Last summer, Google announced that it was using AMD’s 2nd Gen Epyc chip to offer protected computing environments to its cloud customers. This approach, also known as confidential computing, allows an entire virtual machine to run inside a hardware-enabled secure enclave — similar to the secure element in a smartphone that contains payment data but large enough for enterprise applications.
Confidential computing prevents attackers from being able to eavesdrop on applications when applications work with data. Normally, data has to be decrypted for an application to do any work with it, which makes it vulnerable. Data-in-use is the final piece of the data encryption puzzle, solved by hardware-based confidential computing technology.
IBM also has a chip, used in its IBM Z mainframes, for hardware-based secure enclaves for virtual machines.
The other major player in the confidential computing space is Intel, whose secure enclave technology, Intel SGX, is designed to secure individual applications rather than entire virtual machines. As a result, developers have to rewrite their applications if they want to use the SGX features, though third-party tools are available to address some of this gap.
