BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.1 Memory Isolation

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 5 Data Protection and Confidential Computing part of 5

Title

Memory Isolation

Control

There are many technologies that provide data protection via encryption. Most of these solutions focus on protecting the respective data while at rest and do not cover the fact that the data is decrypted and vulnerable while in use. Applications running in memory share the same platform hardware and can be susceptible to attacks either from other workloads running on the same hardware or from compromised cloud administrators. There is a strong desire to secure intellectual property and ensure that private data is encrypted and not accessible at any point in time, particularly in cloud data centers and edge computing facilities. Various hardware technologies have been developed to encrypt content running in platform memory. Please refer to the following technology examples in the appendices for more information:

• Intel TME and Multi-Key Total Memory Encryption (Intel MKTME)

• AMD Secure Memory Encryption (SME)/Transparent Secure Memory Encryption (TSME)

• Arm Realm Memory Isolation and Protection

• Arm External Memory (DRAM) Encryption and Integrity with CCA

• IBM Memory Isolation Technology