What is confidential computing? TEEs and remote attestation explained
Confidential computing protects code and data while a processor is using them. The useful version of the idea starts with a threat model, not an encryption slogan.
Direct answer
Confidential computing protects data in use by running code inside a hardware-based, attested trusted execution environment. A TEE isolates selected code and data from parts of the host stack; remote attestation gives another party signed evidence about that environment before it releases secrets or sensitive work.A precise definition
The Confidential Computing Consortium defines confidential computing as protecting data in use by performing computation in a hardware-based, attested trusted execution environment. “Hardware-based” supplies a root of trust below the ordinary software stack. “Attested” matters because isolation that cannot be independently evaluated asks the customer to trust an operator statement.CCC
This closes a different gap from encryption at rest and encryption in transit. Storage encryption protects persisted bytes; TLS protects data crossing a network; a TEE is intended to reduce exposure while code is actively processing plaintext. A complete system normally needs all three.CCC-TECH
| Data state | Typical control | Primary purpose | Common residual risk |
|---|---|---|---|
| At rest | Disk, object, or database encryption | Protect stored data and media | Keys or plaintext can still be exposed at runtime |
| In transit | TLS or another protected channel | Protect network traffic | Either endpoint can still inspect the data |
| In use | Hardware-backed TEE plus attestation | Constrain who can observe or alter active computation | Application bugs, output leakage, denial of service, and side channels remain system concerns |
How a trusted execution environment works
A TEE establishes an execution boundary whose security properties do not depend entirely on the host operating system or hypervisor. Depending on the platform, the protected unit may be a small enclave, an entire confidential virtual machine, or a combination of a confidential VM and an attached accelerator. Memory encryption is one mechanism; integrity controls, measured launch, protected CPU state, firmware policy, and device isolation determine the actual boundary.CCC-TECH
- Data confidentiality: unauthorized entities outside the boundary should not be able to read protected data while it is in use.
- Data integrity: those entities should not be able to silently alter protected runtime data.
- Code integrity: the code admitted to the environment should not be replaceable without detection.
- Attestability: the platform can produce verifiable evidence about its identity, configuration, and measured state.
Remote attestation is the decision point
Remote attestation is a protocol, not a badge. In the IETF RATS architecture, an Attester produces Evidence. A Verifier evaluates that evidence with reference values, endorsements, and appraisal policy, then returns an Attestation Result. A Relying Party uses that result in its own authorization decision.RATS
- Measure: the platform records security-relevant identity and state, such as firmware, launch measurements, debug policy, and device mode.
- Produce evidence: a hardware-rooted signing chain authenticates those claims.
- Appraise: a verifier checks signatures, freshness, reference values, revocation status, and policy.
- Authorize: a relying service decides whether to release a key, model, dataset, credential, or job.
What confidential computing protects—and what it does not
| Usually in scope when designed correctly | Not automatically solved |
|---|---|
| A malicious or compromised host OS or hypervisor reading protected memory | Vulnerabilities inside the guest application or model-serving stack |
| Unauthorized modification of protected pages or CPU state where integrity is supported | Secrets intentionally written to logs, outputs, crash dumps, or unprotected storage |
| Inspection by routine infrastructure administration paths inside the stated threat model | Denial of service, capacity withdrawal, or traffic analysis |
| Verification of measured platform claims before key release | Proof that the measured application is correct, unbiased, or free of backdoors |
| Protected CPU-to-GPU execution on a supported end-to-end platform | Any GPU merely because it shares the same architecture name |
When enterprises need it
Confidential computing is most useful when the data or model must run on infrastructure operated by a party that should not receive plaintext access. That includes cross-organization analytics, sensitive AI inference, regulated data processing, sovereign deployments, proprietary model weights, and high-value key operations. It is less compelling when the organization already controls the entire physical and administrative stack and the remaining risks sit mainly inside the application.CCC
- The infrastructure administrator is in the threat model, not only external attackers.
- The workload owner can define acceptable measurements and operate or trust an independent verifier.
- Secrets can remain withheld until evidence passes policy.
- The surrounding data path—storage, network, logging, support, and outputs—can preserve the same boundary.
- The team accepts platform-specific lifecycle work for firmware, drivers, attestation policy, and incident response.
A buyer’s evaluation checklist
- Write the adversary list first: cloud operator, data-center technician, hypervisor administrator, another tenant, guest administrator, application maintainer, or some combination.
- Draw the plaintext path from ingress through preprocessing, CPU memory, accelerator memory, storage, logs, telemetry, and outputs.
- Name the exact CPU, GPU, firmware, driver, and confidential mode—not just the cloud product label.
- Obtain sample evidence and document who verifies it, against which reference values, with what revocation and freshness rules.
- Test failure behavior: the system should withhold keys and data when debug mode is enabled, a measurement drifts, or evidence is stale.
- Measure workload performance in the real topology; transfer-heavy patterns can behave differently from compute-heavy patterns.
Frequently asked questions
Is confidential computing the same as encryption?
No. It is a system for protecting data while computation is happening, usually using memory encryption plus isolation, integrity controls, measured state, and attestation. It complements encryption at rest and in transit.
Does bare metal count as confidential computing?
Not by itself. Dedicated hardware reduces multi-tenant exposure, but it does not automatically prevent a host administrator, firmware path, or physical operator from observing data in use. Confidential computing requires a defined hardware-backed TEE and attestation.
Does attestation prove that an application is secure?
No. Attestation supports claims about identity and measured state. A verifier still needs reference values and policy, and the measured software can still contain vulnerabilities or unsafe behavior.
Sources
- CCCConfidential Computing: Hardware-Based Trusted Execution for Applications and DataConfidential Computing Consortium
- CCC-TECHA Technical Analysis of Confidential ComputingConfidential Computing Consortium
- RATS
- NVIDIA-CC
Relevant GPU availability
Verified specifications, confidential-mode support, and public listings for the accelerators this post covers.
Ready to reserve capacity?
Confidential Nodes matches bare-metal confidential GPU nodes to workloads, with verified provider data behind every listing.