As enterprises shift their workloads out of the data center and into co-location facilities or the cloud, they give up a layer of security long taken for granted: physical control over the hardware the software runs on. It’s a reality that’s driving the adoption of confidential computing, especially in the cloud, said Ron Perez, Intel’s technical lead for security architecture pathfinding, in a recent interview.

A cloud provider might be willing to sign agreements promising they won’t snoop on your data, but at the end of the day, it’s still a promise, he explained.

“How much control do they really have? What government, what jurisdiction do they reside in? Where is the data center? Is it subject to seizure or foreclosure,” he said. “People start to realize there are limits to what you can do legally with agreements.”

Confidential computing attempts to rectify this challenge by enabling data to remain encrypted while in use, in transit, and at rest. Additionally, technologies, like Intel’s Secure Guard Extension (SGX), AMD's secure encrypted virtualization-encrypted state (SEV-ES), or Arm's Confidential Compute Architecture (CCA) help to stave off against a variety of threat vectors including malicious hypervisors or side-channel attacks from other applications also running on the system that the user might not control.

Industries that have the most to gain from confidential computing are those that deal in sensitive or proprietary workloads or data. Health care and financial services are a couple of examples of where privacy and data governance concerns make it incredibly difficult to host patient or client information in the cloud, Perez explained. “Confidential computing capabilities really open up new possibilities for them.”

Another area where Intel sees growing demand for confidential computing is artificial intelligence (AI) and machine learning. In this scenario, the data itself might not be sensitive in nature, but the AI training or inference algorithms might be a highly valuable trade secret.

“It kind of boils down to that having to trust only what you need to trust and nothing more,” he added.

Speaking of trust, one of the core principles behind confidential computing is a concept called attestation, which refers to testing whether the workloads you think are secure actually are.

You can think of this in the terms of "trust but verify," Perez said quoting late president Ronald Reagan.

“Providing all these security capabilities, all these protections: encrypted memory and whatnot, those are all fantastic, but they're almost meaningless unless you can prove it to yourself,” he added. And that’s something that confidential computing and attestation directly address.

Confidential computing has evolved dramatically over the last few years as workloads have grown larger and more complex.

Perez noted that the first implementations of Intel SGX supported secure enclaves — pools of encrypted system memory — of just 128 megabytes. “We saw more and more people struggling with, ‘well you know, 128 megabytes, 256 megabytes is nice, but we really want on the order of terabytes or at least multiple gigabytes,’” he said.

Intel’s latest generation of Xeon Scalable processors, codenamed IceLake, vastly expanded the scope of SGX to include larger secure enclaves — up to 512 gigabytes — and multi-socket configurations allowing for even larger workloads.

These larger secure enclaves are especially valuable for users that want to safeguard large proprietary AI workloads while in use, Perez said.

“We’re seeing larger models and larger data sets and one of the challenges that some of our customers had early on was trying to page in or pass in the data they needed to operate on,” he said. “It was so much simpler to have it all inside the enclave … That was a big performance boost to not have to worry about paging data in and out of the enclave.”

Intel is far from the only chipmaker championing confidential computing. The Linux Foundation’s Confidential Computing Consortium, of which Intel is a member, has gained broad industry support since it was founded in 2019.

Intel’s largest rival AMD has announced several improvements to its own confidential computing capabilities with the launch of its third-generation EYPC data center processors this spring.

The release added support for secure nested paging to its SEV-ES technology — AMD’s version of SGX — to prevent a malicious hypervisor from executing replay or remapping attacks on the workload.

Meanwhile, British chip designer Arm Holdings earlier this year announced the Confidential Compute Architecture (CCA), alongside its ARMv9 microarchitecture.

“We believe that secure computing needs to be accessible to all developers, and we really want to extend the kind of high-trust environments that have previously been only accessible to silicon vendors or OEMs using TrustZone,” Mark Knight, director of architecture products at Arm told SDxCentral in an earlier interview. “This is intended to be an architecture for all markets spanning cloud to mobile and automotive to IoT.”

However, the first implementations of Arm’s CCA aren’t expected to reach the market until 2023 or 2024.