Looking Beyond Memory Encryption: Confidential Computing

Article By : Gary Hilson

Security features must be configured properly and work within a larger ecosystem...

Security features for memory are not new, but increased connectivity compounded by the pandemic-driven surge in remote work means safeguarding data is more critical and even more challenging. The security challenges are amplified in emerging use cases where data is shared across communications infrastructure, including 5G. Meanwhile, enabling security adds complexity to memory designs. Even before the exploding growth of edge computing, the Internet of things (IoT) and connected cars, security features in memory were proliferating. Electrically erasable programmable read-only memory (EEPROM) is favored for credit cards, SIM cards and keyless entry systems, while the “S” in SD card stands for “secure,” and flash-based SSDs have for years included encryption. Security has steadily been embedded in memory and networking devices that are distributed throughout computing systems and networking environments. But these memory-based security capabilities still must account for human error. Information security professionals must deal with the consequences of users opening spurious attachments or a router being misconfigured. Similarly, the benefits of secure memory features won’t be fully realized unless properly configured, and in harmony across a system that also includes software. You could say that the dual SoCs — security operations centers, and systems on chip — are merging.
memory security
Infineon’s Semper Secure NOR flash serves as a hardware root-of-trust while also performing diagnostics and data correction for functional safety. (Source: Infineon)
Companies such as Rambus offer products aimed at securing each connection in response to increased server connectivity bandwidth requirements in cloud and edge computing. Meanwhile, Infineon Technologies has expanded its Cypress Semiconductor Semper NOR flash memory to reflect the inevitability of every system being connected — with hackers tampering with the contents of a flash device. That tampering could affect any number of different computing platforms, including an autonomous vehicle, which is essentially a server on wheels. Add to that industrial, medical and IoT scenarios enhanced by 5G networking. Security not only needs to be integrated, but also managed over the lifetime of many different devices, some of which may last a decade with embedded memory. Memory-heavy applications remain the most appealing to hackers. Encryption key management remains critical for securing systems, said analyst Thomas Coughlin. Baking security into embedded systems is increasingly important as non-volatile memory technology proliferates. That’s because data persists even when a device is powered down. The challenge isn’t so much adding security features, Coughlin said. Data on an SSD can be encrypted, for example. “The big issue is whether it’s easy for the user to use these features because usually the weakest link is the human link.” The smartphone serves as an authentication agent, with biometrics replacing the traditional password. That scenario leaves open the possibility that unencrypted data can be exposed accidentally. Coughlin said the danger lies in implementation flaws or complexity. “Making security easy is the key, and that goes beyond encrypting data and putting it into the hardware.” Encrypting SSDs goes only so far, said Scott Phillips, vice president of marketing for Virtium, an SSD and memory vendor. A multi-layered, managed approach is needed. While storage specifications such as the Trusted Computing Group’s Opal spec can reach the BIOS level for pre-boot authentication, configurations and centralized management are critical to guard against hacks, Phillips said. “Even a decent-sized company doesn’t enable a lot of holistic, sophisticated security,” he added. As 5G ramps up, efforts are underway to enable data path protection across to the data center and between, but challenges remain to realize the benefits of hardware-based security. Integration requirements In industrial markets, consolidation requires integration of different systems. Meanwhile hyper-scalers such as Amazon Web Services and Microsoft Azure are promoting data security, said Phillips. Still, those defenses must be implemented all the way to the end user. Despite a growing list of standards and requirements, compatibility issues remain for security methodologies. Vendors are still trying to position themselves as leaders in secure products and services, said Phillips. “Hackers are always one step ahead,” he added. “They know where all those little loopholes are. Those are the things they check for. It takes really a centralized, super-meticulous IT person or department to go through and close all those loopholes.” The idea of embedding security into a memory device rather than bolting it on is not unlike software approaches. “DevSecOps” is about making security and privacy integral to the application development process. An emerging framework dubbed “confidential computing” is designed to protect data in use by isolating computations within a hardware-based trusted execution environment (TEE). Data is encrypted in memory, and elsewhere outside the CPU, while it is being processed.
Security memory
Intel SGX enables the creation of a trusted execution environment is a secure area of a main processor that guarantees code and data loaded inside is protected with respect to confidentiality and integrity.
Confidential computing is being promoted by both software and hardware vendors, including Google, which recently announced capabilities to apply it to container workloads, Intel also enables TEEs for cloud providers such as Microsoft Azure through its Intel Software Guard Extensions. Confidential computing requires shared responsibility for security. Simon Johnson, senior principal engineer for Intel’s Product Assurance and Security Architecture, said humans remain the weakest link. Intel’s supports developers in executing code to secure data, Johnson said. Meanwhile, the confidential computing movement stems from enterprise requirements to process data without regard to origin, including sensitive healthcare information, financial records and intellectual property. Johnson said the platform provider shouldn’t be able to see data. “You want to keep as many people out of your things as possible.” Intel SGX includes hardware-based memory encryption that isolates specific application code and data in memory. It allows user-level code to allocate private memory “enclaves,” designed to be isolated from processes running at higher privilege levels. The result is more granular control and protection to prevent attacks such as cold boot attacks against memory in RAM. The Intel framework is also designed to help protect against software-based attacks even if the operating system, drivers, BIOS or virtual machine manager are compromised. Confidential computing would enable workloads such as analytics on large data sets not owned by the user. It also enables the execution of encryption keys closer to the workload, improving latency. “Today we really only have software to provide protections,” Johnson said. “We don’t have hardware protections on those sorts of environments.” Confidential computing would protect either the processing of data or code, said Johnson, through hardware and the software ecosystem, represented by the Confidential Computing Consortium’s mandate. Ease of use nearly always boosts security, noted Virtium’s Phillips. Push-button memory encryption is the goal, “whereas full security will come from additional functions on top of that,” he added. The idea is not just to encrypt the memory but to guarantee full data isolation to ensure a secure environment, he said. “Confidential computing is a wider story than just encrypting the memory.” It’s also about accommodating a heterogeneous world. “When data is in use, you’ve got to provide a layer of access control and be able to demonstrate that you’re using the software, and that data is in a certain area. It builds all these things up a ladder.”

Leave a comment