Confidential
Computing:
Hardware-Based
Trusted Execution forApplications and Data
A Publication of The Confidential Computing Consortium
November 2022, V1.3

confidentialcomputing.io

Introduction
Today, data is often encrypted at rest in storage and in transit acrossthe network, but not while in use in memory. Additionality, the ability toprotect data and code while it is in use is limited in conventional computing
infrastructure. Organizations that handle sensitive data such as PersonallyIdentifiable Information (PII), financial data, or health information need tomitigate threats that target the confidentiality and integrity of either theapplication or the data in system memory.

Confidential Computing protects data in use by performing computation in a
hardware-based, attested Trusted Execution Environment. These secure andisolated environments prevent unauthorized access or modification of
applications and data while they are in use, thereby increasing the security levelof organizations that manage sensitive and regulated data.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

2

2

Confidential Computing ConsortiumWhy the need for confidential computing
States of data

Security risks for unprotected data
“in use”

In computing, data exists in three states: in transit,
at rest, and in use. Data traversing the network is “inAs threat vectors against network and storagetransit,” data in storage is “at rest,” and data being

devices are increasingly thwarted by the protections

processed is “in use.” In a world where we arethat apply to data in transit and at rest, attackers

constantly storing, consuming, and sharing sensitive

have shifted to targeting data-in-use. The industry

data - from credit card data to medical records, from

witnessed several high-profile memory scraping,firewall configurations to our geolocation data -such as the Target breach, and CPU-side-channel

protecting sensitive data in all of its states is more

attacks which have dramatically increased attention

critical than ever. Cryptography is now commonly

to this third state, as well as several high profile

deployed to provide both data confidentiality

attacks involving malware injection, such as the(stopping unauthorized viewing) and data

Triton attack and the Ukraine power grid attack.

integrity (preventing or detecting unauthorizedchanges). While techniques to protect data in transit
and at rest are now commonly deployed, the thirdstate - protecting data in use - is the new frontier.

NEW

EXISTING ENCRYPTION

Data at Rest

Data in Transit

In useEncrypt inactive data when stored inblob storage, database, et.

Encrypt data that is flowing between
untrusted public or private networks.

Protect/Encrypt data that is in use, while
in RAM and during computation.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

3

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

3

Confidential Computing ConsortiumIn addition, as more data is moved to the cloud,data custodians are strongly incentivized to protect

network and physical perimeter security arepotential surface areas against attack, including

increasingly limited in their ability to protect against

data-in-use.

attacks. Widely studied attack patterns against
cloud-based applications include hypervisor andAs more data is stored and processed on mobile,

container breakout, firmware compromise, andedge, and IoT devices - where processing takes place

insider threats, each of which rely on different

in remote and often-difficult to secure locations

techniques to target code or data while it is in- the protection of data and applications duringuse. While previous safeguards (protecting data

execution is increasingly important. Furthermore,in transit and at rest) remain an essential part of adue to the personal nature of information stored

good defense-in-depth strategy, they are no longer

on mobile devices, manufacturers and mobile

sufficient for use cases in which sensitive data is

operating system providers need to prove thatbeing processed.

access to personal data is protected, is notobservable by device vendors or third parties during

Increasing regulation of data processing, such as

sharing and processing, and that those protections

General Data Protection Regulation (GDPR) andmeet regulatory requirements.

California Consumer Privacy Act (CCPA), may makedata custodians directly responsible when the data

Even when you control all your infrastructure,of users, customers, or clients is leaked due to aprotecting your most-sensitive data while in-use isbreach. As the cost of a data breach under the GDPR

part of a good defense-in-depth strategy.

may be as high as 4% of gross annual revenue,

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

4

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

4

Confidential Computing Consortium

How does Confidential Computing help?
Confidential Computing is the protection of data inelse with physical access to the hardware. Data

use using hardware-based, attested Trusted Execution

confidentiality means that those unauthorized

Environments. Through the use of Confidential

entities cannot view data while it is in use within

Computing, we are now able to provide protections

the TEE. Data integrity is preventing unauthorizedagainst many of the threats described in the previous

entities from altering data when data is being

section.

processed, by any entity outside the TEE. Codeintegrity means that the code in the TEE cannot be

What are Trusted Execution
Environments?

replaced or modified by unauthorized entities.
Together, these attributes provide not only anassurance that the data is kept confidential, but

A Trusted Execution Environment (TEE) is commonly

also that the computations performed are actually

defined as an environment that provides a level ofthe correct computations, allowing one to trust theassurance of data integrity, data confidentiality,

results of the computation as well. This assurance

and code integrity. A hardware-based TEE uses

is often missing in approaches that do not use a

hardware-backed techniques to provide increased

hardware-based TEE.

security guarantees for the execution of code andprotection of data within that environment.

