Confidential Computing: Protecting Customer Data in the Cloud
summary
Confidential computing isolates in‑use data inside cryptographic trusted execution environments and produces signed attestation statements so verifiers can confirm exact code hashes; implementations include AMD SEV SNP (memory encryption plus RMP integrity), AWS Nitro Enclaves (EIFs + KMS-bound attestation) and Intel TDX, with GCP/Azure offerings layered on them. It requires reproducible builds and a key broker/KMS to provision keys, does not replace disk or network protections, still risks side channels, and is shown working in production (e.g., BitKey using Nitro + KMS + DynamoDB).
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:25What is confidential computing
- 3:51Threat model and use cases
- 7:25Building blocks of CC
- 15:12AMD SEV SNP deep dive
- 26:53AWS Nitro Enclaves
- 31:24Intel TDX overview
- 32:29Public cloud offerings
- 36:21Implementation nuances
- 39:15Real-world applications
- 42:10Q&A session
related talks
11mLightning Talk: Computing Confidentially in the Clouds
09mAn introduction to Confidential Computing
37mIt's All About Trust: Why Confidential Computing Matters
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!
16mIntroduction to confidential computing
42mSponsored Session: Confidential Computing - New Capabilities for New Workloads
24mConfidential Compute Architecture
44mAdvancements in Confidential Computing