures use SGX for performance-critical operations and HE for zero-hardware-trust scenarios
• HE eliminates the side-channel attack surface inherent to shared hardware enclaves