We have encryption for data in motion. We have encryption for data at rest. But one type of data is difficult to keep encrypted — data that is being used. For an application to do something with data, such as checking a document for spelling mistakes, it must be able to see the data.
Software-based solutions include tokenization and format-preserving, searchable, homomorphic (which allows for mathematical operations), and multi-party encryption. These are slow, cumbersome, and don’t work for all use cases.
What works is hardware-based protections. Smartphones already use them — secure enclaves that allow for the processing of identity and payment data in a way that’s not visible to the rest of the device.
On enterprise servers, this is called confidential computing and two main flavors of this technology are in use. The best known is Intel’s SGX, a secure enclave within Intel chips that protects applications and data while in use. These enclaves are relatively small, and applications typically must be rearchitected or rewritten to take advantage of them. By keeping it small, however, the potential risk due to flawed application logic is also minimized.
The other approach is used by IBM on the S390 chips in its Z System mainframes and LinuxOne servers, and by AMD in their EPYC chips. Here, the protected enclave is quite a bit larger and can hold not just an application, but the entire virtual machine it’s in. That means that applications don’t have to be rearchitected or rewritten to work inside the enclave.
