English
Menu

What is Confidential computing?

A way of computing in which data being processed are handled inside a hardware-protected TEE, so that even the OS, the hypervisor and the cloud provider's administrators cannot read them. It protects data in use, in addition to encrypting data at rest and in transit. There are VM-based TEEs that protect a whole virtual machine (such as AMD SEV-SNP, Intel TDX and Arm CCA) and enclave-based TEEs that protect part of an application (such as Intel SGX). Secret data and keys are released only after the state inside has been checked by remote attestation.

Japanese name: 機密コンピューティング

Confidential computing appears in 4 practice questions across 2 topics, including Hardware Security: Advanced Topics and Trends, Hardware Security.

Field: Hardware Security: Advanced Topics and Trends

Protecting data in use

Data can be protected by storage encryption while they sit on a disk and by TLS or similar while they cross a network. When they are computed on, however, they are decrypted in memory, so until now one had no choice but to trust the OS, the hypervisor and the cloud provider who manages them. In confidential computing the CPU encrypts the TEE's memory with keys that exist only inside the CPU and refuses accesses from software outside the TEE. Users can then process confidential data without fully trusting the cloud infrastructure.

VM-based and enclave-based TEEs

A VM-based TEE protects the memory of a whole virtual machine, so existing OSes and applications run almost unchanged, but a large body of software including the guest OS enters the trusted computing base (TCB). An enclave runs only the part that handles secrets in a protected region, so the TCB is small, but the application has to be split and rewritten. In VM-based TEEs, besides encryption, integrity protection that stops the hypervisor from remapping pages or writing back old contents is also important. As of the mid-2020s, schemes that combine a CPU TEE with a GPU to run AI workloads under confidential computing are also offered.

Limits and caveats

What confidential computing mainly protects against is memory reads and writes by software and administrators. Side-channel attacks using caches or speculative execution, denial of service by a hypervisor that withholds resources (availability), and advanced physical attacks on the memory bus during operation are outside the protection of some schemes. And if the software inside the TEE has a vulnerability, secrets can leak through it. It is therefore important to check the state inside and the firmware version by attestation, keep the TCB small and keep applying microcode and other updates.

Try it: questions about Confidential computing

In confidential computing on the cloud, what is the purpose of CPU features that encrypt virtual machine memory (such as AMD SEV or Intel TDX)?

  1. ATo always double virtual machine speed
  2. BTo increase virtual machine memory capacity
  3. CTo keep data inside a virtual machine unreadable even by the cloud provider's hypervisor and administrators
Show answer and explanation

Answer: C. To keep data inside a virtual machine unreadable even by the cloud provider's hypervisor and administrators

Normally a virtual machine's memory can be freely read and written by the hypervisor running it, so users must trust the cloud provider. With memory encryption, per-VM keys are managed only inside the CPU, and memory contents stay encrypted outside it, hiding them from the hypervisor and from attackers reading memory directly. It is used together with remote attestation.

Among the TEEs used in confidential computing, which correctly describes the difference between VM-based TEEs that protect a whole virtual machine (such as AMD SEV-SNP and Intel TDX) and enclave-based TEEs that protect part of an application (such as Intel SGX)?

  1. AVM-based TEEs do not encrypt virtual machine memory and protect it only by checking access permissions; only enclave-based TEEs encrypt memory
  2. BVM-based TEEs run existing OSes and applications almost unchanged, but the whole guest OS becomes part of the trusted computing base (TCB)
  3. CWith enclaves the OS and hypervisor are also part of what must be trusted, whereas with VM-based TEEs only the CPU needs to be trusted
Show answer and explanation

Answer: B. VM-based TEEs run existing OSes and applications almost unchanged, but the whole guest OS becomes part of the trusted computing base (TCB)

An enclave runs only the part of an application that handles secrets in a protected region, so what must be trusted (the TCB: trusted computing base) shrinks to the CPU and the enclave code, but the application has to be split and rewritten. A VM-based TEE encrypts the memory of a whole virtual machine and protects it from the hypervisor and the cloud administrators, so existing software can be moved almost unchanged. In exchange, the guest OS and all the software on top of it enter the TCB, and any vulnerability there can leak secrets. A smaller TCB is easier to verify and offers a smaller attack surface, so the choice is a trade-off between ease of use and the size of what must be trusted.

FAQ

If the memory is encrypted, why is attestation needed?

Encryption only keeps outsiders from reading; it says nothing about what is running inside. The workload might be running in a fake TEE, on a tampered guest OS or on firmware that predates a vulnerability fix, so the key that decrypts the data is released only after the measurements and version numbers signed with the CPU's key have been checked.

Does it remove the need to trust the cloud provider at all?

It greatly reduces the worry that memory contents are read, but the CPU vendor and its firmware must still be trusted, and the provider can still disrupt the service by withholding resources. Check for each scheme what is trusted and what it protects against.

Questions that mention Confidential computing (4)

  1. In confidential computing on the cloud, what is the purpose of CPU features that encrypt virtual machine memory (such as AMD SEV or Intel TDX)?
  2. Among the TEEs used in confidential computing, which correctly describes the difference between VM-based TEEs that protect a whole virtual machine (such as AMD SEV-SNP and Intel TDX) and enclave-based TEEs that protect part of an application (such as Intel SGX)?
  3. In confidential computing, a user's verification server (the verifier) checks the attestation report received from a VM-based TEE before handing over the key that decrypts the data. Which is the most appropriate set of things for the verifier to check?
  4. As of the mid-2020s, some data-center GPUs provide features that let them be used for confidential computing together with a CPU TEE. Which correctly describes the idea of this mechanism?

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

Hypervisor Trusted execution environment (TEE) Remote attestation Secure enclave Nonce GPU Arm CCA (Confidential Compute Architecture) CHERI Control-flow integrity DICE (Device Identifier Composition Engine)

Back to the glossary