TEE Architectures and Platform Isolation
This domain tests architecture-level isolation: how each platform separates secure and non-secure execution, where the trust boundary sits, and which attacks the hardware does and does not stop.
Platform mechanisms
- ARM TrustZone splits the CPU into Normal and Secure worlds; the EL3 monitor switches worlds, the NS bit tags transactions, and the TrustZone Address Space Controller and SMMU partition memory and DMA, while the GIC routes interrupts per world.
- Intel SGX enclaves are process-level containers in encrypted EPC pages; the Memory Encryption Engine protects off-chip traffic; the CPU rejects access from ring 0 and other enclaves. SGX protects confidentiality and integrity of enclave memory but leaves access patterns and side channels visible.
- Intel TDX defines a confidential VM boundary; the TDX module, a CPU-attested software module, manages secure EPTs and private memory, so the hypervisor is outside the TCB. Guest trust in the TDX module is a distinct assumption from SGX.
- AMD SEV encrypts VM memory with a per-VM key; SEV-ES also encrypts register state at VM exits; SEV-SNP adds integrity protection through the reverse map table and attestation. Without SNP, a malicious hypervisor can replay or remap ciphertext.
- RISC-V PMP and PMP-based designs such as Keystone provide enclave isolation, but there is no single ratified TEE standard; check the specific SoC.
Isolation primitives to compare
- Memory encryption for confidentiality, integrity trees or the RMP for integrity, IOMMU/SMMU for DMA, interrupt routing, cache partitioning, and an attestation root.
Worked example
Choose for a multi-tenant cloud VM running an unmodified Linux guest that must keep data secret from the cloud operator. SGX requires rewriting the workload into enclaves, so it does not meet the unmodified-guest requirement. SEV-ES hides register state but lacks memory integrity, so a hostile hypervisor could tamper. SEV-SNP or TDX fits: both give a confidential VM with integrity and CPU-rooted attestation. Remaining risk: virtio devices and the host's ability to deny service; those must be addressed by device trust such as TDISP or SEV-TIO, or explicitly accepted.
Traps
- Treating SEV, SEV-ES, and SEV-SNP as equivalent.
- Assuming TrustZone secure world cannot read normal-world memory unless configured.
- Believing SGX removes the OS from the TCB for I/O.
- Ignoring that the TEE OS is privileged and therefore a high-value target.