可信执行环境 (TEE)：硬件级安全计算

c // trusted.edl enclave { trusted { public int ecall_compute_secret([in] int input); }; untrusted { void ocall_print([in, string] const char* str); }; };

### 密封数据与解封

```c
sgx_status_t seal_data(const uint8_t* data, size_t data_size, 
                       sgx_sealed_data_t* sealed_blob, size_t sealed_size) {
    return sgx_seal_data(0, NULL, data_size, data, sealed_size, sealed_blob);
}