ELUVIXSovereign AI Router

Zero-Trust Confidential Silicon (AMD SEV-SNP, Intel TDX & NVIDIA CC)

Eluvix integrates hardware-rooted Confidential Computing across CPU Trusted Execution Environments (AMD SEV-SNP and Intel TDX) and GPU Trusted Execution Environments (NVIDIA Hopper H100 CC-On / PPCIE and Blackwell B200 TEE-I/O). This removes the cloud host hypervisor (KVM/QEMU), root system administrator, and physical PCIe bus from the Trusted Computing Base (TCB), protecting both proprietary 70B+ model weights and sensitive user prompts in flight and in memory.

1. Silicon Threat Mitigations Verified by Eluvix

First-generation memory encryption (such as AMD SEV-ES) encrypted DRAM against physical cold-boot attacks, but left guest page tables (NPT/EPT) and exception vectors (#VC/#VE) exposed to a malicious host hypervisor. Eluvix verifies four hardware silicon primitives before routing confidential workloads:

| Attack Vector | Hypervisor / Hardware Exploit | Silicon Defense Verified by Eluvix | | :--- | :--- | :--- | | Physical DRAM Snoop | Host /dev/mem dump or DDR5 bus interposer | AES-128/256 inline memory engines (AMD ASP / Intel MKTME) + 28-bit SHA-3 ECC MACs | | NPT / EPT Page Remapping | Hypervisor maps two GPAs to same SPA or replays ciphertext pages | AMD Reverse Map Table (RMP) + PVALIDATE / Intel Secure EPT (S-EPT) inside CPU SEAM | | #VC / #VE Interrupt Injection | WeSee / Ahoi attacks inject forged #VC (vector 29) or #VE (vector 20) to leak CPU registers | AMD Restricted Injection (#HV, vector 28) / Intel SEPT_VE_DISABLE | | Host BAR1 GPU VRAM Snooping | Host root reads model weights or KV cache via PCIe BAR0/BAR1 | NVIDIA GSP MMU hardware firewall locks BAR0/BAR1 (0xFFFFFFFF to host) + SPDM AES-GCM-256 DMA |

2. Hopper H100 (SWIOTLB Bounce Buffers) vs. Blackwell B200 (TEE-I/O Inline IDE)

In NVIDIA Hopper H100 CC-On mode, every Host-to-Device (H2D) PCIe transfer must pass through a guest Software I/O Translation Lookaside Buffer (SWIOTLB), where the CPU and GPU Copy Engine (CE) encrypt and decrypt DMA payloads using AES-GCM-256.

NVIDIA Blackwell B200 TEE-I/O eliminates software bounce buffers using hardware PCIe Gen6 Integrity & Data Encryption (IDE), TDISP (TEE Device Interface Security Protocol), and inline encrypted 5th-Gen NVLink (1.8 TB/s):

| Architecture | PCIe DMA Encryption | Effective H2D BW | 70GB Cold Weight Load | Single-GPU Decode | 8x GPU AllReduce | | :--- | :--- | :--- | :--- | :--- | :--- | | AMD SEV-SNP + H100 (CC-On) | SWIOTLB Bounce + CE AES-GCM-256 | 8.64 GB/s | 8.1 s | 121.4 tok/s (-5.5%) | 81.4% efficiency | | Intel TDX + B200 (TEE-I/O) | PCIe Gen6 IDE + TDISP + Inline NVLink | 24.20 GB/s | 2.9 s | 127.1 tok/s (-1.1%) | 98.6% efficiency |

3. IETF RATS Dual-Attestation & Encrypted tmpfs Weight Unsealing

Before releasing the 256-bit AES-GCM Model Weight Decryption Key (DEK) from the Trustee Key Broker Service (KBS), the enclave executes a cryptographic IETF RATS Dual-Attestation handshake:

[ Guest CVM (VMPL 0) + GPU ] ──► 1. Request Nonce ──► [ Trustee KBS / Verifier ]
             │
             ├─► 2. Generate CPU Quote: SHA512(nonce || ephemeral_pubkey) in REPORT_DATA
             ├─► 3. Collect SPDM 1.2 ECDSA P-384 Signed GPU Evidence (GSP + VBIOS RIM)
             │
             └──► 4. Submit Combined Evidence ──────► Verify AMD VCEK / Intel PCS + NVIDIA RIM
                                                                 │
[ Encrypted RAM tmpfs (/mnt/enclave-weights) ] ◄── 5. Release Wrapped 256-bit AES-GCM DEK
  1. CPU Evidence: Verifies VMPL == 0, DEBUG == 0, SMT == 0, MIGRATE_MA == 0, and checks the 512-bit REPORT_DATA binding SHA512(nonce || ephemeral_pubkey) against AMD KDS VCEK or Intel PCS.
  2. GPU SPDM 1.2 Evidence: Verifies the ECDSA P-384 signature over the GPU Security Processor (GSP) firmware measurement and confirms BAR1 firewall lock against NVIDIA Reference Integrity Manifests (RIM).
  3. Zero-Disk Unsealing: Once attested, LUKS2 / dm-crypt unseals the model weights directly into an encrypted RAM-backed tmpfs mount (/mnt/enclave-weights) so plaintext weights never touch host storage.

4. Confidential Switchyard Routing (confidentialPolicy)

Configure confidentialPolicy on the Switchyard Node or per-request via x-eluvix-confidential:

  • disabled: Standard routing without TEE hardware filtering.
  • prefer-tee: Prioritizes attested CPU+GPU confidential enclave upstreams ahead of plaintext workers.
  • require-tee: Fails closed (HTTP 503 confidential_enclave_unavailable) unless an active SEV-SNP / TDX enclave is available.
  • require-dual-attestation: Requires both CPU (SEV-SNP/TDX) and GPU (H100 CC-On/PPCIE or B200 TEE-I/O) SPDM 1.2 attestation with an active kbs:// URI.
curl https://127.0.0.1:3588/api/v1/chat/completions \
  -H "Authorization: Bearer $ELUVIX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "x-eluvix-confidential: require-dual-attestation" \
  -d '{
    "model": "auto",
    "messages": [{"role": "user", "content": "Analyze confidential clinical trial biomarker records..."}]
  }'

Responses include x-eluvix-tee-posture (ATTESTED_DUAL_ENCLAVE | ATTESTED_CPU_ONLY | PLAINTEXT), x-eluvix-tee-arch, and x-eluvix-rats-kbs headers.