[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy0lC5R4yjJlCMl_uZFisrjEbstN1mLeLrv7jQj9ANQE":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"67ba2085-7ee6-4379-9d0c-6372fed783ae","article","Intel TDX：云服务器管理员也看不到虚拟机里的数据吗？","intel-tdx-confidential-vm-explained","Intel TDX 通过处理器支持的隔离机制，将虚拟机运行环境划成受保护的 Trust Domain，降低宿主软件直接读取或篡改其内存的机会。本文说明机密计算解决什么信任问题，也谈远程证明、侧信道和来宾系统自身的风险。","把业务放到云服务器上，意味着计算资源由远程基础设施提供。传统虚拟机能隔离不同租户，但客户仍会问一个更深的问题：云平台的高权限软件，能否直接看到虚拟机内存？Intel Trust Domain Extensions（TDX）是机密计算技术的一种实现，目标是在硬件层为虚拟机建立更强的隔离边界。\n\n## 给虚拟机划出受保护的信任域\n\nTDX 将虚拟机运行环境称为 Trust Domain（TD）。处理器与专门的模块配合，对 TD 的内存访问进行控制，并使用硬件机制保护相关数据。设计目标是让宿主机上的虚拟机监控器或其他软件难以直接读取、篡改受保护域中的明文内存，同时仍由平台负责调度虚拟机使用 CPU 和设备资源。\n\n可以把它想成在数据中心里租一间有硬件封条的机房：物业仍负责供电、分配机柜和安排网络，但不应随意打开封闭机柜查看里面的内容。远程证明则让租户验证自己连接到的运行环境是否符合预期的硬件与软件测量状态，再决定是否交付敏感数据或密钥。\n\n## 机密计算不意味着“谁都看不到”\n\nTDX 主要收紧宿主软件直接读取或修改受保护内存的能力，并不能消除所有风险。来宾操作系统、虚拟机内的应用和依赖库仍可能有漏洞；侧信道、错误配置、恶意输入、设备直通和证明流程也需要单独评估。应用主动输出的数据，当然仍会到达它所调用的服务。\n\n远程证明也不是一句“证明通过就绝对安全”。验证方必须理解测量值代表什么、固件和更新状态如何判断、哪些版本被信任，以及密钥在证明前后如何传递。若租户应用本身泄漏密钥，硬件隔离并不能替它补救。\n\n因此，TDX 更像是云安全模型中的一个新信任边界：它让客户有机会减少对宿主软件的信任，并验证运行环境的一部分属性。它不会替代加密传输、应用安全、身份管理和持续补丁。机密计算的价值，取决于威胁模型是否清楚、证明链是否正确，以及工作负载是否真正利用了隔离能力。\n\n来源：[Intel：Trust Domain Extensions](https:\u002F\u002Fwww.intel.com\u002Fcontent\u002Fwww\u002Fus\u002Fen\u002Fdeveloper\u002Ftools\u002Ftrust-domain-extensions\u002Foverview.html)","\u002Fuploads\u002F2026-10-17\u002Ff8891699-ca7f-4edb-b64d-1b4db6421b0e.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"8d35e42e-9f5b-4dd9-b30f-dc2c53d06096","硬件","hardware",{"id":28,"name":29,"slug":30},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","Intel","https:\u002F\u002Fwww.intel.com\u002Fcontent\u002Fwww\u002Fus\u002Fen\u002Fdeveloper\u002Ftools\u002Ftrust-domain-extensions\u002Foverview.html","published",null,false,50,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:39.718Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"d4a1ef13-fa42-41f3-a9d2-635f47d801d0","RISC-V PMP：处理器怎样给不同特权级划出内存禁区？","riscv-pmp-physical-memory-protection","RISC-V PMP 由高特权级软件配置物理内存区域访问规则，并由处理器在较低权限代码访问时执行检查。本文区分 PMP 与虚拟内存，介绍它在固件和嵌入式安全中的作用及实现边界。","\u002Fuploads\u002F2026-10-13\u002Fecfdd306-c8d2-4bfa-984e-7f579fd86f61.jpg",41,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:39.212Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"56b94746-1551-4111-a1e9-6dc7e62e1604","RDMA：两台机器能否让网卡直接搬运注册内存？","rdma-registered-memory-and-remote-access","RDMA 让网卡在授权和注册内存范围内处理远端数据搬运。本文解释内存注册、访问权限与完成队列，避免把它误解为完全没有 CPU 参与。","\u002Fuploads\u002F2026-10-06\u002F86d526f9-9a46-46aa-8c81-1efd4aae1284.jpg",49,"2026-10-06T00:00:00.000Z","2026-10-06T07:51:32.204Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":61,"createdAt":70},"366cdfd1-a8d3-4be8-893a-a298f1a45d23","Erasure Coding：不用存三份完整副本，也能扛硬盘故障吗？","erasure-coding-data-resilience-storage","纠删码将数据与校验信息分片存储，在符合恢复条件时重建丢失数据，以存储效率换取额外计算和恢复成本。本文用 Ceph 说明关键取舍。","\u002Fuploads\u002F2026-10-06\u002Fb60f1262-88da-48f5-972d-075b96d0020a.jpg",54,"2026-10-06T07:51:46.328Z"]