Confidential VM
A Confidential VM is a rented computer in someone else's data center whose memory is encrypted by the processor. This means even the operator of the data center cannot see what data is being processed inside it.
Anyone running software today usually no longer buys their own computers for it. Instead, you rent computing power from major providers like Amazon, Microsoft, or Google. Technically, you don’t get a whole machine there, but a virtual machine: a separated section on a real server that behaves like its own computer. Other customers' virtual machines run simultaneously on the same server. A Confidential VM is such a virtual machine with an additional layer of protection: the processor encrypts its working memory in such a way that not even the server’s provider can read the content. The customer therefore has to trust the operator less than before.
Why you don’t want to blindly trust the cloud provider
Data has traditionally been protected at two points. While traveling through the internet, it is encrypted — that’s the lock symbol in the browser. On the hard drive, it is likewise encrypted. It is unprotected at only one moment: while it is actually being processed. That’s because, to compute, the processor needs the data lying in plaintext in working memory. This is precisely the gap that Confidential VMs close.
Whoever can read a server’s working memory sees everything. That could be an administrator at the provider who has too many privileges. It could be an attacker who has taken over the server’s management software. And it could be a government authority forcing the provider to hand data over. With a Confidential VM, all three only get to see encrypted digital garbage.
This is practically relevant above all for hospitals, banks, and government agencies. Legally, they are only permitted to process certain data if no unauthorized party can access it. Without this technology, they were often left with only their own server room. AI companies, too, are increasingly using Confidential VMs, because customers are reluctant to send their company documents to someone else’s data center.
Encrypted memory and a proof of authenticity from the chip
The technology sits in the processor itself. Modern server chips from AMD, Intel, and ARM have a built-in unit that generates and keeps a key. Every time data is written from the processor into working memory, this unit automatically encrypts it. When reading it back, it decrypts it again. The key never leaves the chip and is invisible to the provider’s operating system.
That alone would make the promise worthless. After all, the customer would just have to believe that the provider has really switched on the protection. That’s why there is a second component, so-called attestation. The processor issues a cryptographically signed report stating exactly which software was started in the protected environment. The customer can check this report before even sending their data in at all. The signature comes from the chip manufacturer, not from the cloud provider.
A common misconception is that a Confidential VM solves all security problems. It protects against the environment, not against one’s own software. If the application inside has a security vulnerability, the encrypted memory does not help. The technology also costs performance, a few percent depending on the application. And researchers have repeatedly found weaknesses in individual chip generations.
In cloud offerings and AI services
All major cloud providers now sell the technology as a standard option. When creating a virtual machine, you simply select a machine type with the “Confidential” suffix. The surcharge is usually small, and the application itself typically does not need to be rewritten. This is exactly what explains its rapid spread.
In news reports, the term often comes up in connection with AI. Apple, for instance, advertises its “Private Cloud Compute” with comparable ideas: requests that the iPhone cannot answer on its own run in an isolated environment. Providers of graphics processors for AI are also working on extending the protected area to the graphics card. That’s where the actual model data resides.
Related, but narrower, is the term enclave. An enclave protects only a single part of a program, whereas a Confidential VM protects an entire operating system. The umbrella term for both is Confidential Computing. Anyone who comes across these words in a product announcement can now place them correctly.