- Hi everyone.
My name is Iris Kaminer and I'm a program manager
for Azure Data Explorer, also known as ADX.
Today I'll be talking about the Azure Data
Explorer Confidential Computing Solution.
Azure Data Explorer is a high performant, fully managed
Azure service that allows customers to run analytics
on really large volumes of data,
and is optimized for interactive ad-hoc queries.
Azure Data Explorer works best with time series data,
such as monitoring data, logs, metrics,
and telemetry streaming data.
It supports structured data, semi-structured data,
such as JSON, and unstructured text data,
including full text index search.
With Azure Data Explorer, users can analyze petabytes
of information in just seconds by analyzing structured,
semi-structured and unstructured data across
type series and leveraging machine learning,
ADX makes it really simple to extract key insights
from your data.
Built for real-time, the platform provides a great number
of high speed data ingestion options to stream in
fast flowing data, with as little as a few seconds delay
after ingestion.
ADX ingest data in a distributed fashion
and handles both streaming ingestion and bulk ingestion.
ADX features an intuitive, simple, and logical querying
language called Kusto Query Language, or in short, KQL,
that enables data engineers, data scientists,
and even business analysts to perform
big data analysis independently.
There are today over 350,000 users querying data
using KQL.
Azure Data Explorer has been a key component in
Microsoft's digital transformation and is largely
adopted both internally in Microsoft, and across many
companies and independent software vendors, ISVs.
Now that you have an overview of ADX, let's discuss
how confidential computing adds value to our solution.
Looking at existing encryption technologies
that are in organizations, we see that most organizations
are already encrypting their data at rest,
encrypting their data stored on disk.
We also see that most organizations are encrypting
their data in transit, using popular protocols such as TLS.
What is missing in most organizations is the encryption
of data stored in the virtual machine's memory.
Here is where Azure Confidential Computing comes into play.
ADX Confidential Solution is based on
the AMD EPYC SEV-SNP technologies.
These technologies add an advanced level
of security for virtualized environments.
SEV stands for Secure Encrypted Virtualization.
This technology encrypts all data found in the memory
of the virtual machine when it is saved to disk
or transmitted over a network.
This helps protect the VM's data,
by preventing unauthorized access.
SNP stands for Secure Nested Paging.
This technology supports a hierarchical paging model
that allows only the administrator of a virtual machine
to access the memory of his virtual machine.
This creates an isolated memory region
within each virtual machine that is inaccessible
to other virtual machines and hypervisor administrator.
The AMD EPYC processors also supports a secure
boot process, which ensures that the system
only boots from trusted software.
The confidential computing solution for ADX,
Azure Data Explorer, adds additional protection use cases.
Let's review some key use cases.
The first use case is protection from other malicious
VMs hosted on the same machine.
By isolating the memory of each VM on the host,
the malicious virtual machine actor does not have access
to the memories of the other VMs stored on the same host.
A second use case is the virtual machine's protection
from malicious behavior of a hypervisor administrator,
or even a cloud administrator.
With confidential computing, these administrators
don't have access to the memory of the virtual machines.
This prevents attackers from accessing sensitive data,
or executing malicious code within the virtual machine.
A third use case about protect is about protection from
physical attacks, meaning attacks from people
that have physical access to the host machine.
Here too, the VM's memory is encrypted, so a person with
physical access to the machine is not able to read
the memory of a virtual machine.
In addition, confidential computing technologies
is required to meet different compliance requirements,
such as those mandated by GDPR and HIPAA requirements.
The ADX Confidential Computing Solution is based
on the AMD Azure Confidential SKU.
The recommended SKU for Azure Data Explorer
is the ECasv5 SKU family.
To create a confidential Azure Data Explorer cluster,
simply select an ECasv5 SKU during cluster creation.
It's as simple as that.
In addition, if you wish to migrate an existing ADX cluster
to a confidential SKU, all you need to do is
select a confidential computing SKU as the target SKU.
There's no code changes that are required
in order to support this migration.
It is a lift and shift, simple migration experience.
Most customers who adopt confidential computing SKUs
will also encrypt their data using customer managed keys,
CMK Key.
In case the ECasv5 SKU family is selected,
the CMK Key will be used to encrypt the data of the storage,
but also, the data of the SSD's attached premium disk.
You can use either ARM or the Azure portal to deploy
or migrate to a confidential computing cluster.
So to which customer's verticals are we targeting
the ADX Confidential Computing Solution?
The financial sector is the leading vertical
spearheading confidential computing adoption,
and they have stripped compliance regulations
of how to store highly confidential data.
But actually, any company that manages highly
confidential data, such as government agencies,
or healthcare companies, will highly benefit from
confidential computing technology.
Now, I will present a short demo on how to create
an ADX Confidential Computing Cluster using the portal.
In a demo, I'll create an ADX Confidential Cluster
with CMK encryption, using user assigned identity.
In this demo, I'll use the portal to
first create a confidential computing ADX cluster.
After, I will go and configure the cluster to use
a CMK key for encryption.
As a prerequisite, you first need to have or create
a key vault and assign it a user managed identity.
Here you see that I have a key vault
called irisconfidentialkeyvault.
I have granted access to this key vault to our user managed
identity called irisconfidentialuseridentity.
Now let's go and create the confidential cluster.
So first, I need to select a resource group,
and give the cluster a name.
I then need to go and select a region, note that currently
not all regions support confidential SKUs,
so you would need to check in Azure
Confidential Computing Documentation to see the list
of supported regions.
In the demo, I will select east US,
as I know that this region supports confidential SKUs.
Next, I will go and select a confidential SKU
for the cluster.
I will open the SKU list page
and select a confidential SKU.
You can identify if a SKU is confidential
by this lock icon presented next to the SKU name.
I will now select a confidential SKU,
and that's it.
Now I can go review and create my cluster.
Once the cluster has been created, I will go
and open the encryption blade of the newly created
confidential cluster.
Here I will first enable the customer managed key.
I will then go and select the key from the Azure key vault
that I previously created.
I will then select the key,
and apply.
Now I will assign a user managed identity to the cluster.
I will select the user managed identity that
I have previously given access to the key vault.
Now I will save.
And that's it.
Now I have a confidential ADX cluster that is
using a CMK key to encrypt the cluster's data.