confidential computing
When you run a program on someone else's computer — a cloud server you do not own — you normally have to trust the operating system, the hypervisor, and the cloud operator, all of which can see your data while it runs. Confidential computing aims to protect your data and code even from those powerful insiders, using special hardware. Picture renting a safe-deposit box in a bank where even the bank staff cannot open it: the bank provides the vault and the power, but only you hold the key, and the contents stay private even from the people running the building.
It works through a hardware enclave, also called a trusted execution environment. The CPU itself carves out a protected region of memory whose contents are encrypted and whose access is blocked to everything outside it — including the operating system and the hypervisor that would normally have total power over the machine. Code and data are decrypted only inside the CPU, while it is actually computing; in memory and on the bus they stay encrypted. A second key feature is remote attestation: the hardware can produce a cryptographic proof of exactly what code is running inside the enclave, so a remote party can verify it is the genuine, unmodified program before sending it secrets. This shrinks the trusted computing base — the set of things you must trust — down toward just the CPU and your own code.
The honest limits are important and often overstated in marketing. An enclave protects data in use, but it does not make a buggy program inside it secure — vulnerabilities in your enclave code can still leak the very secrets it holds. The hardware itself becomes part of the trusted base, and real enclave designs have suffered side-channel attacks that infer secrets from timing or cache behaviour. And there is a performance cost to the encryption and the restricted entry and exit. Confidential computing meaningfully raises the bar for protecting data on untrusted infrastructure; it is a strong tool, not an absolute guarantee.
A hospital wants a cloud provider to analyze patient records without ever seeing them. It runs the analysis inside a hardware enclave: the records are decrypted only inside the CPU during computation, the cloud's own OS and administrators cannot read them, and remote attestation lets the hospital verify the exact analysis code before releasing the encryption key.
Data stays encrypted everywhere but inside the CPU, even from the OS itself.
An enclave protects data in use but does not make the code inside it correct. A bug in your enclave program can still leak its secrets, and real enclaves have fallen to side-channel attacks — strong protection, not an absolute guarantee.