trusted execution environment
In plain wordsA sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with.
A hardware-enforced compartment of a processor whose code and memory the rest of the platform, including the operating system and hypervisor, can neither read nor modify, typically through memory encryption and access control, and which can vouch for its own identity and state through remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it.. Designs range from process-level enclaves (Intel SGX) and a secure world on mobile chips (Arm TrustZone) to whole confidential virtual machines (AMD SEV-SNP, Intel TDX, Arm CCA) and GPU modes that extend protection to accelerators. TEEs underpin confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine. and are proposed for protecting model weights and for verifiable compute governance. Their security depends on the hardware vendor and has repeatedly been weakened by side-channel and fault attacks.
The decryption key for the model weights is released only to a TEE whose attestation report matches the approved build.
Origin
Grew out of trusted-computing and smart-card research; Arm TrustZone (2004) was an early commercial design. The term was standardized for mobile devices by the Open Mobile Terminal Platform (2009) and GlobalPlatform (from 2010), and Intel SGX (2015) brought enclaves to general-purpose processors.
Related
- confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine.
- remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it.
- model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model.
- secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others.
- GPUGPU, abbr.: A computer chip first designed to draw video-game graphics that turned out to be ideal for AI, because it can do thousands of simple calculations at the same time.
Sources
- Sabt, M., Achemlal, M. & Bouabdallah, A. (2015). Trusted Execution Environment: What It Is, and What It Is Not. IEEE Trustcom 2015.
Mentioned in
confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine., on-chip governance mechanismson-chip governance mechanisms, n.: Features built into AI chips that could check or enforce rules about how they are used — for example, proving which country a chip is in, or refusing to run without a valid license., remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it., secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others.