Difference between revisions of "Confidential Computing"

From MgmtWiki
Jump to: navigation, search
(→‎Solutions)
(→‎Other Material)
 
(13 intermediate revisions by the same user not shown)
Line 8: Line 8:
 
* [https://www.linkedin.com/feed/update/urn:li:share:7130618269056581632/ Microsoft announces Azure]  [[Confidential Computing]] by Vikas Bhatia  
 
* [https://www.linkedin.com/feed/update/urn:li:share:7130618269056581632/ Microsoft announces Azure]  [[Confidential Computing]] by Vikas Bhatia  
 
* 2024-07-01 Process Isolation described in [https://news.dyne.org/privacy-in-eudi/ Privacy in EUDI] by Denis Roio
 
* 2024-07-01 Process Isolation described in [https://news.dyne.org/privacy-in-eudi/ Privacy in EUDI] by Denis Roio
−
===Postres===
+
===PostgreSQL===
 
Transforming PostgreSQL into a Confidential Database with Confidential Computing<ref>Microsoft ''Azure Confidential Computing for Azure Database for PostgreSQL (Preview)'' https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-confidential-computing</ref>
 
Transforming PostgreSQL into a Confidential Database with Confidential Computing<ref>Microsoft ''Azure Confidential Computing for Azure Database for PostgreSQL (Preview)'' https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-confidential-computing</ref>
  
Line 25: Line 25:
 
====Implementation Highlights====
 
====Implementation Highlights====
  
−
{|
+
{| border="1",spacing ="2"
−
| Platform || TEE Technology || Deployment Method || Notes |
+
| Platform || TEE Technology || Deployment Method || Notes  
 
|-
 
|-
−
| **Azure** || AMD SEV-SNP / Intel TDX || Confidential VMs via portal, CLI, Terraform| | Limited to certain regions (e.g., UAE North)  
+
| **Azure** || AMD SEV-SNP / Intel TDX || Confidential VMs via portal, CLI, Terraform || Limited to certain regions (e.g., UAE North)  
 
|-
 
|-
 
| **AWS** || Nitro Enclaves || Dockerized PostgreSQL inside enclave || Requires Fortanix CCM for orchestration  
 
| **AWS** || Nitro Enclaves || Dockerized PostgreSQL inside enclave || Requires Fortanix CCM for orchestration  
Line 38: Line 38:
 
*Remote attestation**: Verifies enclave integrity before processing sensitive data.
 
*Remote attestation**: Verifies enclave integrity before processing sensitive data.
 
*Regulatory alignment**: Supports compliance with HIPAA, GDPR, and other data protection laws.
 
*Regulatory alignment**: Supports compliance with HIPAA, GDPR, and other data protection laws.
 +
 +
===Google Protected Computing===
 +
there is a difference: Confidential Computing is a specific technology focused on protecting data in use via hardware-based isolation, while Google’s Protected Computing is a broader privacy framework that includes Confidential Computing as one of several techniques.
 +
 +
====Confidential Computing (General Concept)====
 +
Definition: A security model that protects data while it is being processed (i.e., in use), not just at rest or in transit.
 +
 +
How it works: Uses Trusted Execution Environments (TEEs)—secure, hardware-isolated environments (e.g., Intel SGX, AMD SEV).
 +
 +
Goal: Prevent unauthorized access to data even from privileged system software (like hypervisors or cloud providers).
 +
 +
Examples:
 +
* Confidential VMs: Encrypt memory and isolate workloads.
 +
* Confidential GKE Nodes: Extend memory encryption to Kubernetes clusters.
 +
* Confidential Space: Enables secure multi-party computation.
 +
 +
Sources: Google Cloud Confidential Computing
 +
 +
====Google’s Protected Computing (Broader Framework)====
 +
[https://blog.google/technology/safety-security/how-we-achieve-privacy-through-innovation/ Definition: Google’s umbrella approach to privacy that includes minimizing data collection, de-identifying data, and restricting access—even from Google itself.]
 +
 +
Components:
 +
* Confidential Computing (as above)
 +
* Federated Learning: Training models on-device without centralizing data.
 +
* Differential Privacy: Adding statistical noise to protect individual data points.
 +
* Homomorphic Encryption: Performing computations on encrypted data.
 +
* Private Compute Core: On-device AI processing (e.g., Smart Reply, Live Translate) isolated from apps and OS.
 +
* End-to-End Encryption: For services like Android Backup and Google VPN.
 +
 +
Sources: [https://blog.google/technology/safety-security/how-we-achieve-privacy-through-innovation/ Google’s Protected Computing overview]
 +
 +
Summary of Differences
 +
{| border="1",spacing ="2"
 +
|Feature || Confidential Computing ||Protected Computing
 +
|-
 +
|Scope || Narrow (data-in-use protection) || Broad (end-to-end privacy framework)
 +
|-
 +
|Tech Focus || Hardware-based TEEs || Combines multiple PETs (e.g., TEEs, differential privacy, federated learning)
 +
|-
 +
|Use Case || Secure processing in cloud or edge || Holistic privacy across devices, cloud, and services
 +
|-
 +
|Provider || Industry-wide concept (Google, Microsoft, AWS, etc.) || Google-specific implementation and philosophy
 +
|-
 +
|}
  