The following table compares a typical TEE
implementation with two other emerging classes

In the context of confidential computing,of solution that protect data in use, Homomorphic

unauthorized entities could include other

Encryption (HE) and Trusted Platform Modules (TPM).

applications on the host, the host operating systemand hypervisor, system administrators, service
providers, and the infrastructure owner—or anyone

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

5

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

5

Confidential Computing Consortium

HW TEE

Homomorphic Encryption

Secure Element e.g., TPM

Data IntegrityY

Y (subject to code integrity)

Keys only

Data confidentiality

Y

Y

Keys only

Code integrity

Y

No

Y

Y (may require work)

No

Y

Code confidentiality
Programmability

Y

Partial (“circuits”)

No

Unspoofability/Recoverability

Y

No

Y

Attestability

Y

No

Y

Table 1 - comparison of properties of Confidential Computing vs. HE and TPMs

In practice, the extent to which the properties are•

Authenticated Launch: Some TEEs may enforce

present can vary by vendor, model, and algorithm,

authorization or authentication checks prior to

but the first three properties highlight the key

launching a requested process, and may refuse

differences in security properties. For example, ato launch a process which is not authorized or

typical TPM protects keys, but by itself cannot vouch

authenticated.

for the validity of the data signed or encrypted bythose keys, and it is not programmable with arbitrary•

Programmability: Some TEEs may becode, whereas a TEE is programmable and protects

programmed with arbitrary code, while somethat code and its data. A typical homomorphic

may only support a limited set of operations. A

encryption algorithm can protect arbitrary data, but

TEE might even include or be composed entirely

by itself cannot ensure that the correct operationsof code fixed at the time of manufacture

have been done and that the code has not been
tampered with, whereas a TEE again protects both•

Recoverability: Some TEEs may provide athe data and the code. These techniques are often

mechanism for recovery from a non-compliant

complementary and can even be used together inor potentially-compromised state. For example,

solutions for stronger security.

if it is determined that a firmware or software
component no longer meets compliance

Depending on the particulars of the TEE, it may

requirements and the launch authentication

also provide:mechanism fails, it may be possible to updatethat component and retry (recover) the launch.

•

Code Confidentiality: In addition to protecting

Recoverability generally requires that somedata, some TEEs may protect code while in use

component(s) of the TEE remain trusted, whichfrom being viewed by unauthorized entities. For

can act as a “root” when other components areexample, this can protect an algorithm that is

updated.

considered to be sensitive intellectual property.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

6

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

6

Confidential Computing Consortium•

Attestability: Often, a TEE can provide evidence

underlying layer. This drives the need for security

or measurements of its origin and current state,solutions at the lowest layers possible, down to theso that the evidence can be verified by anothersilicon components of the hardware. By providing

party and—programmatically or manually—it

security though the lowest layers of hardware,

can decide whether to trust code running in thewith a minimum of dependencies, it is possible toTEE. It is typically important that such evidence

remove the operating system and device driveris signed by hardware that can be vouched forvendors, platform and peripheral vendors, andby a manufacturer, so that the party checking

service providers and their admins, from the list of

the evidence has some assurance that it was

required trusted parties, thereby reducing exposure

not generated by malware or other unauthorized

to potential compromise.

parties.
With the goal of decreasing the reliance on
Availability attacks (such as DoS or DDoS) attacks

proprietary software for confidential computing

are not addressed by current hardware-based TEEs

environments, the Confidential Computing

as part of their threat model. Software projects andConsortium has excluded from its scope TEEs that

service providers may provide mitigations tohave only software roots of trust, and focusedsuch attacks.

on hardware-based security guarantees forconfidential computing environments.

