Intel TDX

Hardware-isolated virtual machines that shield sensitive data and code from the hypervisor and host OS using silicon-level encryption.

Intel Trust Domain Extensions (TDX) hardens cloud environments by deploying hardware-enforced Trust Domains (TDs). It isolates guest virtual machines from the entire software stack: including the VMM, hypervisor, and host OS. Integrated into 4th Gen Intel Xeon Scalable processors (Sapphire Rapids) and later, TDX leverages the Intel Total Memory Encryption - Multi-Key (TME-MK) engine to secure memory with dedicated AES-128-XTS keys. This design blocks unauthorized access from privileged administrative layers, enabling confidential computing on major platforms like Microsoft Azure and Google Cloud.

https://www.intel.com/content/www/us/en/architecture-and-technology/confidential-computing/trust-domain-extensions.html