Most of us understand the importance of encrypting data when sending it to the cloud and storing it there, but what about when processing it? When a cloud application pulls data out of storage for processing, it must decrypt it. That means that, for a while at least, your precious customer data is floating around unprotected in system memory. With attacks like Meltdown and its variants, and with the danger of corrupt employees or rogue sysadmins, there’s a danger of compromise, especially in the cloud's multi-tenanted environments.
Companies are now working on ways to process that data without ever decrypting it. There are two broad approaches. One of them is homomorphic encryption. This uses advanced mathematics techniques to process data without knowing what it is.
IBM has been working on a set of homomorphic encryption tools and began releasing them under an open source license in June. This technique is useful for tasks such as finding the intersection between two databases without looking at either of them, for example. Commercial applications could include outsourcing tasks that require access to sensitive data. IBM hopes that it will catch on in heavily regulated industries like finance and healthcare.
An alternative approach is to focus on encrypting the virtual machine infrastructure that runs the applications processing the data. This is Google’s method. In July, it launched Confidential VMs for Google Cloud. Out in beta, these are virtual machines that offer full memory encryption while they're running rather than just when stored on disk.
Confidential VMs achieve this using a hardware feature called Secure Encrypted Virtualization, which AMD included in its second-generation EPYC CPUs. It keeps data encrypted in memory and generates separate encryption keys for each VM in hardware.
This feature, which builds on the cloud giant's existing Shielded VM secure virtual machine technology, has an advantage in that it's code agnostic. Any workload running in the Google Cloud today can transfer to a Confidential VM, the company says.
Conversely, IBM’s approach requires application code to be aware that it’s dealing with homomorphic encryption, incurring redevelopment costs. Technical analyses also reveal that IBM’s technique requires significantly more RAM and processing power, whereas the Confidential VM approach uses little in the way of extra resources.
Companies worried about the security of their data in the cloud will soon be able to add an extra layer of protection, removing yet another security risk and sharpening the focus on the biggest remaining cause of cloud breaches: human error and inexperience.