 
==References==
 
==References==
 +
<references />
 +
===Other Material===
 
* [https://confidentialcomputing.io/ Web site]
 
* [https://confidentialcomputing.io/ Web site]
 
* [https://www.linkedin.com/company/confidential-computing/ https://www.linkedin.com/company/confidential-computing/]
 
* [https://www.linkedin.com/company/confidential-computing/ https://www.linkedin.com/company/confidential-computing/]
 
* [https://github.com/confidential-computing/governance Confidential Computing Consortium Governance Documents]
 
* [https://github.com/confidential-computing/governance Confidential Computing Consortium Governance Documents]
  
 +
[[Category: Hardware]]
 
[[Category: Security]]
 
[[Category: Security]]

Latest revision as of 18:12, 2 November 2025

Full Title or Meme

The Confidential Computing Consortium is a community focused on projects securing data in use and accelerating the adoption of confidential computing through open collaboration.

Context

Confidential Computing is but one way to create Layered Security.

Solutions

PostgreSQL

Transforming PostgreSQL into a Confidential Database with Confidential Computing[1]

Turning PostgreSQL into a confidential database means ensuring that **data remains protected even while it's being processed**—not just at rest or in transit. This is where **Confidential Computing** comes in, using **Trusted Execution Environments (TEEs)** to isolate and encrypt data during runtime.

Key Approaches

  1. **Azure Confidential Computing (ACC) for PostgreSQL**

- Uses **hardware-based TEEs** (e.g., AMD SEV-SNP or Intel TDX) to isolate memory during query execution. - Data is encrypted at rest, in transit, and **in use**, shielding it from OS, hypervisor, and cloud admins. - Available via **confidential VM SKUs** in Azure Database for PostgreSQL.

  1. . **Fortanix Confidential Computing Manager (CCM) on AWS Nitro**

- Deploys PostgreSQL inside **Nitro Enclaves**, which isolate workloads from the host OS. - Fortanix CCM manages enclave lifecycle, attestation, and secure image deployment. - Enables secure query execution and encrypted data handling in AWS environments.

Implementation Highlights

Platform TEE Technology Deployment Method Notes
**Azure** AMD SEV-SNP / Intel TDX Confidential VMs via portal, CLI, Terraform Limited to certain regions (e.g., UAE North)
**AWS** Nitro Enclaves Dockerized PostgreSQL inside enclave Requires Fortanix CCM for orchestration

Benefits

  • End-to-end encryption**: Data is protected throughout its lifecycle.
  • Remote attestation**: Verifies enclave integrity before processing sensitive data.
  • Regulatory alignment**: Supports compliance with HIPAA, GDPR, and other data protection laws.

Google Protected Computing

there is a difference: Confidential Computing is a specific technology focused on protecting data in use via hardware-based isolation, while Google’s Protected Computing is a broader privacy framework that includes Confidential Computing as one of several techniques.

Confidential Computing (General Concept)

Definition: A security model that protects data while it is being processed (i.e., in use), not just at rest or in transit.

How it works: Uses Trusted Execution Environments (TEEs)—secure, hardware-isolated environments (e.g., Intel SGX, AMD SEV).

Goal: Prevent unauthorized access to data even from privileged system software (like hypervisors or cloud providers).

Examples:

  • Confidential VMs: Encrypt memory and isolate workloads.
  • Confidential GKE Nodes: Extend memory encryption to Kubernetes clusters.
  • Confidential Space: Enables secure multi-party computation.

Sources: Google Cloud Confidential Computing

Google’s Protected Computing (Broader Framework)

Definition: Google’s umbrella approach to privacy that includes minimizing data collection, de-identifying data, and restricting access—even from Google itself.

Components:

  • Confidential Computing (as above)
  • Federated Learning: Training models on-device without centralizing data.
  • Differential Privacy: Adding statistical noise to protect individual data points.
  • Homomorphic Encryption: Performing computations on encrypted data.
  • Private Compute Core: On-device AI processing (e.g., Smart Reply, Live Translate) isolated from apps and OS.
  • End-to-End Encryption: For services like Android Backup and Google VPN.

Sources: Google’s Protected Computing overview

Summary of Differences

Feature Confidential Computing Protected Computing
Scope Narrow (data-in-use protection) Broad (end-to-end privacy framework)
Tech Focus Hardware-based TEEs Combines multiple PETs (e.g., TEEs, differential privacy, federated learning)
Use Case Secure processing in cloud or edge Holistic privacy across devices, cloud, and services
Provider Industry-wide concept (Google, Microsoft, AWS, etc.) Google-specific implementation and philosophy

References

  1. ↑ Microsoft Azure Confidential Computing for Azure Database for PostgreSQL (Preview) https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-confidential-computing

Other Material

Retrieved from "http://tcwiki.azurewebsites.net/index.php?title=Confidential_Computing&oldid=25253"