Understanding Confidential Computing in Sensitive Industries
Have you ever encountered the term ‘confidential computing’? For professionals in sectors such as healthcare, finance, or government—where private and highly sensitive information is prevalent—it is likely that you have interacted with this crucial technology, perhaps without even realising it. But what makes it so “crucially important” in today’s landscape?
Data protection is typically straightforward when information is stored on a disk or transmitted over a network, as encryption safeguards both scenarios. However, there exists a particularly vulnerable moment when data is actively being used by a processor for calculations. This weak link in the security chain—data in use—is precisely what confidential computing aims to fortify. Its significance has surged in recent years as more companies transition to cloud-based artificial intelligence (AI) models.
“Protecting data while it’s being processed by the CPU or GPU is the last frontier of protection,” explains Raghuram Yeluri, Senior Technologist at Intel and a key architect behind the company’s confidential computing strategy. In a recent discussion, Yeluri, who has been with Intel for nearly three decades, shared insights on confidential computing, confidential AI, and aspects of trust in agent-based AI, among other related topics concerning AI workloads.
A Secure Analogy for Confidential Computing
For those without a technical background in cybersecurity, Yeluri offers an analogy to illustrate the role of confidential computing. “Imagine living in an apartment with three or four housemates. If you store something in your wardrobe, it’s likely that your housemates will see it simply by opening the closet doors. However, if you have a safe, as long as you possess the key, what you store there remains secure.”
He adds, “Think of confidential computing as having a safe—a hardware-protected safe that only you can access with a key. You can store and retrieve items with complete security.” This concept appears relatively straightforward. In the pre-cloud era, companies operated their own data centres, fully aware of who managed them and being the sole users. However, with the advent of cloud computing, workloads now share servers with other clients, overseen by the service provider’s administrators. A malicious administrator or a tenant exploiting a hypervisor vulnerability could potentially copy, alter, or steal information.
Consequently, confidential computing encrypts data in memory, preventing modifications and stopping operators or providers from making copies. “Thus, confidential computing offers that protection—the ultimate encryption during use and confidentiality during use—so that the only time data is ‘in the clear’ is when it resides within the CPU being processed, and no one can view it except the CPU at that moment,” Yeluri elaborates.
Critical Applications in Healthcare and Finance
In industries such as healthcare, finance, and pharmaceuticals, two types of sensitive assets are handled. The first comprises personal data, such as medical histories, treatments, or banking information, all subject to stringent regulations like the European Union’s AI Act or the DORA regulation for financial services. The second involves the AI models trained on this data, which can represent highly valuable intellectual property. Some companies invest billions of dollars in their development.
Thus, the risk extends beyond the theft of data used to train AI; there is also the threat of someone copying or extracting the model itself. In light of these risks, confidential computing provides two significant advantages. The first is the protection of confidentiality and integrity of both data and models from the infrastructure owner. The second is the ability to demonstrate this protection with verifiable proofs. “You don’t have to trust the provider,” Yeluri states. “Here, you have cryptographically verifiable proof showing that you are using confidential computing.”
This also facilitates a new form of collaboration. Yeluri illustrates this with an example: “If you have a model requiring data from two different banks to fine-tune, both banks may be reluctant to share their data with one another. The model owner, having invested millions in its training, fears that the model could be copied or extracted if handed over to one of the banks for fine-tuning.” With confidential computing, he assures, the data from both banks and the model coexist in an isolated environment. This means that neither party can see the other’s data, yet the model improves with the contributions from both sides, all while maintaining the necessary security for both the banks and the model owner.
Intel’s Innovations in Confidential Computing
Intel has been pioneering developments in this area for years. One of its initial advancements was SGX (Software Guard Extensions); available for over a decade, this technology creates highly secure enclaves within processors, albeit requiring application modifications. Approximately five years ago, TDX (Trust Domain Extensions) was introduced, designed for companies to conduct lift and shift operations—moving applications as they are to confidential virtual machines or containers without alterations. TDX serves as the foundation for current work in confidential AI.
The third component is the Intel Trust Authority, a remote attestation service. The fourth is TDX Connect, a technology aimed at extending confidentiality properties from CPUs to GPUs and other accelerators, allowing for the execution of increasingly larger models in the AI era.
Verifying Confidential Workloads in Cloud Environments
How can one ascertain that their workload is truly running in a confidential environment? When utilising a public cloud, such as Microsoft Azure or Google Cloud, providers can assure you that your applications are running in a confidential setting. “Generally, these companies operate exceptionally well,” notes Yeluri. “They will deliver exactly what you need, although you must place your trust in them.” However, for scenarios requiring the highest levels of security, there lies a critical distinction between accepting a claim and being able to verify it. Attestation is what allows for independent verification.
The process comprises three steps, explains Yeluri, being an expert in attestation as the chief architect of Intel Trust Authority. First, the hardware provides cryptographic evidence that the environment is authentic. The Trust Authority verifies that the signature is genuine and that the key has not expired. Second, a “measurement” (a hash of the running code) is compared with the expected one to confirm that the correct code is executing. Third, the client’s policies are evaluated, for example, “let’s say you have a set of policies stating: I need it to run in a Google cloud located in the United States, and I need it to execute in a confidential environment, specifically on Intel Gen 5 rather than Gen 4.” If everything aligns, the service issues a signed token that the client can present to regulators, auditors, or partners.
Yeluri likens this to a government-issued passport: a document signed by an official authority that anyone can accept as proof of identity. Similarly, attestation generates a sort of “cryptographic passport,” which functions consistently across Microsoft, Google, IBM Cloud, or on private servers.
The Challenges of Autonomous Agents in AI
This introduction to confidential computing concludes with a discussion on agent-based AI. Yeluri explains that, until now, software has been deterministic—meaning defined inputs yield defined outputs, with a threat model that could be validated prior to launch. In contrast, AI agents exhibit non-deterministic and dynamic behaviours, complicating such analyses.
While confidential computing does not resolve all these issues, it provides a robust foundation upon which to build controls. It enables the creation of high-integrity agent identities, upon which a public key infrastructure can be established. Furthermore, it allows for immutable and auditable records of each agent’s actions, tools used, and policies applied. It also facilitates the verification that an agent is communicating with the correct tools and servers, including the Model Context Protocol (MCP) servers that connect models with diverse external capabilities.
This is significant because agents often operate without human oversight, continuing until their goals are met. If they connect to an incorrect tool, detrimental outcomes may occur before anyone notices. Some damages, such as financial transactions, are not always reversible.
Yeluri’s final lesson is that, in the age of AI, trust holds immense value but cannot be taken for granted; it must be verifiable. This is what keeps confidential computing relevant now more than ever.