{
  "format": "agent-article-v0",
  "article_id": "EA-257",
  "canonical_url": "/tools/ea-257-confidential-computing-tee-ai",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EA-257-CURRENT-APPROVAL",
    "EA-257-CURRENT-BODY-READBACK"
  ],
  "unknown_ids": [
    "EA-257-UNKNOWN-01"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "CURRENT",
  "observation_status": "SPEC_ONLY",
  "freshness": "CURRENT",
  "last_verified": "2026-10-06",
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "V23-CANDIDATE-EA257-FIRST-20261015-C4",
    "BODY-SHA256:6bc070e773be123d90281eaf3a3ad6fa8d59f8b933b8d30d4fefe0e3dfbd2848"
  ],
  "article_sources": [
    {
      "id": "EA-257-CURRENT-APPROVAL",
      "evidence_class": "RESEARCH",
      "title": "現行本文の監査・revision対応",
      "supports": [
        "現行台帳のAUDIT_PASSと候補・revision・本文ハッシュの対応を確認しています。"
      ],
      "limit": "監査状態と来歴の記録です。外部根拠の最新性や本文の全主張を追加保証しません。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "V23-CANDIDATE-EA257-FIRST-20261015-C4"
      ],
      "supporting_locators": [
        "1KqhJtiSb2S84rWmeYVwKcT_76dBwZ_B0ZZuAWQqH0rQ/EA_REVISION_LEDGER!A58:U58",
        "EA_REVISION_LEDGER!A58:U58",
        "EA-257-FIRST-20261006"
      ],
      "provenance_status": "CURRENT_CANONICAL_APPROVAL_READBACK"
    },
    {
      "id": "EA-257-CURRENT-BODY-READBACK",
      "evidence_class": "IMPL",
      "title": "現行本文の収録照合",
      "supports": [
        "公開生成入力の本文SHA-256が、監査済み候補に結び付いたハッシュと一致しています。"
      ],
      "limit": "本文の同一性の検査です。外部システムの挙動や全主張の真偽を実証したものではありません。",
      "checked_at": "2026-10-17",
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "BODY-SHA256:6bc070e773be123d90281eaf3a3ad6fa8d59f8b933b8d30d4fefe0e3dfbd2848"
      ],
      "supporting_locators": [
        "content/staging/EA-257.md",
        "6bc070e773be123d90281eaf3a3ad6fa8d59f8b933b8d30d4fefe0e3dfbd2848",
        "EA-257-FIRST-20261006"
      ],
      "provenance_status": "CURRENT_APPROVED_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "PUBLIC_CLAIM",
      "text": "Confidential Computing／TEEは、定義したthreat modelの範囲でAI workloadのdata-in-useと実行環境をhost/operatorから隔離し、remote attestationをsecret/key releaseの条件にできます。\nただし、TEEやattestation PASSだけでapplication code、GPU、side channel、availability、prompt/output/log、tool actionまで自動的に安全になるとは扱いません。"
    },
    {
      "heading": "TRUST_BOUNDARY",
      "text": "導入時にCPU/TEE technologyとgeneration、firmware/microcode/BIOS/TCB、VM/base image、workload image、runtime policy、GPU/accelerator、attestation verifier、key-release service、IAM/KMS、storage/network pathを固定します。「confidential VM」というproduct labelだけで全componentが同じ保護境界に含まれるとは推定しません。"
    },
    {
      "heading": "ATTESTATION_CHAIN",
      "text": "remote attestationは、evidence生成→verifierによる署名/measurement/TCB検証→nonce/freshness/token expiry確認→reference value/policy照合→attested workload identity確定→policy PASS後のsecret/model key/resource access、というchainで扱います。token取得だけをauthorization成功としません。"
    },
    {
      "heading": "MEASUREMENT_AND_REFERENCE_VALUES",
      "text": "image digest、boot/firmware/TCB、runtime policy等、resource release判断に必要なcomponentを明示的に測定・pinします。測定対象外componentを暗黙にtrustedとしません。TCB/image更新はreference value更新をchange controlとして扱い、古い脆弱TCBへのrollbackも確認します。"
    },
    {
      "heading": "FRESHNESS",
      "text": "attestation evidenceにはnonce等のfreshness mechanismを要求し、stale/replayed evidenceをsecret releaseへ使用しません。verifier identity、token TTL、clock/expiry handlingも確認します。"
    },
    {
      "heading": "KEY_RELEASE",
      "text": "secret/model keyはattestation policyが要求measurementとfreshnessを満たした後にreleaseします。release先public key/session identityをattested workloadへbindします。TEEの存在だけをkey release条件にしません。"
