BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.2 Application Isolation

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 5 Data Protection and Confidential Computing part of 5

Title

Application Isolation

Control

Application isolation utilizes a TEE to help protect the memory reserved for an individual application. The trust boundary associated with the application is restricted to only the CPU. Future generations of these techniques will allow entire applications to be isolated in their own enclaves rather than only protecting specific operations or memory. By using separate application enclaves with unique per-application keys, sensitive applications can be protected against data exposure, even to malicious insiders with access to the underlying platform. Implementations of application isolation will typically involve customer application developers integrating a toolkit within the application layer, and it is the developers’ responsibility to ensure secure TEE design.

Please refer to the following technology examples in the appendices for more information:

• Intel Software Guard Extensions (SGX)

• Arm Confidential Compute Architecture (CCA)

• Arm TrustZone Trusted Execution Environment (TEE) for Armv8-A

• Arm Realm Memory Isolation and Protection

• IBM Application Isolation Technology