---
title: Confidential Computing Enclaves
url: https://www.emergentmind.com/topics/confidential-computing-enclaves
type: topic
---

# Confidential Computing Enclaves

Confidential computing enclaves are hardware- and software-backed execution environments offering strong confidentiality and integrity guarantees for code and data—even against a privileged or compromised operating system, hypervisor, or cloud infrastructure. These enclaves form the key primitive underpinning modern Trusted Execution Environments (TEEs), enabling secure in-use data processing, attestation, verifiable integrity, and isolation from co-tenants and adversarial hosts. Recent work generalizes the notion of enclaves from CPU-resident regions (e.g., Intel SGX/TDX, AMD SEV-SNP) to include accelerator-rich architectures, composable cross-device domains, in-memory compute substrates, and unified, recursive isolation APIs for future datacenter fabrics.

## 1. Architectural Principles and Enclave Taxonomy

Enclaves are defined by a hardware-enforced isolation boundary that protects code and data from all non-enclave software and DMA-capable devices. Two architectural approaches dominate:

- **Process-based Enclaves:** Hardware partitions a region of system memory for the enclave, with the MMU and on-chip Memory Encryption Engine (MEE) enforcing access control and confidentiality. Enclave state is explicitly entered/exited using instructions such as EENTER/EEXIT (SGX) or via hypercalls (e.g., HyperEnclave, Keystone) [1812.09822][2212.04197].
- **VM-based Enclaves:** TEEs at the virtual machine abstraction (e.g., AMD SEV, Intel TDX) employ full-VM encryption, attestation, and memory integrity. Trusted containers and confidential VMs add management, orchestration, and higher-level attestation [2205.05747][2302.03976].

Domain-specific extensions include accelerator enclaves (e.g., "Software-Defined Enclaves" for ML [2007.06751]), composite enclaves (configurable cross-device TCBs [2010.10416]), and in-memory enclaves ("PIM-Enclave" [2111.03307]). Some proposals (e.g., Tyche [2507.12364]) unify all of these under a trust-domain abstraction with recursive composition.

### Table 1: Major Enclave Frameworks

| Framework      | Abstraction    | Memory Boundary        | Attestation          |
|----------------|---------------|-----------------------|----------------------|
| SGX / TDX      | Process, VM    | EPC (128 MiB), TDX VM | MRENCLAVE, Quote     |
| SEV/SEV-SNP    | VM             | Full VM                | PSP, SNP Attestation |
| Keystone/Sanctum| Process       | DRAM partitions        | SM measurement, Hash |
| HyperEnclave   | Process (VMX)  | Hypervisor-enforced    | TPM PCR + Hash       |
| Tyche          | Trust Domain   | Arbitrary granularity  | Monitor-Signed, TPM  |

## 2. Security Goals, Attestation, and Threat Models

The fundamental enclave security properties are:

- **Confidentiality:** All code and data inside the enclave are invisible to non-enclave software/devices.
- **Integrity:** Unauthorized modifications by non-enclave agents are detected or prevented.
- **Initial-state and Code Attestation:** Enclaves provide cryptographic measurement of loaded code/data (e.g., SHA-256 or SHA-3) at creation; remote parties can verify via a signature chain anchored in a device-bound key (e.g., via Intel’s Quoting Enclave or AMD’s VCEK, or via TPM [1812.10605][2511.04550]).
- **Formal Non-Interference:** For example, MI6 demands that an attacker’s observations when attacking a co-resident

Source: https://www.emergentmind.com/topics/confidential-computing-enclaves