Confidential Computing Demystified: An in-depth look into CVMs - Dimple Kuriakose | UbuCon Asia 2025 скачать в хорошем качестве

Confidential Computing Demystified: An in-depth look into CVMs - Dimple Kuriakose | UbuCon Asia 2025

UbuCon Asia 2025, Kathmandu, Nepal. Whenever you run your application on a cloud, you are pretty much giving the cloud provider complete access to your sensitive data. Even if you were to use full-disk encryption to protect the data on your disk, it still remains vulnerable when in use — when loaded into RAM or processed by the CPU. So how do you ensure that your data remains secure even if the cloud infrastructure is compromised? How do you trust a VM that was launched by a compromised host environment? An environment where a malicious actor could have physical access to your allocated hardware. Confidential computing aims to solve all of these problems and in this talk, we'll see how that is achieved. We'll explore potential threats and understand mitigation techniques — techniques like secure boot, measured boot, TPM-based full-disk encryption and hardware-based trusted execution environments. We'll see how Ubuntu is modified to support all of this.