Confidential computing with Intel Software Guard Extensions (SGX) for Virtual Servers for VPC

SGX is a trusted execution environment (TEE)

SGX uses a trusted execution environment (TEE). TEE is a secure area of the main processor that provides a higher level of data security for trusted data and applications.

A TEE sets up an isolated, secure area of the main processor on a device that is dedicated to processing and storing sensitive data. The secure environment is protected from unauthorized access - even if the operating system is compromised. While your sensitive data is inside an encrypted enclave, your data is split into trusted and untrusted parts. The trusted parts are used in the encrypted enclave while the CPU denies all other access to the enclave regardless of access privileges. The data is inaccessible to internal and external threats and can't be removed or modified.

So, all Intel SGXs are TEEs, but not all TEEs are Intel SGXs.

Attestation

When you develop a confidential computing application, you must design it so you can segment the information that needs encryption. At run time, the segmented information is kept confidential through attestation. When a request for information from the segmented code or app data is received, the encrypted enclave verifies that the request comes from the part of the application that exists outside of the enclave within the same application before it shares any information. Through the attestation process, information is kept confidential and data leakage is prevented. For more information about attestation with Intel SGX, see Attestation with Intel SGX and Data Center Attestation Primitives (DCAP).

Confidential computing with SGX use cases

The following are some of the use cases for confidential computing with SGX.

• Confidentiality and Privacy of Workloads and Applications within a Confidential Computing environment make sure that data privacy and security applications are always protected.

• Confidential AI and Analytics enable data and business analytics applications, machine learning models, and applications within secure enclaves. Includes SMPC applications that also help gain data insights.

• Secure Multi-party Compute enables distributed SMPC, where participants are ensured that their data and insights are protected even when calculated outside their direct control.

• Digital Assets is the trusted platform for digital custody solutions, for storing and transferring high-value digital assets in highly secure wallets, reliable at scale.