The Security Liability of Memory Allocation in TEEs: A Design Decision Log

Memory allocation is not a feature — it is a security liability.

In high-assurance Trusted Execution Environments (TEEs), you cannot afford the jitter or the fragmentation of a probabilistic global heap. When building the sakshi-core attestation loop for the Sovereign Spine architecture, the requirement was absolute: determinism.

Standard heap allocation introduces non-deterministic paths, memory fragmentation, and significantly increases the complexity of the Trusted Computing Base (TCB). For our enclave, that is unacceptable.

The Problem: Why GlobalAlloc Fails the TEE Test

In a standard Rust environment, we lean on the global allocator. In a TEE, however, the global allocator is a massive attack surface.

Jitter: Allocation time varies based on heap state, leaking metadata through timing side-channels.

Fragmentation: Heap fragmentation can lead to unpredictable exhaustion, a vector for Denial of Service (DoS) within the enclave.

TCB Bloat: The allocator logic itself adds thousands of lines of code to your audit surface.

The Solution: Session-Scoped Bump Buffer

To enforce architectural certainty, I stripped away the dependency on standard heap allocation in the enclave. Instead, I implemented a session-scoped bump buffer.

This is a contract-based memory model:

Constant-time execution: Allocation is a pointer increment operation, taking 1-2 CPU cycles.

Zero-fragmentation: Memory is allocated linearly and cleared atomically at the session boundary.

Simplified TCB: By removing GlobalAlloc, the enclave memory logic is reduced to a handful of lines of verifiable code.

Implementation Concept

The core logic relies on a pre-allocated static region. We do not ask the system for memory; we own a dedicated slab of silicon-backed memory and manage it strictly within the request lifecycle.

// Conceptual implementation of the session-scoped buffer
pub struct BumpBuffer {
    buffer: &'static mut [u8],
    offset: usize,
}

impl BumpBuffer {
    pub fn alloc(&mut self, size: usize) -> Option<&mut [u8]> {
        if self.offset + size <= self.buffer.len() {
            let start = self.offset;
            self.offset += size;
            Some(&mut self.buffer[start..self.offset])
        } else {
            None // Enforce strict limit, no OOM panic
        }
    }
}

The Architectural Takeaway

We must stop hoping for performance and start architecting for it. By moving the decision boundary from the runtime heap to a statically-defined buffer, we remove entire classes of vulnerabilities.

In the Sovereign Spine, the memory model is not just an implementation detail—it is a security guarantee.

Explore the Implementation

The architectural patterns discussed here—including the session-scoped bump buffer—are part of the sakshi-core module within the Citadel Protocol Repository.

View the code: citadel-protocol/sakshi-core