Tee

Trusted Execution Environments (TEE)

What is a TEE?
A secure area of a processor that runs code and stores data protected from the main operating system, providing hardware-based security guarantees.

How TEEs Work

[Normal World]          [Secure Enclave]
    |                        |
Application --(encrypted)--> Protected Code
    |                        |
    OS                 [Isolated Memory]
    |                        |
Hypervisor            [Hardware Protection]

TEE Technologies
| Technology | Provider | CPU |
|------------|----------|-----|
| SGX | Intel | Intel CPUs |
| TrustZone | ARM | ARM chips |
| SEV | AMD | AMD EPYC |
| CCA | ARM | ARMv9 |
| Keystone | RISC-V | RISC-V |

Intel SGX Concepts
| Concept | Description |
|---------|-------------|
| Enclave | Protected memory region |
| Attestation | Prove code is running in enclave |
| Sealing | Encrypt data to enclave identity |
| Ocall/Ecall | Communication into/out of enclave |

Confidential Computing Use Cases

# Conceptual: Run ML inference in enclave
def secure_inference():
    # Inside enclave
    model = load_encrypted_model()
    model.decrypt_with_enclave_key()

    # Process encrypted input
    encrypted_input = receive_from_client()
    decrypted_input = decrypt_in_enclave(encrypted_input)

    # Run inference
    result = model.predict(decrypted_input)

    # Re-encrypt result
    return encrypt_for_client(result)

Benefits
| Benefit | Description |
|---------|-------------|
| Data confidentiality | Data protected in use |
| Code integrity | Tampering detected |
| Attestation | Verify what code is running |
| No trust in cloud | Cloud cant see data |

Limitations
| Limitation | Description |
|------------|-------------|
| Performance | Some overhead |
| Memory limits | Enclave memory constrained |
| Side channels | Vulnerable to some attacks |
| Complexity | Harder to develop |

Cloud Confidential Computing
| Cloud | Offering |
|-------|----------|
| Azure | Confidential VMs |
| GCP | Confidential Computing |
| AWS | Nitro Enclaves |
| IBM | Confidential Computing |

ML in TEEs
- Run inference on private data
- Protect model weights from cloud
- Multi-party computation
- Confidential training

Best Practices
- Use attestation to verify enclave
- Minimize enclave surface area
- Handle side-channel risks
- Test thoroughly before deployment