Trusted Execution Environment (TEE)

The TEE creates a strictly bounded enclave in the CPU that is isolated at the hardware level. Code and data within the enclave are inaccessible to the host OS, hypervisor, BIOS, and System Management Mode (SMM). Even a compromised kernel cannot read enclave memory. This is enforced by the processor's memory controller, which blocks non-enclave access attempts at the bus level.

• Intel SGX: Uses Enclave Page Cache (EPC) with hardware encryption
• AMD SEV: Encrypts entire VM memory with per-VM keys
• ARM TrustZone: Splits the system into Secure and Normal worlds

All data within the TEE is transparently encrypted by a dedicated hardware engine before being written to DRAM. The encryption keys are generated at boot time and never exposed to software. This protects against cold-boot attacks, DRAM probing, and physical bus sniffing. The memory encryption operates at line speed with negligible latency overhead.

• Total Memory Encryption (TME): Encrypts all memory with a single ephemeral key
• Multi-Key TME (MKTME): Supports multiple encryption keys for different VMs or enclaves
• Integrity protection: Detects replay and splicing attacks via MAC verification

Remote attestation allows a remote client to cryptographically verify the exact software stack running inside a TEE before provisioning secrets. The enclave produces a signed measurement (a hash of its initial code and data) that is signed by a hardware-derived attestation key. A third-party attestation service validates this quote against known good measurements.

• DCAP (Data Center Attestation Primitives): Intel's flexible attestation framework
• EPID (Enhanced Privacy ID): Group signature scheme for anonymous attestation
• Verifiable claims: Includes enclave identity, code version, and security flags

The TEE provides a mechanism to encrypt data for persistent storage such that it can only be decrypted by the same enclave on the same platform. Sealing binds data to the enclave's identity (MRENCLAVE) or the signing authority (MRSIGNER). This ensures that even if an attacker steals the storage medium, the sealed data remains cryptographically inaccessible.

• Seal to MRENCLAVE: Ties data to the exact enclave binary version
• Seal to MRSIGNER: Allows data migration across version updates from the same author
• Monotonic counters: Prevents rollback attacks on sealed data

Modern TEEs incorporate hardware and microcode mitigations against side-channel attacks that attempt to leak secrets through timing, power consumption, or cache access patterns. While no TEE is perfectly resistant, continuous microcode updates and architectural defenses raise the bar significantly.

• Cache partitioning: Isolates enclave cache lines from untrusted code
• Speculation barriers: LFENCE and VERW instructions mitigate Spectre-class attacks
• Constant-time crypto: Hardware-accelerated AES and SHA run in fixed cycles
• Page fault hardening: Prevents controlled-channel attacks via address translation monitoring

The TEE model drastically reduces the Trusted Computing Base (TCB). In a traditional stack, trust extends to the OS, hypervisor, and cloud provider. With a TEE, only the enclave code and the processor package must be trusted. The OS and VMM are treated as hostile entities. This reduction in TCB minimizes the attack surface for sensitive workloads.

• TCB components: CPU silicon, enclave application, attestation service
• Excluded from TCB: Host OS, hypervisor, firmware, cloud administrator
• Formal verification: Some TEE designs undergo mathematical proof of isolation guarantees

The cryptographic protocol that makes TEEs trustworthy in untrusted environments. A relying party challenges the TEE to produce a signed measurement of its internal state—including firmware hash, enclave code identity, and security version numbers. The TEE's hardware root of trust signs this attestation report with a key fused into the silicon during manufacturing. The verifier validates the signature chain back to the manufacturer's CA. This proves: (1) the code running is exactly what was expected, and (2) it runs on genuine TEE hardware, not an emulator.

TEEs protect against logical attacks but remain vulnerable to physical side channels. Attack vectors include: cache timing attacks (Prime+Probe on shared LLC), power analysis (monitoring voltage regulators), electromagnetic emanations, and branch prediction state. Mitigations include: constant-time programming within enclaves, cache partitioning (Intel CAT), transactional memory for abort-on-interrupt, and speculative execution barriers (LFENCE). Modern TEE designs incorporate microarchitectural defenses, but the attack surface remains a critical research area.