Extending the “Circle of Trust” with Confidential Computing

The benefits of operational efficiency and flexibility delivered by public cloud resources have encouraged today’s organizations to migrate applications and data to external computing platforms located outside the perceived security of on-premises infrastructures.

Many businesses are now adopting a “cloud-first” design approach that emphasizes elastic scalability and cost reduction above ownership and management, and, in some cases, security.

Analyzing global trends in public cloud services, Gartner has predicted that spending on these resources will increase from $182.4B in 2018 to $331.2B in 2022, with 30 percent of all new software investments being cloud native by the end of 2019.

Trusting Someone Else to Guard Your Secrets

The benefits of third-party infrastructure and applications, however, come with risks. Deploying sensitive applications and data on computing platforms that are outside of an organization’s owned and managed infrastructure requires trust in the service provider’s hardware and software used to process, and ultimately protect, that data.

Trusting a cloud provider can be disastrous for an organization financially and reputation-wise if they are the subject of a successful cyber-attack.

In its Ninth Annual Cost of Cybercrime Study, Accenture reported that in 2018 the average cost of cyber-attacks involving either a malicious insider or the execution of malicious code was $3M per year, according to participants.

Confidential Computing

One response to the problem of the trustworthiness of the cloud when it comes to data protection has been the emergence of the Trusted Execution Environment (TEE), which has led to the concept of “confidential computing.” Industry leaders joined together to form the Confidential Computing Consortium (CCC) in October.

The Confidential Computing Consortium looks to address the security issues around data in use, enabling encrypted data to be processed in memory without exposing it to the rest of the system.

This is the first industry-wide initiative by industry leaders to address data in use, since today’s encryption security approaches mostly focus on data at rest or data in transit.

The work of the Confidential Computing Consortium is especially important as companies move more workloads to multiple environments, including on premises, public cloud, hybrid, and edge environments.

Secure Enclaves

One of the most important technologies for addressing the problem of protecting data in use can be found in the form of secure enclaves, such as the protected memory regions established by Intel® Software Guard Extensions (Intel® SGX).

Secure enclaves allow applications to execute securely and be enforced at the hardware level by the CPU itself. All data is encrypted in memory and decrypted only while being used inside the CPU: the data remains completely protected, even if the operating system, hypervisor or root user is compromised.

With secure enclaves, data can be fully protected across its entire lifecycle – at rest, in motion and in use – for the first time.

Secure enclaves can offer further security benefits using a process called “attestation” to verify that the CPU is genuine, and that the deployed application is the correct one and hasn’t been altered.

Operating in secure enclaves with attestation gives users complete confidence that code is running as intended and that data is completely protected during processing.

This approach is gaining traction, for example it enables sensitive applications, including data analytics, Machine Learning, and Artificial Intelligence, to run safely in the cloud with regulatory compliance.

Runtime Encryption

Encryption is a proven approach for effective data security, particularly when protecting data at rest and data in motion. However, as discussed above, a key requirement for confidential computing, and the focus of the Confidential Computing Consortium, is protecting data in use.

When an application starts to run, its data is vulnerable to a variety of attacks, including malicious insiders, root users, credential compromise, OS zero-day, and network intruders.

Runtime encryption provides deterministic security with hardware-aided memory encryption for applications to protect data in use. Through optimization of the Trusted Computing Base (TCB), it enables encrypted data to be processed in memory without exposing it to the rest of the system.

This reduces the risks to sensitive data and provides greater control and transparency for users. Runtime encryption provides complete cryptographic protection for applications by running them securely inside a TEE and defending them even from root users and physical access to the server.

Expanding the “Circle of Trust”

The number one concern cited by enterprises in their move to the cloud continues to be security. Confidential computing and protecting data in use gives sensitive applications a safe place that protects them from today’s infrastructure attacks.

Confidential computing is critical for protecting cloud data, and it is fundamentally helping establish and expand the “circle of trust” in cloud computing.

It creates isolated runtime environments that allow execution of sensitive applications in a protected state, keeping cloud apps and data completely secure when in use.

With secure enclaves and runtime encryption supporting confidential computing, customers know that, no matter what happens, their data remains cryptographically protected.

No amount of zero-day attacks, infrastructure compromises, and even government subpoenas can compromise the data. Confidential computing expands the deterministic security needed for the most sensitive cloud applications, at the performance level demanded by modern Internet-scale applications.

A Secure Cloud Future

As Gartner has reported, businesses are migrating their sensitive data and applications to public cloud services, a practice that saves them from ownership and maintenance of infrastructure that will inevitably be obsolete in the future.

Leading technology providers have recognized that confidential computing provides a security model ready to address the problems of untrusted hardware and software that have hampered this transition to the cloud.

With a growing number of use cases, and interest and deployments surging, confidential computing environments will be relied on to protect data in growing areas such as industry 4.0, digital health, the Internet of Things (IoT), and federated machine learning systems.

As the Confidential Computing Consortium continues its work, individuals and businesses may at some point expect a confidential computing architecture as a prerequisite for the exchange and processing of our private data.