At least one device, comprising: at least one virtual machine (106A...n) to process data (112A...n) in the at least one device; and a trusted execution environment including at least an encryption service to encrypt or decrypt data provided to the encryption service from the at least one virtual machine; wherein the at least one virtual machine comprises an encryption agent (110A...n) to provide the data to the encryption service; wherein the at least one virtual machine (106A...n) is configured to: provide data (112A...n), via the encryption agent (110A...n), to the encryption service, obtain encrypted data (114A...n) from the encryption service, and cause the encrypted data (114A...n) to be stored in a remote resource, and: obtain, via the encryption agent (110A...n), encrypted data (114A....n) from the remote resource, provide the encrypted data (114A...n) to the encryption service, and obtain decrypted data (112A...n) from the encryption service; wherein the encryption service is further configured to register, upon receiving a request to this effect, the encryption agent (110A...n) prior to accepting data for encryption or decryption from the at least one virtual machine (106A...n), wherein this registration includes an authentication of the encryption agent (110A...n) and wherein this authentication includes the encryption agent (110A...n) providing, to the encryption service, hash values for measuring known-good programs, which are programs comprised in the encryption service and used for encrypting data to be stored in the remote resource, or for decrypting data retrieved from the remote resource; wherein the trusted execution environment further comprises an encryption key corresponding to the at least one virtual machine, wherein the encryption key is generated by the encryption service when the encryption agent (110A...n) is registered; wherein the encryption service utilizes the encryption key corresponding to the at least one virtual machine to encrypt or decrypt data received from the encryption agent; and wherein the trusted execution environment is based on secure enclave technology to protect at least the encryption service and encryption key. at least one virtual machine (106A...n) to process data (112A...n) in the at least one device; and a trusted execution environment including at least an encryption service to encrypt or decrypt data provided to the encryption service from the at least one virtual machine; wherein the at least one virtual machine comprises an encryption agent (110A...n) to provide the data to the encryption service; wherein the at least one virtual machine (106A...n) is configured to: provide data (112A...n), via the encryption agent (110A...n), to the encryption service, obtain encrypted data (114A...n) from the encryption service, and cause the encrypted data (114A...n) to be stored in a remote resource, and: obtain, via the encryption agent (110A...n), encrypted data (114A....n) from the remote resource, provide the encrypted data (114A...n) to the encryption service, and obtain decrypted data (112A...n) from the encryption service; wherein the encryption service is further configured to register, upon receiving a request to this effect, the encryption agent (110A...n) prior to accepting data for encryption or decryption from the at least one virtual machine (106A...n), wherein this registration includes an authentication of the encryption agent (110A...n) and wherein this authentication includes the encryption agent (110A...n) providing, to the encryption service, hash values for measuring known-good programs, which are programs comprised in the encryption service and used for encrypting data to be stored in the remote resource, or for decrypting data retrieved from the remote resource; wherein the trusted execution environment further comprises an encryption key corresponding to the at least one virtual machine, wherein the encryption key is generated by the encryption service when the encryption agent (110A...n) is registered; wherein the encryption service utilizes the encryption key corresponding to the at least one virtual machine to encrypt or decrypt data received from the encryption agent; and wherein the trusted execution environment is based on secure enclave technology to protect at least the encryption service and encryption key.