On Wednesday, 21st August, 2019 (just under a week ago, at time of writing), Jim Zemlin of the Linux Foundation announced the intent to form the Confidential Computing Consortium, with members including Alibaba, Arm, Baidu, Google Cloud, IBM, Intel, Microsoft, Red Hat, Swisscom and Tencent. I’m particularly proud as Red Hat (my employer) is one of those[1], and I spent the preceding few weeks and days working very hard to ensure that we would be listed as one of the planned founding members.
“Confidential Computing” sounds like a lofty goal, and it is. We’ve known for ages that you should encrypt sensitive data at rest (in storage), in transit (on the network), but confidential computing, as defined by the consortium, is about doing the same for sensitive data – and algorithms – in use. The consortium plans to encourage industry to use hardware technologies generally called Trust Execution Environments to allow applications and processes to be encrypted as they are running.
This may sound somewhat familiar to those who follow my blog, and it should: Enarx, an open source project launched by Red Hat, was announced as one of the projects that should be part of the initial launch. I’ve written about Enarx in several places:
- Announcing Enarx (on this blog)
- Enarx for everyone (a quest) (on this blog)
- Trust No One, Run Everywhere (now + Next Red Hat blog)
Additionally, you’ll find lots of information on the introduction page of the Enarx wiki.
The press release from the Linux Foundation lists the following goals for the Confidential Computing Consortium (my emboldening):
The Confidential Computing Consortium will bring together hardware vendors, cloud providers, developers, open source experts and academics to accelerate the confidential computing market; influence technical and regulatory standards; and build open source tools that provide the right environment for TEE development. The organization will also anchor industry outreach and education initiatives.
Enarx, of course, fits perfectly into this description, as per the text in bold. Beyond that, however, is the alignment that there is with the other aims of the Enarx project, and the opportunities with which a wider consortium presents us. The addition of hardware vendors gives us – and the other participants – opportunities to discuss implementations (hardware and software) in an open environment, cloud providers and other users will give us great use cases, and academic involvement broadens the likelihood of quick access to new ideas and research.
We also expect industry and regulatory standards to be forthcoming, and a need for education as the more sectors and industries engage with confidential computing: the consortium provides a framework to engage in related activities.
It’s early days for the Confidential Computing Consortium, but I’m really hopeful and optimistic. Already, the openness displayed between the planned members on both technical and non-technical collaboration has gone far beyond what I would have expected. The industry interest – as evidenced by press and community activities – has been high, and overwhelmingly positive. Fans of Enarx – and confidential computing generally – should be excited by the prospect of greater visibility and collaboration. After all, isn’t that what open source is about in the first place?
1 – this seems like a good place to point out that the views in this article and blog are my own, and may not represent those of my employer, of the Confidential Computing Consortium, the Linux Foundation or any other body.
Alice, Eve and Bob - a security blog 
ConfCom seems to be a good step forward. Would love to see hackathons around this.
LikeLike