[MUSIC]
>> Well, everybody, Seth Juarez here.
A familiar face in the Azure family joins me now,
Chief Technical Officer Mark Russinovich. Mark?
>> Seth.
>> What's going on? You haven't
invited me to the family barbecue since,
let me see, never.
>> Well, I was going to invite you this Build,
but when you hinted me up to Rick, I was like -
>> He was on with Rick yesterday and I was like,
"Why don't I get to talk to Mark?"
So I diva'd my way into this.
Mark, it's been a number of years since
we've talked about Azure Confidential Compute.
We did a couple of Channel 9 videos, remember,
on Confidential Compute, we did some with blockchain,
can you catch us all up on what's new?
>> Well, we've been working on confidential computing
since about 2014.
Tight collaboration with Microsoft Research,
who had already started working
on exploring confidential computing.
This year has been a breakthrough
year when it comes to
confidential computing technologies and
services that we've been offering.
A key one in the hardware space is that we've been
offering SGX servers in
our datacenters now for a couple of years,
last year we went GA with them.
Intel's releasing new servers this year that
have gigabytes of encrypted memory,
as opposed to the hundreds of megabytes in
the current generation, the preceding generation.
That's going to unlock
a whole lot of workloads that are going to
really have great performance
inside of enclaves on SGX.
We also have this amazing announcement
from AMD of confidential virtual machines.
Unlike the enclaves,
these confidential virtual machines, or
SMP it's called in AMD's hardware,
allows you to run a full virtual machine
OS unmodified on top in a confidential encrypted memory.
Those are two key hardware things that we've got.
From a software perspective,
we've been releasing a bunch of new capabilities,
including some announcements here at Build.
>> This is cool stuff, and I don't
think people understand like,
what is it actually mean that it's hardware secured?
We want to spend a little bit of time in this.
I don't think people understand what that means.
>> The core of this confidentiality
is something called an enclave,
where an enclave is a protected region of the CPU,
protected by the hardware,
the very core of the hardware.
As the CPU actually starts up,
it can protect a region of the memory of the CPU,
as well as the control registers of the CPU,
such that only certain code can
run inside that enclave and have access to it.
Anything looking from the outside is just going to see
encrypted contents and have
no ability to modify what's going on inside.
This is the place where you can have your data,
very sensitive data, effectively be
encrypted wallets and uses the way that we frame it.
>> This is really cool. It's like having
the special secret room
inside of your machine where all the data,
all the compute is
literally encrypted. Am I getting this right?
>> That's effectively it.
>> I dumbed it down just for me, Mark.
Now, are people using this?
>> We've got a whole bunch of customers using it,
like MobileCoin is using it on top of Azure.
One of our key customers,
one of the largest consumers of
confidential computing services on Azure is Signal.
>> That's actually interesting.
Now I know you have a video
for our Signal that's showing the use.
Can we play that? Let's cue that
up and let's react to it right after.
[MUSIC]
>> Signal is a nonprofit organization
dedicated to global privacy and communication.
Our flagship product is Signal Messenger,
which is a secure,
end-to-end encrypted messaging app.
It's used all over the world
by all kinds of different people.
>> At the heart of it all,
we believe that the data we're
protecting is your data and not our data.
In the beginning of this year, we ended up on
the number 1 position on
app stores in more than 70 countries across the world.
>> When things really took off,
we really did see the load on our systems begin to spike,
in particular, our confidential computing systems were
really under a lot of strain and
we needed to add capacity fast.
>> The easiest determining factor for
us in making the decision to move to
Azure Cloud exclusively for the services was
the simple availability of computing resources.
>> Azure Confidential Computing
really helps us deliver what our users need,
which is transparent
privacy-preserving communication.
Some of the biggest benefits we've seen are
the ability to scale dynamically,
quickly, and with little notice.
That takes a lot of pressure off our ops teams.
It means we can respond to surges in demand quickly,
and that is a really, really powerful thing.
>> We build on trust as the core of
everything that brings people to
Signal and how we operate our service.
>> Signal can't read your messages,
we don't know who your contacts are.
Azure allows us to build and
deploy the systems that make that possible.
>> People who use Signal
see their data is roomed, it is then encrypted.
It only exists on their device
and the device of the recipients
receiving the information.
The abilities rely on a trusted partner or vendor that
can do all that for us at
the scale with the global footprint that we need,
it is one of the ways in which Microsoft helps us best,
and I'm excited for
continuing to ride going forward as we
continue to see more interests
and rapid growth in Signal.
>> Mark, this is really cool
because it just occurred to me,
as I was watching,
I was looking at the hardware on a single box.
But now let's talk about scale and
security both and how it helps Signal.
>> Well, one of the benefits of
a Cloud provider like Azure is
that we know how to scale quickly.
When they have this demand surge,
they contacted us, we worked with them.
How many servers do you need?
We got them deployed really quickly so that, basically,
we were able to meet the demands of
their huge growth that they experienced.
>> I remember downloading it recently,
the actual app, and it felt, like, smooth as butter,
and the fact that no one can see what I'm
doing or they even know what I'm doing is amazing.
There's got to be some Azure
goodness and engineering to be
able to scale that out well and still maintain security.
>> Yeah, absolutely. Basically, there's
the raw hardware capabilities which you're
talking about here in the case of Signal,
but we've got a bunch of other customers that are
using confidential services that are
built on top of that confidential hardware to
unlock really cool scenarios.
Like RBC, is one of our key customers that
we've been partnering with over
this journey towards confidential computing.
It's created something called a virtual clean room,
where they allow multiparty computation.
Its ability for merchants, customers,
and the banks to mix data
together with none of them having any access to
each other's data but being able to perform
analytics machine learning on that data to
be able to give customers better offers,
for example, that are tailored
for exactly what they're doing.
Talking about other services that customers make use of.
Here at Build, we announced Azure Confidential Ledger
and Azure SQL Database ledger,
which can be deployed onto that confidential ledger.
What that gives you is this tamper-proof record of
everything that's happened with
your SQL database that you can go verify this data,
that SQL database and ensure
that nothing's been tampered with.
If somebody comes to you and says, "Hey,
that transaction never really happened,'' you can go
back into the ledger and verify
whether that's really true or not.
>> This is amazing. Where can people go to find out more?
We got 10 seconds.
>> Well, confidential computing?
There's a confidential computing resource
right on Microsoft Learn
documents that will provide
you overview of what's going on.
Of course, the Build announcements.
Build will have pointers to
Azure Confidential Ledger as well
as the SQL Database ledger.
>> Awesome. Well, Mark, always
a privilege and a pleasure to talk to you.