Confidential computing: A game-changing way to protect data in use

We all have heard Newton’s first law of motion, which is often simplified as “an object at rest stays at rest; an object in motion stays in motion.”

But what about data at rest and in motion? And what about data in use?

A primary means of protecting sensitive data is encryption. Encryption applies algorithms to scramble data so that it’s readable only by someone who holds the key to decrypt it. The high-tech industry continues to make advances in encryption that protects data at rest -- information stored on a disk drive, say -- and data in motion -- information transferred across a network.

Then there’s data in use. How can data be encrypted while it’s being analyzed in computer memory? That’s the goal of confidential computing, an emerging industry initiative to protect data in use -- at scale and in the cloud.

Building on industry innovations

Confidential computing is enabled by hardware technology that reserves a section of a CPU as a secure enclave. It encrypts the memory in the enclave with an encryption key unique to the CPU and the application.

An agency can use such an approach to protect highly sensitive data and application code placed in the enclave. That data can be decrypted only within that enclave on that CPU. As a result, the data remains protected while it’s in use -- for instance, when users are conducting analytics on a database. Even if attackers gained root access to the system, they wouldn’t be able to read the data.

The technology includes an attestation feature so that an organizaton can confirm to third parties that the data resides in an enclave. An agency that handles health data, for example, could assure health care providers that information they submit will remain protected.

Earlier generations of this technology limited the enclave size. But with the latest generation of computer processors, a server could have up to 1 TB of enclave memory. That enables agencies to place an entire application, database or transaction server inside the enclave.

Protecting cloud data with confidence

This new capability can transform the way agencies approach security in the cloud. With traditional cloud computing, users must implicitly trust the cloud provider. The cloud provider might make every assurance that it will protect the data at rest, and the agency might take every precaution to protect the data in motion. Ultimately, though, agencies have to simply hope their data will remain secure while it’s in use.

But with confidential computing, agencies can be confident their data in use is protected. This is a game-changer, especially for federal agencies, which are highly regulated. Now they can protect in-use data even when it’s being hosted by a cloud provider. As a result, the data can remain safe throughout its entire lifecycle – at rest, in motion and in use.

Bringing confidential computing to government

Leading hardware makers are partnering with top cloud providers to bring confidential computing to federal organizations. Agencies will be able to select cloud services built on virtual machines that leverage the right hardware technology to protect data in use. Attestation features can verify the security posture of those VMs.

Confidential computing VMs are already in preview for federal, state and local governments and their partners in the various U.S. cloud regions. This technology enables agencies to build enclave-based applications to protect data in use in a dedicated cloud that meets government security and compliance requirements.

Of course, federal agencies often manage clouds in classified, air-gapped environments not connected to the internet. For those situations, hardware and cloud providers have partnered to develop tools that enable confidential-computing provisioning, updates and attestation without the need for an internet connection.

Benefiting industry and government

Industry is coming together to address a range of cloud security issues through the Confidential Computing Consortium. A project of the nonprofit Linux Foundation, the CCC is an open-source community dedicated to defining and driving the adoption of confidential computing.

Confidential computing will deliver advantages to the high-tech industry and public sector alike.

• Benefits for the industry: Because it reduces the “trust base” for data in use to only the CPU, confidential computing significantly decreases the risk to applications and data in the enclave. Cloud providers, software-as-a-service providers, application developers and anyone else creating applications for environments where security is a top concern will embrace confidential computing.
• Benefits for government: Confidential computing gives any organization in a regulated environment -- and, really, any enterprise that transacts on data that includes personal identifiable information -- the ability to protect data in use. It allows organizations to work with data in the cloud without having to include the cloud provider as part of the trust base it needs to secure.

Cyber vulnerabilities will always exist. Cyberattacks will still make headlines. But with confidential computing, agencies can protect data throughout its lifecycle -- at rest, in motion and in use.