[MUSIC PLAYING]
NELLY PORTER: Welcome to the "Google Cloud Security
Showcase," a special web series where
we'll focus on security use cases
customers can solve with Google Cloud.
My name is Nelly Porter, and I'm Product Manager Lead
at Google Cloud, working on Confidential Compute.
Today, we will be talking about how
you can protect the confidentiality
of your workloads while they are in GCP.
We understand that it is a challenge
to protect your sensitive workloads and sensitive data
from sophisticated adversaries or accidental data leakage,
and encryption is a common method
to limit the exposure of your sensitive data in the cloud.
Confidential computing is a way to protect your data
when it is processed or in use.
Today, GCP introduces the first confidential computing product,
Confidential VM.
Let me show you how easy you can create a Confidential
VM in Google Compute Engine.
Let's create Confidential VM.
For this purpose, all that you need
to do to give it a name, and it will discover a new option,
Confidential VM Service.
Let's check this magic checkbox.
And you see that we will select All Configuration for you
and enable it on your Confidential VM.
And now all what you need to do to click Create,
and this spin up a Confidential VM.
Let me show you that it's really confidential.
And it means let's SSH to this VM
and check the hardware that it's running on.
And if it will do that, we will see
that it's running on AMD servers with
secure encrypted virtualization extension enabled.
And it means your VM is memory encrypted
and your sensitive data and code fully protected.
By clicking a simple checkbox, you transform your VMs
into Confidential VMs.
VM memory is encrypted by a key per VM generated in hardware
by AMD secure processor.
And the key is ephemeral, and not extractable.
It means even Google do not have access to the keys.
You might ask, is encrypting memory expensive
and will hurt my performance?
The answer is, we're focused on making
Confidential VM performant.
There's very low latency.
And based on all of the benchmarks,
we are not more than 2% to 6% slower than non-Confidential VM
on the same hardware.
Let me show you a performance comparison between Confidential
and non-Confidential VM, so you can decide for yourself.
Let's compare performance of Confidential
and non-Confidential VMs, and we will start from boot time.
Let's spin up two VMs simultaneously and see
which one will finish first.
As you will see, non-Confidential VM
will come first, and Confidential VM will follow.
The next, we will check memory access performance.
And for this purpose, we will put
Confidential and non-Confidential VM side
by side.
We'll use SysBench to validate memory's throughput.
And we will go with memory read first, memory read sequential.
Since we're looking into memory throughput,
the bigger number is better.
And as test will compete, you will see
the result is very promising.
Memory throughput is comparable.
Let's move to memory write, random write.
And once again, we're talking about memory access.
And throughput is the most interesting number
we're looking for.
Memory throughput is comparable for Confidential
and non-Confidential VM.
We believe that memory performance
of both Confidential and non-Confidential
are comparable, and highly recommend
you to validate your performance and see by yourself.
For the first time, our customers
can finally keep sensitive data encrypted
during its entire lifecycle, from ingestion to storage,
and now even during processing.
Thank you for tuning in.
Please visit our page for more content from Google Cloud
experts.
[MUSIC PLAYING]