Microsoft Azure confidential computing keeps data in use secret

Microsoft has announced a new Azure (cloud) data security capability: confidential computing.

Who’s it for?

The capability allows companies to use the cloud even if they don’t completely trust the cloud service provider and administrators.

Confidential computing is aimed at companies that need to safeguard very sensitive information (user data or company data/intellectual property), but still need to regularly analyze and use it.

This can include, for example, financial companies who want to keep personal portfolio data and wealth management strategies secret, or healthcare organizations that want to collaborate but still need to keep their private patient data confidential.

“Confidential computing ensures that when data is ‘in the clear,’ which is required for efficient processing, the data is protected inside a Trusted Execution Environment (TEE – also known as an enclave),” Mark Russinovich, CTO at Microsoft Azure, explained.

“TEEs ensure there is no way to view data or the operations inside from the outside, even with a debugger. They even ensure that only authorized code is permitted to access data. If the code is altered or tampered, the operations are denied and the environment disabled. The TEE enforces these protections throughout the execution of code within it.”

The cornerstones for Azure confidential computing

The hardware and software technologies Azure confidential computing makes use of have been developed by Intel and Microsoft in the last four years or so. They include:

• Haven, a system for shielded execution of unmodified legacy applications in the cloud
• A design and verification methodology for secure isolated regions
• VC3, a system that allows users to execute computation in the cloud while keeping the code and data secret
• Privacy-preserving multi-party machine learning for collaborative data analytics that guarantees the privacy of the used datasets.

Currently on offer

For the moment, customers can try out Azure confidential computing through the company’s Early Access program. Also, only two TEEs are currently supported.

“Virtual Secure Mode (VSM) is a software-based TEE that’s implemented by Hyper-V in Windows 10 and Windows Server 2016. Hyper-V prevents administrator code running on the computer or server, as well as local administrators and cloud service administrators from viewing the contents of the VSM enclave or modifying its execution,” Russinovich explained.

“We’re also offering hardware-based Intel SGX TEE with the first SGX-capable servers in the public cloud. Customers that want their trust model to not include Azure or Microsoft at all can leverage SGX TEEs. We’re working with Intel and other hardware and software partners to develop additional TEEs and will support them as they become available.”