Technology Overview

Last Update: July 2023

Hardware-based secure enclave establishes isolated environments for specific applications, effectively segregating them from the rest of the software stack.

Enclave provides sophisticated hardware-based security features and encryption capabilities. By running application-specific code and data within an enclave, we can have an additional layer of security, privacy, and trust in the execution environment. As a result, deploying applications within containers becomes an excellent choice, particularly in potentially untrusted cloud environments.

Hardware secure enclave technologies include Intel SGX, Intel TDX, AMD SEV, ARM CCA, and RISC-V AP-TEE. GPU-based technologies include NVIDIA CC.

Intel SGX

Intel SGX provides a secure execution environment called an enclave to protect sensitive code and data. It allows applications to isolate portions of their code and data in enclaves, ensuring confidentiality and integrity. SGX enables secure computations even on compromised systems, preventing access to the enclave's contents.

Intel TDX

Intel TDX safeguards confidential guest virtual machines (VMs) from both host and physical attacks by isolating the register state of the guest and encrypting its memory. TDX employs a specialized module operating in a dedicated mode that acts as an intermediary between the host and guest, ensuring effective separation between them.

AMD SEV

AMD SEV is designed to protect virtual machines (VMs) in cloud environments. SEV encrypts the VM's memory, isolating it from the hypervisor and other VMs. This technology provides a secure execution environment for VMs, protecting them from unauthorized access and tampering.

ARM CCA

ARM CCA is a hardware-based security technology that enables confidential computing on ARM-based processors. CCA provides mechanisms for isolating and protecting sensitive code and data within secure enclaves. It allows applications to execute securely and protects against unauthorized access or tampering.

RISC-V AP-TEE

RISC-V AP-TEE is a trusted execution environment designed for the RISC-V (pronounced "risk-five", ) architecture, an open standard instruction set architecture (ISA) based on established reduced instruction set computer (RISC) principles. AP-TEE provides a secure execution environment for applications, protecting sensitive code and data from unauthorized access. Unlike most other ISA designs, RISC-V AP-TEE is provided under royalty-free open-source licenses.