Confidential Computing Across Multiple Clouds and Platforms: Project Enarx
summary
Project Enarx claims to run sensitive apps on untrusted hosts by combining WebAssembly, Rust and hardware TEEs (currently SGX and AMD SEV, Intel TDX planned), keeping the host OS out of the trust chain and minimizing the TCB to CPU+firmware. The demo compiles a wasm binary, deploys it unprotected, in a KVM, then into an SEV “keep” where attestation and encrypted memory prevent a host-side memory-scan from extracting secrets — the SEV deployment succeeds.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:48Protecting workloads
- 4:07Isolation
- 6:03The actors and components
- 6:54The players
- 10:18The problem(s) with TEES
- 12:12One way to solve the problem
- 29:08Enarx Runtime Architecture - deep dive
- 30:13Alternative approaches
related talks
38mEnarx for Confidential Computing
53mEnarx - secured, attested execution on any cloud
46mEnarx - Attested, Secured Execution with AMD’s SEV
40mConfidential Computing and Privacy-Enhancing Technologies - The Landscape
35mVeracruz: Privacy-preserving mutliparty computation using trusted hardware
11mLightning Talk: Computing Confidentially in the Clouds
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
37mIt's All About Trust: Why Confidential Computing Matters