Confidential Computing

The core mechanism of Confidential Computing. Sensitive data and code are processed within a hardware-isolated execution environment, known as a Trusted Execution Environment (TEE) or Secure Enclave. This environment is protected by the CPU itself, creating a cryptographic boundary that prevents access from the host operating system, hypervisor, or any other software, including privileged system administrators. Examples include Intel SGX enclaves, AMD SEV-SNP encrypted VMs, and the ARM TrustZone secure world.

Confidential Computing addresses the 'data in use' phase of the data lifecycle. While data is typically encrypted at rest (storage) and in transit (network), it must be decrypted for processing in memory, creating a vulnerability. Confidential Computing ensures data remains encrypted while being processed in the CPU. Memory encryption keys are generated and managed by the hardware, keeping plaintext data visible only to the authorized code inside the TEE. This principle closes the last major gap in end-to-end data encryption.

A critical cryptographic protocol that enables trust in a remote TEE. Before sending sensitive data or code, a client (the relying party) can cryptographically verify:

• The genuineness of the hardware (e.g., a real Intel SGX-capable CPU).
• The integrity of the TEE's firmware and security properties.
• The identity and integrity of the exact software (measurement) running inside the enclave. This process creates a verifiable chain of trust from the hardware root of trust to the application, ensuring the environment is secure and untampered.

A key security goal is to reduce the Trusted Computing Base—the set of hardware, firmware, and software components that must be trusted for the system to be secure. In Confidential Computing, the TCB is dramatically minimized to primarily include the CPU's security circuitry and the small, auditable application code running inside the enclave. The massive, complex layers like the host OS, hypervisor, and system drivers are explicitly excluded from the TCB, drastically reducing the potential attack surface.

Beyond confidentiality, TEEs protect the integrity of the execution. This means ensuring that the code running inside the enclave has not been altered and executes as intended. Hardware mechanisms prevent:

• Unauthorized modification of enclave memory.
• Control-flow hijacking attacks by enforcing integrity on pointers and execution paths.
• Replay attacks by securing the enclave's state. This guarantees that the computation's results are authentic and derived from the correct, unmodified code and data.

TEEs provide secure, hardware-backed services for cryptographic key generation, storage, and use. Keys can be generated inside the enclave and never exposed. Sealing is a vital feature where the TEE can encrypt (seal) persistent data to the specific enclave's identity and platform state. The data can only be decrypted (unsealed) by the same enclave on the same trusted platform, enabling secure local storage. This allows for stateful applications that can persist sensitive data across restarts without exposing it.