Azure Confidential Computing and Zero Trust

Foreword

Traditional systems encrypt data at rest and in transit, but they could not encrypt data while it is in use. Confidential computing extends data protection to data in use in memory, enabling protection throughout the entire data lifecycle and adding another layer of defense, enhancing intellectual property (IP) protection, data privacy, and data integrity. This is especially critical today, as the exponential growth of datasets and the machine learning software for analyzing those datasets have led to increased scrutiny of how data and code are exposed.

Confidential computing protects data in use by isolating data within a trusted execution environment (TEE), which is like a sealed box for data processing. From the outside, the data appears encrypted, and it is only decrypted inside the TEE once it is verified by the key holder. This isolation is rooted in hardware, effectively rendering even the cloud-hosting infrastructure and its administrators incapable of accessing the data.

This means that services can be designed with zero trust in mind. They can segment data based on least-privilege access principles. For example, data may be accessible only to the code that needs access to perform its function, while all other code in the system sees only encrypted data. Least privilege access isn’t the only way confidential computing enforces zero trust principles. Zero trust also includes the ability to attest the proper state of the hardware and software within the TEE, thereby ...