Google on Tuesday unveiled a new Google Cloud product designed to help organizations protect sensitive data while it’s being processed.
Alibaba, Arm, Baidu, Google Cloud, IBM, Intel, Microsoft, Red Hat and others last year announced the launch of the Confidential Computing Consortium, an organization of the Linux Foundation whose goal is to improve the security of data in use.
Google on Tuesday unveiled the first product in its Google Cloud Confidential Computing portfolio: Confidential VMs. Currently in beta for Google Compute Engine, Confidential VMs are designed to help organizations, particularly ones in regulated industries, protect sensitive data by providing memory encryption capabilities that can be leveraged to isolate cloud workloads.
The tech giant says it has been focusing on making confidential computing easy and accessible since the launch of its Asylo open source framework in 2018, and with the launch of Confidential VMs it believes it has achieved this goal.
Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature in 2nd Gen AMD EPYC processors to ensure that sensitive data remains encrypted at all times, including while it’s used, queried or indexed.
Google Cloud Confidential Computing builds on the protections provided by Shielded VM, a hardened virtual machine instance that ensures a verified bootloader and kernel run on startup, providing protection against malicious guest OS firmware, boot and kernel vulnerabilities, and malicious insiders.
“Confidential Computing can unlock computing scenarios that have previously not been possible. Organizations will now be able to share confidential data sets and collaborate on research in the cloud, all while preserving confidentiality,” Google explained.
The company noted that Google Cloud Platform users can easily move their current workloads to a Confidential VM, simply by ticking a checkbox.
“Using the AMD SEV feature, Confidential VMs offer high performance for the most demanding computational tasks, while keeping VM memory encrypted with a dedicated per-VM instance key that is generated and managed by the AMD EPYC processor. These keys are generated by the AMD Secure Processor during VM creation and reside solely within it, making them unavailable to Google or to any VMs running on the host,” Google said.
AMD told SecurityWeek that SEV has continued to evolve since its launch a few years ago to enable more secure functions for modern datacenters. The 2nd Gen EPYC CPUs provide up to 509 unique encryption keys known only to the processor, compared to only 16 unique keys provided by the 1st Gen EPYC processors. The company says this feature is only available on AMD processors.
AMD says its EPYC processors support a variety of cloud workloads, including general purpose, memory bound, compute-intensive and virtual desktop infrastructure (VDI). These processors are used not only by Google Cloud, but also Amazon Web Services (AWS), Microsoft Azure, Oracle Cloud Infrastructure, and IBM Cloud.
Related: IBM Releases Open Source Toolkits for Processing Data While Encrypted
Related: Microsoft, Google Announce Wider Availability of Secure VMs
Related: Google Offering Higher Bonuses for Cloud Platform Vulnerabilities
Related: Many New Security Features, Services Added to Google Cloud