Is your application ready for Confidential Computing?
An application-centric view of confidential computing
In this article, I’ll briefly discuss the different approaches to confidential computing and its implication for your application design.
Quick Recap
In simple words, you can think about confidential computing as a means of creating a specific location (a TEE) in memory, where anything inside this location is inaccessible to the entities outside this location.
A Trusted Execution Environment (TEE) is one of the building blocks of confidential computing, and the choice of TEE directly impacts your application design.
TEEs are secure and isolated environments that prevent unauthorised access or modification of applications and data while in use.
Currently, there are two types of TEEs.
Process-based TEEs
In the process-based TEE model, you must split the application into two components: trusted (secure) and untrusted. The trusted component resides in encrypted memory and handles confidential computing. In contrast, the untrusted component interfaces with the operating system and propagates I/O from encrypted memory to the rest of the system. Data can only enter and exit this encrypted region through predefined channels with strict checks on the size and type of data passing through.
Intel SGX (Software Guard eXtensions) is an example of a process-based TEE.
VM-based TEEs
In this model, VM memory is encrypted, and the hardware-based encryption keys protect the VMs and prevent interference by a malicious hypervisor or other VMs.
AMD SEV (SEV-ES/SEV-SNP), Intel TDX, IBM Secure Execution and PEF are examples of VM-based TEEs.
Impact of TEEs on your application
When using process-based TEE, you must split the application into trusted and untrusted pieces. Your existing application needs to be re-architected or ported to use confidential computing.
Before you start yelling, “Oh no.. not again”, let me tell you that the industry is working actively to avoid the need for application re-architecting.
Solutions exist today, allowing you to use process-based TEE with limited or no modifications to existing applications.
These solutions employ a library OS (libOS) to wrap the application and run it in TEE. An example library OS is Occlum; you can read more about Occlum here.
The following diagram explains where library OS fits in the overall stack.
Ref: https://cczoo.readthedocs.io/en/latest/LibOS/libos.html
The application deployment workflow for a non-containerised and containerised app looks like this with process-based TEEs.
Few things to keep in mind when using library OS.
- library OS support for production use
- Test and support responsibilities in this stack when using 3rd party ISV applications.
For VM-based TEEs, there is no need to split the application into trusted and untrusted components. You can run existing applications unmodified in a VM-based TEE which is great from an application developer standpoint, but there are tradeoffs. The process-based approach is more fine-grained compared to the VM-based approach. Consequently, the VM-based approach could be more resource-heavy. A more detailed comparison of the two approaches is available here.
The application deployment workflow for a non-containerised and containerised app looks like this with VM-based TEEs.
The Road Ahead
The different requirements for process and VM-based TEEs result in different requirements for applications and the container-based DevOps pipeline. To make the experience easier and reduce the load on the DevOps engineer, we are working towards a common technology stack under the CNCF confidential containers project.
Look at the high-level technology stack for containers using process and VM-based TEEs. The diagrams are sourced from the following page.
From the diagrams, you can infer the similarity of the technology stack. The goal is to have the confidential computing aspects within the enclave software stack, with minimal to no changes in the application design and development process. This should be a win-win for everyone and help improve the applications’ security posture.
Conclusion
I hope this blog gets you to start thinking about confidential computing from the view of application design.
Note: This blog first appeared here.
