I do not send my dog alone to the park But I do send all my data, my IP,
my models to run in the cloud. Well, you sometimes just must use the cloud,
AI models are just getting bigger and compute hungry.
And not to mention the data sizes
The desire of all of us to work at higher and higher levels of
abstraction only means that the software stacks
underneath are getting taller with so many
components from so many providers that my attack surface is getting deeper.
A modern cloud is actually multiple devices,
clusters of not only CPUs, but all kind of accelerators,
and I want to be able to connect to the cloud from any possible device,
which only makes my attack surface wider, extended over multiple devices and networks.
We are starting to use Artificial intelligence for
almost anything we do... But so does the bad guys.
And I sometimes feels that I cannot outsmart people who are using these tools,
and this is even before quantum computing..
This is exactly why I believe confidential computing should start with the hardware,
by the people who knows the hardware best. Let’s talk about Intel® Trust Authority
Protecting my data “at rest” when it just resides in the memory,
and “in transit” when I transmit it over is usually easier
The main vulnerability is while the data is “in process”, when you use the data or your model,
it cannot be encrypted; it has to be open and in-use. And .. exposed
SGX, Intel Software Guard Extensions is designed
to provide a secure execution environment for applications,
So you basically have a set of HW instructions that can help you define enclaves,
protected and isolated region of memory where sensitive code
and data can be stored and executed in isolation from the rest of the system,
including the operating system.
SGX is probably the most deployed, most researched,
and most trusted execution environment available..
TDX, Intel Trusted Execution Technology allows to
provide such secured environment at the virtual machine level.
So you have a full hardware-isolated virtual machine or a trusted-domain.
These VMs, these Trusted execution environments are isolated from the
cloud host, from the hypervisor and other VMs on the platform.
On top of that, you need someone, not the infrastructure provider,
someone neutral and trustworthy who can provide attestation across clouds, premises, and the edge.
Not only for a specific cloud environment,
but for all your workloads that might be deployed .. well, anywhere..
The attestation process basically establishes the trust you need.
and ensures that you are executing the right
application on the right SW stack, on the right hardware
Without being compromised, Before you release your data or application to be executed.
So top to bottom secured, attested private like environment inside the public cloud..
And this is done by Intel® Trust Authority
Let me try to visualize it a little..
There are of course many use cases, here is an example..
We have an application, the AI model, parameters, algorithms, they are all our secrets.
And we would like to keep it that way. Even though it will all run in the cloud,
on the edge, or anywhere in between
At the lower level, we are using an enclave, protected by SGX.
And it means you do not have to trust ALL the system,
but only the enclaves, so the attack surface is smaller
And we are using TDX to create full virtual-machine level secure environment
But… all your data is still encrypted. And will
wait for approval before it begins any execution.
The application will get the evidence from the hardware,
and will send it to Intel® Trust Authority.
Intel® Trust Authority is configured to communicate directly with your cloud
environment and has all the details of the Trusted Execution Environments and your application.
Intel® Trust Authority then provide the attestation token to the application,
basically verifying that the hardware, the software stack on top,
it is all matching our expectations and no malware,
third party or anyone has tampered with them.
Now that the system is verified,
the application can send the decryption key to the cloud, into the TDX environment
Our AI model can be decrypted, and execution of the workload can begin.
So silicon-based. private, secure, verified by Intel® Trust Authority execution environment,
anywhere
Check out my other video on how to get started with confidential Computing on Intel Xeon CPUs.
And check the links below for more information,
Thank you