I will probably get some feedback on my assertion in the title of this blog. But the truth is, as many of you are painfully aware, it's hard to compare security between vendors because there aren’t benchmarks like there are for the performance of a workload. The challenge is further compounded by the fact there is very little in terms of a common language and any security discussion quickly becomes so technical that only a Chief Security Officer (CSO) understands the nuances.
In this note, I have described, in the simplest terms possible, how IBM has been delivering on end-to-end “confidential computing” for its clients’ (what it calls its customers) cloud computing for more than two years with its fourth-generation technology, based on over a decade of research. Certainly, not in doubt here is the maturity of IBM’s technology.
What is confidential computing?
The term confidential computing refers to technology that protects data while in use. It has been embraced by cloud computing companies as it could be a way to reduce security concerns and entice customers to adopt more cloud services.
The goal is to enable a cloud tenant to put data in a public cloud and have guarantees that the public cloud provider does not have access to the data in any way shape or form. Bad actors will always exist and there have certainly been lots of examples of insiders who have used their privileged authorities to do nefarious things.
In today's world, you're trusting the cloud provider. They will tell you, “we promise we will not access your data. We will have policies in place, our administrators will not touch your data when it is in our cloud”. With Confidential Computing the cloud provider will say we cannot access your data as opposed to we will not.
How IBM is delivering Confidential Computing
IBM has done a lot of work over the years to address concerns around security, data privacy, and compliance in the public cloud by creating strong data governance. This is manifested in a set of technologies associated with LinuxONE and the IBM Z solutions that have been available for four years, while many other vendors are still maturing their technologies.
Secure Enclave technology since 2016
Unfortunately, there is no industry definition on what a “secure enclave” is.
IBM’s Secure Enclave enables applications to process encrypted data without the possibility of exposing plain-text data to the operating system or any other running process – including any form of malicious attack. The data and applications running within the secure enclave become inaccessible even to the cloud service provider.
A secure enclave is an isolated memory location that can be used to run an application in a trusted execution environment (TEE). It is protected by locked-down hardware in the CPU that safeguards data being processed from attack, making it difficult for attackers to unscramble private data without legitimate approval even with the physical access to the infrastructure.
A secure enclave guarantees confidentiality, integrity, and security for the application running within it. IBM’s enclave technology has been in production for over four years since it was introduced to host Blockchain solutions in the IBM Cloud.
The IBM enclave technology is consumable in a simplistic way. Application developers do not need to rewrite their applications, they simply deploy containers into the enclave in an unmodified fashion, and inherit the confidential computing of the Enclave as a result.
IBM Cloud Hyper Protect Services and IBM Cloud Data Shield since 2018
IBM first announced generally-available Confidential cloud computing capabilities in 2018 with the release of IBM Cloud Hyper Protect Services and IBM Cloud Data Shield. The family of IBM Hyper Protect Cloud Services is built with secured enclave technology that integrates hardware and software and leverages the industry’s first and only FIPS 140-2 Level 4 certified cloud hardware security module (HSM) to provide end-to-end protection for clients’ entire business processes. IBM Cloud Data Shield provides technology that helps developers to seamlessly protect containerized cloud-native applications, without needing any code change.
Customers voting with their dollars
In the absence of benchmarks, one can sometimes assess a technology by who has selected the technology and why. The three examples below share one common theme; sensitive data that must be inaccessible to the cloud service provider.
Daimler was looking for a place for their sales portal, an important enabler for their business. To be able to innovate very quickly it needed to be a cloud solution. The data being hosted was client data, the crown jewels of the company which resulted in a strong requirement for the cloud provider to not be able to gain access to that data. In the end, they found that the IBM Cloud with Hyper Protect Cloud Services was the only cloud that could meet their requirements.
Apple prides itself on having secure enclave technology built into their devices. Apple CareKit is an open-source framework for developing iOS apps to help users better understand and manage their health. Functions include creating dynamic care plans, symptoms tracking, connecting with care teams, and more. CareKit often works with back-end systems for synchronization of data across devices, as well as for access by care teams, so it is important to be able to trust the security of the cloud. Cloud security requirements can be onerous for healthcare providers as they need to guarantee the privacy and protection of data in flight, at rest, and in operation at the server-side where personally identifiable information (PII) and health information is stored.
IBM introduced Hyper Protect iOS SDK for CareKit powered by IBM Cloud Hyper Protect Services, which ensures data is always encrypted, whether in flight or at rest, and protected in use. Hyper Protect Services delivers complete authority over sensitive data and associated workloads — restricting access even for cloud admins. The solution extended the security of Apple devices into the cloud with the bonus of HIPAA readiness.
The third example is Bank of America, who were challenged to get the public cloud with sensitive data. IBM was able to appease the risk analysts in the bank with their confidential computing technology. IBM was able to guarantee that at no time does anybody in IBM have access to Bank of America's keys contained in the hardware security module (HSM) giving the bank full lifecycle management over their data. The bank achieved data governance that met their needs from a compliance and a risk management perspective.
The IBM future: Fully Homomorphic Encryption (FHE)
Fully Homomorphic Encryption (FHE) promises to be the next innovative step in cloud security. It will allow user data to be protected anytime it is sent to the cloud while keeping some of the useful properties of cloud services like model training and inference with machine learning. This is because it can allow operations and functions to be performed over encrypted data so data is never unencrypted outside the users’ environment.
Today IBM has Fully Homomorphic Encryption Toolkits for MacOS and iOS and multiple Linux distributions for IBM Z and x86 architectures enabling developers to experiment with FHE to keep data protected and processed simultaneously.
Data and securing that data is and will remain an incredibly important asset to companies and consumers. As our reliance on data grows in the era of hybrid cloud, the need for data privacy becomes even more critical for everyone – and for businesses, an imperative.
With the growing adoption of hybrid cloud environments, Confidential Computing could not be more important. IBM has taken the first step to bring true Confidential Computing to clients.
In delivering Confidential Computing since 2016, IBM has provided protection across the entirety of the compute lifecycle – which includes everything from the build process and key management to the security of data services. Important because failure to fully protect any of these layers can leave the business process exposed.
IBM has a long history of providing the highest available levels of security, as well as a strong heritage of investing in the future of computing to make security features like homomorphic encryption or emerging platforms like quantum computing a reality.
Note: Moor Insights & Strategy writers and editors may have contributed to this article.