Industry Expert Blogs

With the rise of the cloud, computation has become highly distributed. Workloads can be running on many compute nodes and often span multiple data centers. A workload consists of a combination of code and data, and both are often valuable and sensitive. A data center is often managed by a third-party, such as Cloud Service Provider (CSP), and may reside in a different legal jurisdiction to the workload’s owner. The need to host increasingly sensitive workloads in the cloud has driven the need for Confidential computing. This is a model where a workload can be deployed on third-party infrastructure, with a high degree of confidence that no third party can compromise its confidentiality nor its integrity. 

While today this model is most often used to describe properties that are desirable in a public cloud, there is growing interest in several other markets. Modern vehicle design seeks to consolidate multiple workloads from different suppliers onto a single in-car server. The consumerization of IT has led to a mix of personal and corporate data on personal computers. These are both examples of applications that have similar security requirements to the public cloud, and where the same underlying security technologies can be reused. 

Several challenges must be solved to construct a platform that supports Confidential computing, but the main challenge has been how to protect data and code while it is being processed. By comparison, it is relatively easy to protect data at rest and data in motion by using strong encryption, digital signatures, and careful key management. 

With the recent publication of the first open-source patches that support the Realm Management Extension (RME), now is a great time to look at the latest developments and features for Confidential computing on Arm. In this blog I, provide a brief overview of the techniques that can be used to build a computing platform that supports Confidential computing. This includes a summary of the newest features Arm has added to the Armv9-A Architecture, and details of Arm’s supporting reference software architecture. 

What are the threats that designers consider? 

Click here to read more ...