“Confidential Computing” is an up-and-coming model in which a user (e.g. cloud customer) trusts a hardware vendor (e.g. Intel, AMD, nVidia), and that vendor has a mechanism by which systems with their hardware can run user code and attest, remotely, to the user that the code has not been tampered with and that the system’s owner (e.g. Amazon) is not exfiltrating user data.
This could be used for DRM or nefarious purposes, but that’s not the point.
Obviously this is no more secure than the underlying hardware. All the attacks against SGX, for example, will still apply unless they are fixed.
This kind of thing has a history, eg this was on top of the TPM platform: https://web.archive.org/web/20060822043633/http://www.hpl.hp...
I wonder what's different this time.
Confidential computing lets you reduce your TCB to the software running in your guest, be that a full OS like Linux or maybe some unikernel type thing, and the hardware itself. The intent is that a malicious host could not read or modify guest state, though of course they could simply refuse to schedule it.
While I can totally imagine that being true, I imagine this is probably more a response to cloud providers wanting to subdivide each physical GPU into virtual/multi-tenant GPUs.
They'll want to be able to provide strong security guarantees to customers who're renting compute on a multi-tenant GPU and are pushing their sensitive data onto it
I have a sneaking suspicion that somewhere in an NSA datacenter there will be racks upon racks of these things running transformers over every text message and voice call coming from certain regions...