Confidential Computing with Trusted Execution Environments: Architectures, Attacks and Applications

Encryption protects data on disk and on the network. A program must still decrypt its data to compute on it, and at that moment whoever runs the machine can read it. Confidential computing tries to close this gap with hardware. A trusted execution environment isolates code and data from the operating system, the hypervisor and the operator, and remote attestation lets a distant party check what was loaded. This article reviews the published research on that idea. We describe the two designs now in use, process-level enclaves and confidential virtual machines, with the hardware families behind them. We then go through what attestation proves, what it costs to run unmodified software in an enclave, and the attack literature grouped by class: transient execution, controlled channels and interrupts, fault injection, weaknesses in memory encryption, and abuse of the host interface. Applications to machine learning follow, with a short comparison against homomorphic encryption. This is a review and no new experiment is reported. Our reading is that the trust model is narrower than the name suggests.