Why is Hardware Necessary for
Confidential Computing
Security is only as strong as the layers below it,since security in any layer of the compute stackcould potentially be circumvented by a breach at an

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

7

7

Confidential Computing ConsortiumUtilization Paradigms within
Confidential Computing
There are multiple ways hardware-based TEEs are

hardware-TEEs. This approach may allow for closer

being used today to deliver the efficient defense-

scrutiny of the code that is run in the TEE and thein-depth mechanisms and security boundaries

interfaces it offers, since there may be less codesought by confidential computing. The approaches

to review than in Paradigm #2, but may requirevary in the size of their Trusted Computing Baseapplications to be designed (or changed) to use a(TCB), which is a rough measurement of how

TEE-aware SDK.

many lines of code a user needs to trust, and how
applications use the corresponding TEE.
Users should understand the differences between

Approach #2: Run-time Deployment
Systems

the two common approaches and how they meetthe qualities of confidential computing, so theyThis approach involves minimizing the effort

can make the corresponding selection that supports

needed to convert a typical application workload

their use case.

into one that can run in a TEE. Parallel efforts exist
to allow the development of cross-TEE portableapplications, while other efforts are underway

Approach #1: Application SDKs

to deploy unmodified applications into TEEs.
Deploying full applications has its advantages andHere the developer becomes responsible fordraw-backs: on the one hand it reduces the cost to

identifying and possibly partitioning theirdeploy applications that gain additional isolation,

application’s code into trusted and untrusted

however the original applications were mostcomponents. How they perform such an activity

likely not designed to take advantage of the othermay be influenced by whether the application

features of of TEEs such as attestation and secretis written for one hardware-TEE, or whether

protection. These advantages may be foregone in

TEE-specifics are abstracted into a common

the interest of ease-of-use, or may be handled byprogramming model by a software development

the run-time deployment system or via another

kit which allows for a degree of portability acrossmechanism.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

8

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

8

Confidential Computing ConsortiumUse Cases for Confidential Computing?
Keys, Secrets, Credentials andTokens Storage and Processing

based TEE, providing data confidentiality, data
integrity, and code integrity to achieve security
comparable to a traditional HSM.

Cryptographic keys, secrets, credentials andtokens are the “keys to the kingdom” fororganizations responsible for protecting sensitive

Public Cloud Use Cases

data. Historically, the storage and processing ofthese critical information assets required an on-

In a traditional public cloud scenario, trust

premises hardware security module (HSM) thatmust be placed in many layers within the cloudcomplied with local national security standards,

provider: the hardware; the firmware for core andsuch as the US Federal Information Processing

peripheral devices; the host operating system, theStandard (FIPS 140-2, 140-3) security requirements

hypervisor, and the cloud provider’s orchestration

for cryptographic modules. The proprietary naturesystem itself. While public cloud providersof traditional HSM hardware increases their cost,obviously go to great lengths to secure all layers

limits their scalability, and presents cost andof this stack, Confidential Computing offers

compatibility challenges for deployment in cloud

additional protection guarantees and significantly

and edge computing environments.

reduces the number of layers that must be trusted
by the end user.

Confidential Computing is already in use, bothby independent software vendors (ISVs) andWith a hardware-based TEE protecting applications

within large organizations, to store and process

and data in use, it becomes significantly more

cryptographic and secret information using

difficult for an unauthorized actor—even one withstandardized compute infrastructure available on-physical access to the hardware, root access to thepremises, in public/hybrid clouds, and even at thehost OS or the hypervisor, or privileged access to

network edge for IoT use cases. Key management

the orchestration system—to gain access to theapplications store and process cryptographic keys,

protected application code and data. Confidential

secrets, and tokens inside a secure, hardware-

Computing aims to allow the removal of even

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

9

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

9

Confidential Computing Consortiumthe cloud provider from the Trusted Computing

or developing cures for diseases in the healthcare

Base, so that only the hardware and the protectedindustry, or gaining business insight. As anapplication itself would be within the attack

illustration, multiple hospitals could combine

boundary.

data to train a machine learning model to moreaccurately detect brain tumors using radiology

This enables many workloads to move to theinformation. But individual patient data would be

public cloud which previously could not due tokept confidential, even in the event of a breach.

security concerns or compliance requirements.
Utilizing Confidential Computing, organizations
can now ensure that data on remote systems is

Multi-Party Computing

protected against tampering and compromise,
including against insider threats within the

New compute paradigms are emerging to enable

partnering organizations, and can also validate

datasets and processing power to be shared

the integrity of the code processing that data. The

across multiple parties. However, the data

data can be combined and analyzed within theand computational models may be sensitive

TEE, and the results can be sent in an encrypted

or regulated, such as in the financial services,format back to each party. Data remains

healthcare, government and non-profit domains.

protected throughout the entire process: while it is

So how can the confidentiality and integrity

transferred, during computation, and while stored.

of the data be preserved even when sharedacross platforms that may not be trusted by

These capabilities will help drive the advancement

the other transacting parties? Organizationsof a global data-sharing playing field, such as

want to be freed from the limitations of data

the technologies mentioned above, that enables

silos, but still must ensure the data sources areorganizations to unlock previously unleveraged

not compromised when they are shared anddata sets for collaborative analysis and exchange

the results can only be accessed by the parties

with other organizations – with reduced risk ofapproved for sharing.

security, privacy, and regulatory impacts.

