Confidential Computing: A History

If you haven’t heard about Confidential Computing, here’s the gist. It’s the new buzzword for a trendy tech nobody understands - except for the fact that it should bring high security to computed data. That’s a major topic in security because traditional encryption works very well for data when it’s in transit or when it’s at rest (in storage), but cannot properly safeguard data when it is being processed. 

Maybe, you heard about the complex terms it comes with, like Trusted Execution Environments, enclaves, or isolated VMs. 

If you find yourself struggling to grasp the meaning of these terms, don't worry at all. This article aims to introduce you to the story of Confidential Computing without getting too much into the technical stuff (we’ll post some links to go more in-depth at the end of the article). 

An iTale of Enclaves

Let’s start the story in 2014 when Apple launched its new iPhone… The iPhone 5s. Quite discreetly, that phone had something the others didn't. Apple called it a Secure Enclave Processor. Consumers didn’t care so much, but the security industry was shaken. 

Apple has added a processor dedicated to the security of its devices, entirely separate from the rest of the system. This chip and its memory stored the most sensitive data, such as Apple Pay, the iCloud keychain containing passwords, Face ID, and Touch ID biometric data. It also kept the cryptographic signatures that allowed you to verify that the app you downloaded on the Apple Store was legit.

Everything was encrypted, of course. But that wasn’t what made it a breakthrough in security and confidentiality. It was that the memory was physically separated from the rest of the terminal's memory, to prevent bugs from being exploited. As a result, third-party applications couldn’t access it. Even if the application process was compromised (with root privileges), access to the personal storage authenticated by the iCloud account was impossible. Data was being protected while being processed. 

This was the first big commercial enclave, or, in more accurate technical terms, a Trusted Execution Environment (TEE).

Securing the Cloud

Of course, the first seeds of Confidential Computing didn’t originate with Apple or consumer tech. They were planted as early as the 1980s in the hardware-based security research field. One of the earliest examples of Confidential Computing was the development of the secure kernel, a protected area of memory that can only be accessed by authorized code. The US government funded research and the Kernelized Secure Operating System was born. Secure co-processors were also already being developed by IBM to ensure data confidentiality and integrity, but it wasn't until recent years that the vision of Confidential Computing started to crystallize fully. 

It happened because of the Cloud computing hype in the 2010s. Because the customers of Cloud computing started to worry that the providers could (theoretically) access their data, it raised privacy concerns. Confidential computing came as an answer to address these concerns by providing a way to protect data from unauthorized access, even in the cloud.

Intel Strikes Back

That’s when things started moving faster. In 2015, Intel launched the Software Guard Extensions (SGX), a set of security-related instruction codes that are built into some of their modern processors. This was a significant leap forward, offering new techniques for protecting selected codes and data from disclosure or modification. 

Then, in 2019, a group of tech giants, including Google, Microsoft, IBM, and Intel, founded the Confidential Computing Consortium under the Linux Foundation's umbrella. This consortium aimed (and still aims) to accelerate the adoption of Confidential Computing and provide a universal data security standard. 

All hardware manufacturers and cloud providers started launching their vision of Confidential Computing technology: AMD, with SEV-SNP, Microsoft and Google with Confidential VMs, Amazon,; Amazon with AWS Nitro Enclaves, Nvidia, with a confidential GPU… 

Things have never been so exciting in the field, and we’re happy to take you on a deeper journey into what Confidential Computing is, how it works, and how you can use it for yourself to protect data! 

• Our intro to Confidential Computing is an explanation that’s very accessible on the principles behind the technology’s security.
• Discover the Confidential Computing ecosystem, a little theory that’s a little more intermediary on the topic.
• Confidential Computing Explained, a hands-on course to learn how enclaves work and how to create your own mini Key Management System (cryptographic keys).
• A guide to privacy technologies if you’re curious about the alternatives to Confidential Computing to protect data privacy.

Want to learn more about Zero-Trust LLM deployment?

Image credits: Edgar Huneau