Skip to main content
Contact Nelix Partner with Nelix
Platform

Trusted Compute Platform

Four layers that make an inference result verifiable

Root of trust, inference engine, infrastructure SoC, and fleet verification plane, specified together so a field result can be checked against the hardware, firmware, and model that produced it.

Architecture defined Pre-silicon
Partner with Nelix Product roadmap
Advanced package

Advanced package

Trust domain Trusted compute
Nelix trusted compute domain Floorplan with four nested planes: board domain, package, die, and a central trust island for device identity, measurement and signing. Compute, memory, sensor I/O, metrology, crypto and telemetry route into a ring bus. Only signed data leaves through an attestation export port. Board domain Package Die Die extent Package extent Compute Bounded array Memory Measured store I/O phy Sensor ingress Metrology Sense & sample Crypto Sign & seal Telemetry Signed export Ring bus Trust island Root of trust Key slots Identity · measure · sign Port signed Attestation export Nothing else crosses
  • Trust boundary
  • Supporting logic
  • Signed data in flight
Trusted Compute Platform · architecture, design intent
ARCHITECTURE

Read the architecture

Each layer depends only on the guarantees beneath it, and what is drawn is specified rather than measured.

  1. Attested Infrastructure Inference

    Fleet verification before workflow admission · Platform

  2. InferEdge

    Joule-bounded inference as a completion transaction · Accelerator

  3. SecureGrid

    Metrology and inference in one trust domain · SoC

  4. TrustCore

    Per-die identity, measured boot, result signing · Root of trust

Boot chain Secure boot
Measured secure boot sequence A conceptual staged boot diagram. Five stages ascend from an immutable boot ROM through first stage, loader and kernel to an attestable state. Each stage verifies the next before handing control on, and each writes a measurement into a shared register bank below, which fills as the sequence proceeds. If any measurement fails to match, control leaves the sequence into a halt state and no attestation is produced. Boot depth Boot sequence Mismatch Halt, no attestation S0 Boot ROM Immutable S1 First stage Verify + measure S2 Loader Verify + measure S3 Kernel Verify + measure S4 Attestable Quote ready Measurement register M0 M1 M2 M3 M4 Extend only · never rewind
  • Current stage
  • Reject path
  • Light = hand-off and measurement
Each stage measures the next before handing over, and the register only extends, so the boot history cannot be rewritten.
Mechanism context · design intent
MECHANISMS

What holds, and why

  1. Silicon-derived identity

    PUF identity from manufacturing variation, no stored key to extract

  2. Measure before execute

    Boot, firmware, and model artefacts verified before inference runs

  3. Energy-budgeted work

    Requests admitted only against an accepted joule budget and model tier

  4. Proof-carrying results

    Each export binds result digest to device, firmware, and model state

Interposer stack
Interposer stack
DESIGN TARGETS

Specification

Pre-silicon. Architecture specified; RTL in progress; FPGA next. Figures are design targets, not measured silicon results.

Trusted Compute Platform design targets
Platform status Architecture defined; RTL in progress
Target inference envelope Sub-15 W (design target)
Numeric formats INT8 / INT4 (design target)
Identity PUF-derived, per-die
Cryptography Post-quantum and classical suites
Target service life 10-20 years in field
First silicon Not before 2029
Where it fits
  • Revenue metering
  • Distribution automation
  • Industrial monitoring
  • Remote radio sites
  • Constrained-edge inference
Engage

Talk to the design team

The specification is still open to review.

Partner with Nelix Product roadmap
RELATED