Confidential Computing on GCP

Confidential Computing is a cloud security technology that encrypts data while it is being processed—i.e., in use. Traditional encryption protects data at rest (storage) and in transit (network), but data in memory (RAM) is typically plaintext and accessible to the host operating system, hypervisor, and anyone with physical access to the server. Confidential Computing addresses this gap by creating a hardware-based Trusted Execution Environment (TEE) that isolates the workload from the host and encrypts memory with a key not accessible to the cloud provider.

On GCP, Confidential Computing is built on AMD EPYC processors with Secure Encrypted Virtualization (SEV) technology. SEV encrypts the memory of each virtual machine (VM) with a unique, ephemeral key generated by the AMD secure processor. The key is never exposed to the hypervisor (KVM) or the host OS. Even Google's infrastructure cannot read the VM's memory. The encryption is transparent to the guest OS and applications—they run normally without modification.

Creating a Confidential VM using gcloud:

gcloud compute instances create confidential-vm-1 \
    --zone=us-central1-a \
    --machine-type=n2d-standard-2 \
    --confidential-compute \
    --shielded-secure-boot \
    --image-family=ubuntu-2204-lts \
    --image-project=ubuntu-os-cloud

Verifying Confidential VM status:

gcloud compute instances describe confidential-vm-1 --zone=us-central1-a --format="value(confidentialInstanceConfig)"

This returns enableConfidentialCompute: true if the VM is a Confidential VM.

Inside the VM, verify SEV is active:

dmesg | grep -i sev

Look for lines indicating SEV is enabled. On Ubuntu, you can also check /sys/kernel/security/sev/.

Attestation Example (using a script): The guest can call the AMD Secure Processor to get an attestation report. Google provides a tool called gcloud confidential-vms attest (part of the gcloud CLI) to fetch and verify attestation reports.

gcloud confidential-vms attest --instance=confidential-vm-1 --zone=us-central1-a

This outputs a signed attestation report in JSON format.

A pharmaceutical company wants to collaborate with a research hospital to analyze patient genomic data without exposing the raw data to each other or to Google. They use Confidential Space, which provisions a Confidential VM with pre-configured secure boot and attestation. Each party uploads encrypted data to Cloud Storage. The Confidential Space VM decrypts the data inside the TEE, runs the analysis, and outputs encrypted results. The VM's attestation report is verified by both parties to ensure no tampering. At scale, they run multiple analyses in parallel using Confidential GKE Nodes. A common misconfiguration is not setting up proper IAM permissions for the Confidential Space service agent, causing attestation failures.

A bank needs to process credit card transactions in a PCI-DSS compliant environment. They deploy their payment processing application on Confidential VMs to ensure that even Google's infrastructure cannot access the cardholder data in memory. They use N2D machine types with Ubuntu 22.04. They enable CMEK for the persistent disks and use Confidential VMs for the compute. They also use Cloud Audit Logs to monitor VM creation. A pitfall: they initially tried to enable live migration, which is not supported, causing VM termination during host maintenance. They learned to use managed instance groups with auto-healing to handle VM replacements.

A startup develops a proprietary machine learning model. They train the model on sensitive customer data using GKE with Confidential Nodes. They create a cluster with a node pool using gcloud container node-pools create with the --confidential-nodes flag. The model and data are protected in memory. They also use Cloud HSM to encrypt model artifacts at rest. A common issue: they forget to use Container-Optimized OS with containerd (the default for GKE), which is required. They also need to ensure the GKE version is 1.23 or later. Performance monitoring shows a 5% overhead on training time due to memory encryption, which is acceptable for their compliance needs.