Confidential computing and data encryption in use

Confidential Computing is the last frontier for data protection and encryption, especially for those defined in use by programs. The issue of personal data, in fact, poses new objectives for protection that change according to how the data is treated. We typically recognize three data usage scenarios:

• at rest (data at rest): all information that is somehow permanently saved on a support and is not actively used by any application;
• in motion (data in transit): that is, data flows, generally through a communication network, which need protection during movement;
• in use (data in use): all those data that are actively consumed by a process, a program or processed with any technology.

However, while we are used to protecting the data of the first two categories, the data protection process in use is still embryonic: let's try to understand the differences.

The simplest use cases

There are various mechanisms that allow us to protect the data we produce, transmit and save: each of these adapts to the type of environment in which it must be applied. For example, backup disks are information containers that tend to be used infrequently. Here it is possible to use symmetric key cryptography which is certainly more secure even if it opens up to the problem of keeping the key. In fact, in this case we do not need to "consume" the data very often and quickly but rather a few accesses and delayed over time.

On the contrary, the transmission of data over the network presents us with a decidedly more complicated choice. On the one hand, having to transmit protected data and at the same time avoid burdening the transmission in terms of added protection structures. In fact, transmission over a network involves splitting the original data into smaller packets. Furthermore, in the case of a data stream (such as, for example, for multimedia contents) the problem arises of being able to protect a continuous flow of information without having to interrupt it. Also in these cases there are various solutions such as asymmetric key encryption or symmetric key flow algorithms (such as RC4).

Data in use: what's different

But let's get to the focal point that is at the center of the research of many computer scientists: the data in use . In fact, when a program makes use of data, it typically loads them from the hard disk (or any other storage unit) into central memory, where the CPU is able to quickly fetch them, process them in the registers and save them again waiting to be copied stably. on the hard drive. In ordinary computer use, the time in which our applications leave the data in the main memory unprotected may seem negligible. However, the case of large data bases which for some reason require processing of their content is different.

For example, let's say you have a large table on a database . If we wanted to UPDATE some fields, in fact the system would need to temporarily copy the data to the main memory, apply the changes and then save the updated data again. In this case, however, the amount of time is significantly greater, exposing the plaintext data to potential attacks that could compromise it.

Confidential Computing: How It Works

Confidential Computing technology has at its core a secure execution environment, called Trusted Execution Environment (TEE) . This dedicated hardware within the CPU is protected by embedded encryption keys and mechanisms by which the keys can only be accessed by authorized applications.

In this way, potential unauthorized applications that require the CPU to process information will be blocked directly at the processor level. This ensures that the data remain protected in the memory until the moment of their processing which will be required by the TEE. However, processing and decryption are completely invisible to the operating system, so any malicious software running on it will not be able to access sensitive data.

This technology officially became the target of the first Confidential Computing Consortium , born in 2019 from a group of CPU manufacturers with the support of the Linux Foundation . Although it is still a little used technology, it actually has great potential that can be exploited. In a few years there will surely be more and more companies that will recognize the benefits in terms of safety management and reduction of operational risk.

The article Confidential computing and data encryption in use comes from Tech CuE | Close-up Engineering .