Hardware-Based Security Mechanisms for Protecting Computer Systems: A Structured Narrative Review of Trusted Execution, Attestation, and Memory-Safety Hardware

Abstract

Security mechanisms that are embedded in processors and platforms are driven by the fact that software-only defenses have been undermined by compromises in the operating system, hypervisor, or application. This paper is a structured narrative review of the hardware based security mechanisms for computer system security, from eleven verifiable sources published from 2018 to 2026. Sources consist of surveys of trusted execution environments (TEEs) and remote attestation, Arm TrustZone, Intel SGX research and attack papers. The purpose of the review was to categorize the principal mechanisms, review the protection and reported limitations, and analyze documented attacks. The level of granularity, support for attestation, protection from physical adversaries, and other mechanisms vary widely. Several designs have been based on the assumption that is now been proven to be incorrect due to microarchitectural and memory-interposition attacks, and developer practice has added to this risk. CHERI provides excellent memory-safety guarantees with workload-dependent overheads that range from nearly nonexistent to 1.65×. The synthesis enables threat modeling for selecting mechanisms, defense in depth, and integrity and freshness protection for memory in physically exposed deployments.