For example, private multi-party analytics canbe applied to any case in which multiple parties

Blockchain

have private data that needs to be combined
and analyzed without exposing the underlying

A blockchain is a shared, immutable ledger thatdata or machine learning models to any of therecords the exchange of data, digital assets, orother parties. The technology could be applied tocurrency between a network of participants.

preventing fraud in financial services, detecting

Blockchains provide the infrastructure to record

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

10

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

10

Confidential Computing Consortiumand validate the transactions without the needand communication inefficiencies that arise fromfor a centralized 3rd party. Blockchains canconsensus protocols [5].

provide transparency into supply chain activities,
facilitate the exchange of digital assets, orunderpin compliance processes such as KnowYour Customer (KYC). A key characteristic of a

Mobile And Personal Computing
Devices

blockchain is that it ensures that participants whoshould have a piece of data in common know for

Use cases on client devices mostly involve

sure that they see the same thing, and that once

application developers or mobile device

entered on the blockchain data is immutable. It

manufacturers who provide assurances thatis up to the application developer to ensure that

personal data is not observable during sharing

sensitive data such as PII is not stored on theor processing. From a compliance and best

immutable blockchain.

practice perspective, this removes equipment
manufacturers from the liability loop as they

Confidential Computing can be used to enhance

can assert that they can not observe a client’s

the implementation of a Blockchain-based

personal data. Where a TEE is able to ensure

system. By combining the power of Confidential

the attestability and code integrity properties

Computing and Blockchain technologies, users

mentioned before, functional correctness of

may leverage a hardware-based TEE to provide

computation (and hence trustworthiness ofattestation and verification services thatthe result of the computation) can be formally

optimize for scalability, privacy and security. The

proven[1][2] . This provides an environment whereassurance of data consistency between users of aapplication developers can prove to the user thatblockchain usually depends on each party having

their data has not left the device.

independently validated all historical data uponwhich the validity of any current data depends.

For example, in an implementation of continuous

This requires visibility of those historical data sets,authentication (always logged on), the usera potential scalability or privacy concern. Users canaccount login application on the device uses

execute smart contracts in a hardware-based TEE

signals that can be gathered from user interaction

instead of independently accessing and validating

to identify the user. These may include sensitive

historical data and associated smart contracts fordata like biometrics or physical patterns in how thethemselves. Once the transaction is finalized, TEEs

user interacts with the device that would benefit

provide attestation services to prove the reliability

from operating within a TEE. The user behaviorof the transaction, meaning no subsequent

engine only needs to identify the user, without

participant needs to perform the verification again

exposing the raw user behavioral data to otherfor themselves. TEE-based attestation services

devices or to code outside the TEE.

can also help address some of the computational

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

11

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

11

Confidential Computing ConsortiumAnother example is the case of decentralized
on-device model training, where the desire is toimprove a model, and allow such improvements tobe shared with other devices, without leaking thedata used to train the model. Design of protocols
using hardware-based confidential computing areeasier to use than statistical models like Differential
Privacy[3]. Furthermore, statistical methods still relyon the consumer to trust the application developer
to inject the right amount of noise to adequately
hide sensitive data. By contrast, an on-device
HW TEE could enable users to set policy andconstraints on their own devices for the usage andprocessing of their data through the property ofmutual attestation.

Point of Sale devices / payment
processing
Use of hardware-based, attested Trusted Execution
Environments is already common in the payment
processing industry today. Point-of-Sale devices
that accept chip-and-PIN style credit or debit cards
are used to protect secrets such as credit card
numbers, PINs, expiration dates, CVVs, and key
material used for protecting messages. Often, otherdevices such as cash registers or tablets are general
purpose computing devices, and chip-reading
hardware is used to keep the payment processing
code protected from any potential malware on suchgeneral purpose computing devices.

