Confidential Computing.

Confidential computing closes the last gap in data protection: encryption in use. Workloads run inside a TEE — a CPU-enforced enclave whose memory is encrypted and integrity-checked, so neither the hypervisor, the host operating system, nor a privileged cloud administrator can read the plaintext. Remote attestation is the linchpin: before sending data or keys, a client verifies a hardware-signed quote describing the exact code measurement and microcode version running inside the enclave. The concept is governed by the Confidential Computing Consortium, formed under the Linux Foundation in 2019. Hardware backends include Intel SGX, Intel TDX, AMD SEV-SNP, Arm CCA, AWS Nitro Enclaves, Azure Confidential VMs, and Google Confidential Computing.

TEEs are not a silver bullet, and their history is a reminder that side channels bypass memory encryption. Foreshadow / L1TF (CVE-2018-3615, 2018) used speculative execution to read SGX enclave secrets from the L1 cache, defeating attestation until microcode and OS patches shipped. Plundervolt (CVE-2019-11157, 2019) did the complement: by dynamically undervolting the CPU it injected faults into SGX-protected computations, corrupting multiplications and RSA/AES operations to leak keys. Robust designs therefore combine confidential computing with least privilege, patched microcode, minimal enclave code, and short-lived attested keys.

flowchart TD
  W[Workload deployed into TEE] --> M[CPU measures code and microcode]
  M --> Q[Hardware signs attestation quote]
  Q --> V{Client verifies quote}
  V -->|trusted| REL[Release keys and data to enclave]
  V -->|mismatch| DENY[Refuse to provision secrets]
  REL --> ENC[Encrypted and integrity-checked enclave memory]
  ENC --> P[Process plaintext, invisible to host and operator]