The Linux Foundation has announced the establishment of Confidential Computing Consortium, whose objective is to develop technologies and open standards related to the secure processing of data in memory and confidential computing.
Companies such as Alibaba, Arm, Baidu, Google, IBM, Intel, Tencent and Microsoft have already joined the project set, which is intended to co-develop technologies to isolate data in memory during computation at a neutral site. The ultimate goal is to provide funds to maintain the entire data processing cycle in encrypted form, without finding information in open form at certain stages.
The interests of the consortium mainly include technologies related to the use of encrypted data in the computational process, namely, the use of isolated enclaves, protocols for multilateral computing, manipulation of encrypted data in memory and complete isolation of data in memory (for example, to prevent host-systems administrator access to in-memory data from guest systems).
The following projects have been submitted for independent development as part of the Confidential Computing Consortium:
- Intel took the initiative to continue the collaborative development of previously opened components to use technology SGX (Software protection extensions) on Linux, including an SDK with a set of tools and libraries.
SGX suggests the use of a special processor instruction set to allocate closed user-defined memory areas to user-level applications whose content is encrypted and cannot be read and modified even by the kernel and code executed in the modes. ring0, SMM and VMM.
- Microsoft introduced the Open Enclav framework, that allows creating applications for various architectures TEE (Trusted Execution Environment) using a single API and an abstract representation of the enclave. An application prepared using Open Enclav can run on systems with multiple enclave implementations. From the TEE, currently only Intel SGX is supported.
The code is being developed to support ARM TrustZone. Support for Keystone, AMD PSP (Platform Security Processor) and AMD SEV (Secure Encryption Virtualization) is not reported. - Red Hat has delivered the Enarx project, which provides an abstraction layer to create universal applications to run in enclaves that support multiple TEE environments, that are independent of hardware architectures, and allow the use of multiple programming languages ​​(using WebAssembly-based runtime). The project currently supports AMD SEV and Intel SGX technologies.
Of the similar projects that are overlooked, it can be observed the Asylo framework, developed primarily by Google engineers, but that does not have the official endorsement of Google.
The framework makes it easy to adapt applications to move some of the functionality that requires greater protection to the side of the protected enclave. Of the hardware isolation mechanisms in Asylo, only Intel SGX is supported, but a virtualization-based software-based cabinet mechanism is also available.
For its implementation, various encryption algorithms, functions for processing private keys and passwords, authentication procedures, and a code for working with sensitive data can be moved to the enclave.
In the event of a host system compromise, the attacker will not be able to determine the information stored in the enclave and it will be limited only by the external interface of the program.
The use of hardware enclaves can be considered as an alternative to using homomorphic encryption-based methods or confidential calculation protocols to protect the calculations, but Unlike these technologies, the enclave has virtually no performance impact of calculations with sensitive data and greatly simplifies development.
Source: https://www.linuxfoundation.org