Edge And IoT Use Cases

To protect user-entered information such as a PIN,

Cases such as local search and filtering in theentry, so that such data cannot be read or

it is important to also protect the means of data

context of (for example) DDoS detection taking place
in a home router are examples where a confidential
computing environment would fit well. In mostcases, TCP/IP packet metadata needs to be kept
confidential as sensitive user behaviour may beinferred. Other examples include Edge confidential
Machine Learning processing, like video-metadata
generation for reducing latency and/or bandwidth totampered with as the user enters it. In secure
devices, the number pad is isolated such that the
input is only readable by code within the
hardware-based TEE. In this manner, the data canbe safely operated on and used to generateencrypted messages to a payment processing
service, all out of reach of any malware or
unauthorized access by third parties.

a backend network; CCTV camera surveillance, where
the provider needs to load templates of persons ofinterest that could be harmful if leaked; or on-device
training models similar to those described above inthe mobile context.
Some devices are, by their design, physicallyaccessible to untrusted parties. Confidential
computing technology can be used to help
mitigate attacks which depend on physicalaccess to the device.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

12

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

12

Confidential Computing Consortium

Conclusion
The Confidential Computing landscape is rapidly

These different approaches support various

evolving to provide new tools to business anduse cases, but all with the end goal of helping

end-users that protect sensitive data and code

ensure the confidentiality of the sensitive,

against a class of threats occurring during databusiness critical information and workloads.

execution which were previously difficult, if not

As confidential computing continues to evolve,

impossible, to protect against.

more approaches may emerge, or evolutions ofthese approaches may occur. The Confidential

Solution providers have developed different

Computing Consortium is optimistic about theapproaches for confidential computing byinnovation that lays before this field.

making trade-offs, for example around
TCB size, ranging from partitioning theapplication’s code into trusted and untrusted
components, to enabling the migration ofexisting applications with few or no changes.

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

13

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

13

Confidential Computing ConsortiumAbout the Confidential Computing
Consortium
The Confidential Computing Consortium (CCC) is aReferences

community focused on projects securing data in use
using hardware-based TEEs, and accelerating the[1] “Toward Trustworthy AI Development: Mechanisms

adoption of confidential computing through open

for Supporting Verifiable Claims” Report by Miles

collaboration. The CCC brings together hardware

Brundage et al., April 2020.

vendors, cloud providers, and software developers

https://arxiv.org/pdf/2004.07213.pdf

to accelerate the adoption of Trusted Execution[2] “Remote Credential Management with Mutual

Environment (TEE) technologies and standards.

Attestation for Trusted Execution Environments”
It is not the intent of this whitepaper, or the CCC, to

Carlton Shepherd, Raja N. Akram, and Konstantinos

evaluate or compare specific vendor technologies. This

Markantonakis. 12th IFIP WG 11.2 Intl. Conference,

whitepaper aims to set context and define consistent

WISTP 2018, Brussels, Belgium, Dec. 10-11, 2018.

terminology that vendors can use to describe theirhttps://arxiv.org/pdf/1804.10707.pdf

products, allowing others to make a like-to-likecomparison between the various offerings in this space.

[3] The Algorithmic Foundations of Differential Privacy”
Cynthia Dwork, Aaron Roth. Foundations and Trends

This content represents the collaborative work (“Work”)

in Theoretical Computer Science Vol. 9, Nos. 3–4 (2014)of the Confidential Computing Consortium (“CCC”). The

211–407.

CCC is solely responsible for the Work and Individual CCC

https://www.cis.upenn.edu/~aaroth/Papers/

members may not have contributed or participated, or

privacybook.pdf

may not endorse it.
[4] “Differential Privacy” Cynthia Dwork, ICALP 2006:
Automata, Languages and Programming pp 1-12.

Further Readinghttps://www.microsoft.com/en-us/research/wpcontent/uploads/2016/02/dwork.pdf•

Confidential Computing Consortium•

Draft NIST paper[5] Veronese, Giuliana & Correia, Miguel & Bessani,•

UN Handbook on privacy preserving techniques

Alysson & Lung, Lau & Veríssimo, Paulo. (2013).
Efficient Byzantine Fault-Tolerance. Computers, IEEE
Transactions on. 62. 16-30. 10.1109/TC.2011.221.
https://www.gsd.inesc-id.pt/~mpc/pubs/tc13minimal.pdf

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

Confidential Computing Consortium

14

Confidential Computing: Hardware-Based Trusted Execution for Applications and Data

14

Confidential Computing Consortium

g.io

The Confidential Computing Consortium (CCC) is a community
focused on projects securing data in use using hardwarebased TEEs, and accelerating the adoption of confidential
computing through open collaboration. The CCC brings
together hardware vendors, cloud providers, and softwaredevelopers to accelerate the adoption of Trusted Execution
Environment (TEE) technologies and standards.