Don’t Trust Opaque Clouds, Cryptographically Verify Instead!
summary
Confidential computing claims hardware-enforced TEEs plus remote attestation let workloads prove integrity on demand; the demo boots confidential VMs on Azure, measures firmware and DM‑verity images, and only releases keys from a Trustee key‑broker when measurements match the golden reference. Implementations use ConfidentialContainers/Carter, KMS (Vault), Argo CD and Open Cluster Manager in a hub‑and‑spoke validated pattern; protections block shell/log access and the flow works end‑to‑end, while AWS Nitro still lacks comparable attestation.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:03Motivation for cryptographic verification
- 3:55Trusted compute base
- 7:26Confidential computing
- 12:27Confidential containers and KVM
- 16:20Hardware root of trust and memory encryption
- 22:05Deployment at scale
- 25:37Live demo
- 31:52Remote attestation
- 35:45Firmware and hypervisor security
- 38:12Limitations and best practices
related talks
45mConfidential Computing: Protecting Customer Data in the Cloud
13mVM Security with Confidential Computing
29mConfidential Containers: The Next Era of Cloud Data Security
11mLightning Talk: Computing Confidentially in the Clouds
19mKeynote: Attested, Transparent, Sovereign: The Evolution of Confidential Computing
37mIt's All About Trust: Why Confidential Computing Matters
28mSealed for All: Multi-Party Confidential Computing, No Trust
27mTrust No One: Bringing Confidential Computing to Containers