Linux Foundation Organization on the establishment of a consortium , aimed at developing open technologies and standards related to secure data processing in memory and confidential computing. Companies such as Alibaba, Arm, Baidu, Google, IBM, Intel, Tencent, and Microsoft have joined the collaborative project, intending to advance technologies for data isolation in memory during computations on a neutral platform.
The ultimate goal is to provide means for maintaining a complete cycle of data processing in encrypted form, without exposing information in clear text at any stage. The consortium's interests primarily focus on technologies related to the use of encrypted data during computations, specifically the use of isolated enclaves, protocols for , manipulation of encrypted data in memory, and full isolation of data in memory (for example, to prevent host system administrators from accessing data in the memory of guest systems).
For independent development within the Confidential Computing Consortium, the following projects have been transferred:
- Intel has transferred previously open
SGX Microsoft has transferred the framework - Open Enclav , AMD PSP (Platform Security Processor) and AMD SEV (Secure Encryption Virtualization). Red Hat has transferred the project
- Enarx , providing an abstraction layer for creating universal applications to run in enclaves that support various TEE environments, independent of hardware architectures, and allowing the use of multiple programming languages (utilizing a WebAssembly-based runtime). Currently, the project supports AMD SEV and Intel SGX technologies.
Among the overlooked similar projects, one can highlight the framework , which is primarily developed by Google engineers, but an officially supported Google product. The framework allows for easy adaptation of applications to offload parts of their functionality requiring enhanced protection to a secure enclave. Among the hardware isolation mechanisms in Asylo, only Intel SGX is supported, but there's also a software mechanism for enclave formation based on virtualization.
Let us recall that an enclave (, Trusted Execution Environment) implies that the processor provides a special isolated area that allows offloading part of the application's and operating system's functionality into a separate environment, the contents of which are inaccessible from the main system, regardless of the privilege level. Various encryption algorithms, closed key and password handling functions, authentication procedures, and code for working with confidential data can move into the enclave for execution.
In case of compromise of the main system, an attacker will not be able to determine the information stored in the enclave and will be limited only to the external programming interface. The use of hardware enclaves can be considered an alternative to employing encryption-based methods for protecting computations encryption or , but unlike these technologies, the enclave has virtually no impact on the performance of computations with confidential data and significantly simplifies development.
Source: opennet.ru
