Confidential computing protects sensitive data while it is being processed. Traditional encryption secures data at rest and in transit, but usually exposes plaintext in memory. Trusted execution environments (TEEs), or enclaves, use CPU-supported memory encryption to protect data in use from threats outside the enclave, including the hosting environment. section 9.2.1
A confidential-computing design typically relies on these ideas:
- Load sensitive inputs and proprietary models into an enclave hosted by an otherwise untrusted server. section 9.2.1
- Run the computation inside the TEE so the hosting environment cannot inspect the protected inputs during processing. section 9.2.1
- Use WebAssembly’s minimal, language-agnostic runtime to keep the trusted computing base small and support multiple tenants in constrained secure environments. section 9.5
- Match the design to hardware-backed capabilities such as Intel SGX, AMD SEV, ARM TrustZone or CCA, and RISC-V Keystone. section 9.2.1
Training an AI model on protected hospital data
An institution keeps its proprietary model private, while a hospital cannot disclose patient records. Loading both into an enclave allows the model training computation to run without exposing either input to the hosting environment. section 9.2.1
Figure 9.2 The three states of data: at rest, in transit, and in use. Each state represents a potential point of vulnerability where data can be exposed or compromised if not properly protected.
Use the three-state model to distinguish protection for data at rest, data in transit, and data in use. section 9.2.1
