Confidential computing

[6] In their various implementations, TEEs can provide different levels of isolation including virtual machine, individual application, or compute functions.

The attestation process assesses the trustworthiness of a system and helps ensure that confidential data is released to a TEE only after it presents verifiable evidence that it is genuine and operating with an acceptable security posture.

[22][23] The additional security capabilities offered by confidential computing can help accelerate the transition of more sensitive workloads to the cloud or edge locations.

Using confidential computing, only the workload owner holds the encryption keys required to decrypt data for processing inside a verified TEE.

[31] This provides a technological safeguard that reduces the risk of data being exfiltrated and processed in plaintext in other countries or jurisdictions without the workload owner's consent.

Multiple academic and security research groups have demonstrated architectural and side-channel attacks against CPU-based TEEs based on a variety of approaches.

[3] These include page faults,[34] caching,[27] and the memory bus,[35] as well as specifically Æpic[36] and SGAxe[37] against Intel SGX, and CIPHERLEAKS[38] against AMD SEV-SNP.

Update mechanisms in the hardware, such as Trusted computing base (TCB) recovery, can mitigate side-channel vulnerabilities as they are discovered.

[45] Several researchers have described use cases where confidential computing TEEs and FHE work together to mitigate shortcomings of the technologies acting individually.

However, Trusted Computing targets a different set of threat models and large variety of platforms (e.g., phones, laptops, servers, network equipment);[50] confidential computing addresses attack vectors that target confidentiality and integrity of code and data in use, notably through the use of Trusted Execution Environments and memory encryption.

Confidential computing use cases require a combination of hardware and software, often delivered in conjunction with cloud service providers or server manufacturers.

The founding premiere members were Alibaba, Arm, Google Cloud, Huawei, Intel, Microsoft and Red Hat.

The founding general members included SUSE, Baidu, ByteDance, Decentriq, Fortanix, Kindite, Oasis Labs, Swisscom, Tencent and VMware.

[83][84] The CCC states its efforts are "focused on projects securing data in use and accelerating the adoption of confidential computing through open collaboration.