    },
    {
      "heading": "CPU_AND_GPU_BOUNDARY",
      "text": "AI accelerator利用時はCPU confidential VMとGPU confidential computing/attestationを別gateとして確認します。CPU VMがattestedでもGPU、driver、firmware、PCIe/device pathまで自動的にprotectedとは扱いません。GPU CC mode、GPU attestation evidence、driver/firmware compatibilityを確認します。"
    },
    {
      "heading": "APPLICATION_BOUNDARY",
      "text": "TEE内でもapplication vulnerability、prompt injection、malicious/excessive tool call、overbroad IAM、plaintext logs/traces、model output disclosure、secret persistence、business-action authorizationは別controlです。attestation PASSをapplication correctnessやtool-action permissionとして扱いません。"
    },
    {
      "heading": "SIDE_CHANNEL_AND_AVAILABILITY",
      "text": "TEEをside-channel-freeまたはDoS-resistantと表現しません。platform threat model/current security bulletinを確認し、必要に応じconstant-time implementation、secret-independent access、resource isolation等を別control化します。availability/capacity/attestation outage/hardware shortageは別SLOです。"
    },
    {
      "heading": "DEPLOYMENT_MODE",
      "text": "AWS Nitro Enclavesのdebug modeのようにdeployment modeでattestation suitabilityが変わるため、debug/dev imageとproduction attestation-capable imageを分離します。"
    },
    {
      "heading": "CURRENTNESS",
      "text": "TEE security claimはhardware generation名だけで固定せず、firmware/microcode/BIOS/TCB/security bulletin mitigation stateを確認します。attestation SDK/clientのdeprecation/compatibilityも追跡します。"
    },
    {
      "heading": "FAILURE_ENVELOPE",
      "text": "stale/replayed attestation、missing nonce、verifier misconfiguration、wrong reference digest、unsigned/unpinned image、debug image、unpatched TCB、incomplete measurement、unmeasured runtime、CPU-only attestation、GPU CC disabled、device path outside boundary、premature/unbound key release、overbroad IAM/KMS、token expiry、TCB rollback、side-channel leakage、application bug、prompt/output/log exfiltration、tool authorization failure、secret persistence、DoS、capacity shortage、attestation outage、SDK incompatibilityを想定します。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "本項は2026-10-06時点のAWS Nitro Enclaves/KMS、Google Confidential Space、Azure confidential VM、AMD SEV-SNP security bulletins、NVIDIA attestation/confidential-computing documentation、Confidential Computing Consortium threat-model materialに基づきます。live resource mutation、token cryptographic verification、side-channel test、performance benchmarkは未実施です。"
    },
    {
      "heading": "SAFE_WORDING",
      "text": "Confidential Computing／TEEは、定義したthreat modelの範囲でAI workloadのdata-in-useと実行環境をhost/operatorから隔離し、remote attestationをsecret/key releaseの条件にできます。ただし、TEEやattestation PASSだけでapplication code、GPU、side channel、availability、prompt/output/log、tool actionまで自動的に安全になるわけではありません。measurement、nonce/freshness、verifier、TCB/firmware、workload identity、CPU/GPU境界、key-release policyを固定し、測定対象外とOPEN_UNKNOWNを明示します。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "organization TEE architecture、cloud/region、CPU/TEE generation、firmware/microcode/BIOS/TCB、reference authority、verifier、nonce/token、key release、GPU/driver/firmware/CC、image signing/SBOM、runtime policy、IAM/WIP/KMS、storage/network、side-channel requirements、performance/cost、capacity/SLA、logging/residency、Agent tool auth、incident response、rollback/reference updateは未確認です。"
    }
  ],
  "human_url": "/tools/ea-257-confidential-computing-tee-ai",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-257-confidential-computing-tee-ai",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-257-confidential-computing-tee-ai"
}