Tech firms join forces to boost cloud security

The Linux Foundation has announced the formation of the Confidential Computing Consortium (CCC) to accelerate the adoption of confidential computing, promote its use at the enterprise level and drive global technical standards to simplify secure enclave development and deployment.

Founding members of the group – which unites hardware suppliers, cloud providers, developers, open source experts and academics – include Alibaba, Arm, Baidu, Google Cloud, IBM, Intel, Microsoft, Red Hat, Swisscom and Tencent.

According to the group’s founders, current approaches in cloud computing address data protection “at rest”’ and “in transit”, but encrypting data “in use” is considered the next and most challenging step to providing a fully encrypted lifecycle for sensitive data.

They believe hardware-based confidential computing will enable encrypted data to be processed in memory without exposing it to the rest of the system, and reduce exposure for sensitive data and provide greater control and transparency for users.

“The earliest work on technologies that have the ability to transform an industry is often done in collaboration across the industry and with open source technologies,” said Jim Zemlin, executive director at the Linux Foundation.

“The Confidential Computing Consortium is a leading indicator of what is to come for security in computing and will help define and build open technologies to support this trust infrastructure for data in use.”

Members of the CCC will work together to influence technical and regulatory standards and build open source tools for the development of trusted execution environments (TEEs), also known as secure enclaves, where data and operations are isolated and protected from any other software, including the operating system and cloud service stack.  

Intel is among the first founding members to announce open source project contributions. The chip maker will contribute is Software Guard Extensions (SGX) software development kit (SDK), which is designed to help application developers protect select code and data from disclosure or modification at the hardware layer by using secure enclaves.

“Software developed through this consortium is critical to accelerating confidential computing practices built with open source technology and Intel SGX,” said Imad Sousou, corporate vice-president and general manager, system software products at Intel.

Lorie Wigle, vice-president, Intel architecture, graphics and software, and general manager, platform security product management, said that although leaders in information and infrastructure security are well versed in protecting data at-rest or in-flight through a variety of methods, data being actively processed in memory is another matter.

“Whether running on your own servers on-prem, in an edge deployment, or in the heart of a cloud service provider’s datacentre, this ‘in-use’ data is almost always unencrypted and potentially vulnerable,” she said, adding that the CCC is dedicated to making confidential computing practices, such as the protection of data in-use, easier to adopt in a multi-cloud world.

“Combined with encrypted data storage and transmission methods, TEEs can create an end-to-end protection architecture for your most sensitive data,” said Wigle.

“Companies that wish to run their applications in the public cloud, but don’t want their most valuable software IP visible to other software or the cloud provider, can run their proprietary algorithms inside an enclave.

“Multiple untrusted parties can share transactions but protect their confidential or proprietary data from the other parties by using enclaves. Any time that sensitive data is in use, there may be an opportunity to use confidential computing to protect it better.”

Under the EU’s General Data Protection Regulation (GDPR), cloud service providers are required to ensure data is secure, said Richard Curran, chief security officer, global cloud, enterprise and government group sales at Intel.

“The GDPR is also encouraging CSP customers to demand more in terms of security, so Intel is moving to a security-by-design philosophy and, together with Arm, we will have to commit to ensuring that we help the industry move along in its transition to a far more secure environment that is secure by design and bounded by hardware,” he told Computer Weekly.

“We are now seeing greater industry collaboration, not to find a silver bullet that solves all security issues, but to make it easier for people to ensure that their data is protected.”

Curran added that all those who have signed up to the CCC have realised the importance of hardware-based security as threats become more evasive and more difficult to trace and find, and the impact is more severe.

Intel SGX is currently available on the Intel Xeon processor E-2100 family, and is used in confidential computing services from Microsoft Azure, IBM Cloud Data Guard, Baidu, Equinix and Alibaba Cloud.

SGX is currently available on single-socket servers, but Intel plans to release a PCI-Express add-in card that combines three CPUs to enable Intel SGX in multi-socket Intel Xeon Scalable servers in the fourth quarter of 2019. Intel also plans to roll out SGX across mainstream Xeon platforms in coming generations, guided by input from CCC members and associate members.

“Already got a number of projects and pilots where people are ready to put these types of [PCI] cards into a multi-socket system, and what the industry wants is for us to move to mainstream servers and that will happen in 2020,” said Curran. “So there is a lot of work being done in that area.”

Alibaba launched Alibaba Encrypted Computing technology, powered by Intel SGX, in September 2017 and has provided commercial cloud servers with SGX capability to customers since April 2018.

Xiaoning Li, chief security architect at Alibaba Cloud, said: “Confidential computing provides new capabilities for cloud customers to reduce trusted computing base in cloud environments and protect their data during runtime. We are very excited to join CCC and work with the community to build a better confidential computing ecosystem.”

Microsoft is to contribute Open Enclave SDK, an open source framework that allows developers to build TEE applications using a single enclaving abstraction that will run across multiple TEE architectures.

“The Open Enclave SDK is already a popular tool for developers working on TEEs, one of the most promising areas for protecting data in use,” said Mark Russinovich, chief technical officer at Microsoft. “We hope this contribution to the CCC can put the tools in even more developers’ hands and accelerate the development and adoption of applications that will improve trust and security across cloud and edge computing.”

Intel’s Imad Sousou added: “Combining the Intel SGX SDK with Microsoft’s Open Enclave SDK will help simplify secure enclave development and drive deployment across operating environments.”

Red Hat will contribute its Enarx platform for abstracting TEEs to enable developers to create and run “private, fungible, serverless” applications.

Chris Wright, senior vice-president and CTO at Red Hat, said: “While hardware support for security continues to advance, creating secure computing environments can still be challenging. We are developing the Enarx project to help developers deploy applications into computing environments which support higher levels of security and confidentiality and intend to bring it to the CCC.

“We look forward to collaborating with the broader industry and the CCC to help make confidential computing the norm.”

The proposed structure for the CCC includes a governing board, a technical advisory council and separate technical oversight for each technical project. The CCC is intended to host a variety of technical open source projects and open specifications to support confidential computing, and will be funded through membership dues.