A new Cloud-based technology that isolates confidential data during computation in a secure CPU enclave, could be the future of data security
The SolarWinds hacking incident last year that hit 18,000 customers worldwide, including US government organizations, has sent a chilling message of cybersecurity experts about a new kind of threat, the ingenuity of which has fooled them all. Hackers did a simple thing; they hid malicious code within good code that was trusted by customers. User of Orion, one of SolarWinds software products, were blissfully unaware that they were using malware infected software for nearly nine months before the breach was detected. According to some estimates American businesses and government agencies could be spending upward of $100 billion over many months to contain and fix the damage from the Russian hack.
SolarWinds is an Austin, Texas-based information technology firm. One of SolarWinds’ products is a software system called Orion that is widely used by companies to manage their IT resources. According to SEC documents, SolarWinds has some 33,000 customers who use Orion. Hackers breached SolarWinds’ systems and inserted malicious code into the software build process. The breach of the CI/CD pipeline went undetected for many months and, as a result, numerous product updates were unwittingly shipped by SolarWinds to customers that included the inserted vulnerabilities. The inserted malicious code introduced a backdoor, allowing hackers to gain access to the software running on SolarWinds’ customers’ infrastructures. The hackers found a way to legitimize the malicious code by injecting it into the build pipeline. The SolarWinds CI/CD build pipeline was producing digitally signed and trusted software for over 18,000 customers worldwide. The real issue for clients is complex. The build pipeline produces builds, and these builds are digitally signed with the SolarWinds certificate trusted by the Certificate authorities in various operating systems and browsers. If clients were to revoke the digital certificate, they would be revoking both the good and the bad coding.
A New Concept
The cleverness of the hack has made cybersecurity experts come up with a new concept to secure the most valuable data assets of the organization, Confidential Computing. Confidential Computing is a cloud computing technology that isolates sensitive data in a protected CPU enclave during processing. The contents of the enclave – the data being processed, and the techniques used to process it – are accessible only to authorized programming code, and invisible and unknowable to anything or anyone else, including the cloud provider.
To simplify the concept, one needs to understand the three states in which data resides – (a) at rest on a storage device; (b) in transit between two locations across a network and; (c) when it is in use as it’s being processed by applications. It is in the third stage that data is most vulnerable and Confidential Computing is about protecting this stage.
What is Confidential Computing?
Confidential Computing is a Cloud-based system that isolates confidential data during computation in a secure CPU enclave. The material of the enclave – data processing and processing methods – is only available to a permitted code, and inaccessible and unknown for everyone. The technology isolates sensitive data in a protected CPU enclave during processing. The contents of the enclave – the data being processed, and the techniques used to process it – are accessible only to authorised programming code, and invisible and unknowable to anything or anyone else, even to the Cloud provider.
Before it can be processed by an application, data must be unencrypted in memory. This leaves the data vulnerable just before, during and just after processing to memory dumps, root user compromises and other malicious exploits. Confidential Computing solves this problem by leveraging a hardware-based trusted execution environment, or TEE, which is a secure enclave within a CPU. The TEE is secured using embedded encryption keys, and embedded attestation mechanisms that ensure the keys are accessible to authorized application code only. If malware or other unauthorized code attempts to access the keys – or if the authorized code is hacked or altered in any way – the TEE denies access to the keys and cancels the computation.
So, what are the derived benefits? A lot, but let us just dwell on the most crucial ones:
- Protects sensitive data, even while in use
- Extends Cloud computing benefits to sensitive workloads
- Protects intellectual property including proprietary business logic, analytics, algorithms, or entire applications.
- Enables secure collaboration with partners on Cloud platforms.
- Protects data processed overdistributed Edge computing frameworks.
In 2019, a group of CPU manufacturers, Cloud providers and software companies came together to form the Confidential Computing Consortium (CCC). The two prime goals of the CCC are to define industry-wide standards for Confidential Computing and to promote the development of open source Confidential Computing tools. The Consortium members currently include Alibaba, AMD, Baidu, Fortanix, Google, IBM/Red Hat, Intel, Microsoft, Oracle, Swisscom, Tencent and VMware – all big names for whom data security means a lot! The world will surely hear more on this.