Confidential Tenancy: Towards Digital Sovereignty on Public Clouds
summary
Proposes extending confidential computing into a full confidential tenancy that isolates an entire cloud account — IaaS, PaaS, SaaS and its management plane — with private identity and key services and tenant-controlled logging. Introduces a virtual data diode implemented via an attested hypervisor (Hyper-V + platform TPM) that binds CPU attestation to platform provenance, enables shared memory for zero‑copy networking, and blocks exfiltration even if TEEs or host components are compromised; prototypes and early defense-sector engagements exist.
AI-written summary · about
chapters (9)
- 0:00Digital sovereignty on clouds
- 1:24Dimensions of sovereignty
- 3:50Threat models for confidential computing
- 6:17Virtual data diodes for TEEs
- 11:56Attested hypervisor design
- 16:31Attested Hyper-V for Windows
- 20:25Extended attestation with dual components
- 21:28Confidential tenancy services
- 24:40Summary and future
related talks
11mLightning Talk: Computing Confidentially in the Clouds
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!
45mConfidential Computing: Protecting Customer Data in the Cloud
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
23mIntegrating Confidential Computing Into Cloud Infrastructure: Challenges and Opportunities
13mVM Security with Confidential Computing
23mConfidential computing: from niche to mainstream
16mIntroduction to confidential computing