Safer spaces: How Confidential Computing can grow secure data collaboration

This article includes content from “What happens here stays here: Confidential City (and Space)” of the Cloud Security Podcast. 

Identifying fraud and detecting money laundering are challenging tasks for banks, insurance agencies, and other financial institutions. They need to collaborate to accurately and quickly track and stop criminal activity, but that collaboration comes with a catch: It must be done within the bounds of existing regulations. 

Today, a new era of privacy-enhancing technology is emerging to help organizations make the most of the latest cloud capabilities without compromising privacy and other regulations. Generally, Confidential Computing uses hardware-based security to isolate data from untrusted code while it’s being processed. Google Cloud’s Confidential Computing technology can enable data sharing needed to prevent fraud, even if that data is highly sensitive, subject to strict regulatory requirements, or shared from companies that compete against each other.

Confidential Space, one of our Confidential Computing solutions, allows multiple data contributors to work together and conduct joint analysis without losing control over how their data is used and who is authorized to work with it. This made it an appealing solution to MonetaGo, a fraud prevention company that focuses on global trade. 

“With Confidential Space, our customers don’t have to worry about [data] compromise when sharing data,” said Brendan Taylor, chief technology officer, MonetaGo, when Google Cloud debuted Confidential Space last year. “The prevention of fraud helps accelerate growth, which we can achieve while maintaining privacy and enabling critical real-time decision making. Our solution not only helps financial institutions to address the huge amounts of value lost each year due to a lack of information sharing, but most importantly should help millions of businesses get better access to working capital.”

When Confidential Space was in development at Google Cloud, it was known by the codename Las Vegas, said Rene Kolga, senior product manager for Confidential Computing at Google Cloud, during a recent episode of our Cloud Security Podcast. 

“As the saying goes — anything that happens in Vegas, stays in Vegas, and that’s exactly what Confidential Space allows our customers to do,” Kolga said.

The potential of data-sharing and other emerging technologies, such as Cloud Computing and AI, remains constrained by vital data privacy regulations and legitimate concerns about protecting intellectual property from competitors. Too often, progress comes at the price of privacy, and vice versa, leaving huge stores of sensitive data untouched when it comes to generating new business value.

“The encryption of data-at-rest and in-transit has been around and is well known, but what about data-in-use?” said Kolga. “Prior to Confidential Computing, there wasn’t really a way to protect data or machine learning models while they were being used or processed.” 

Google Cloud’s approach to Confidential Computing creates a layer of cryptographic isolation to protect data, automatically encrypting data in memory, and generating unique encryption keys that are known only to the processor.  

“The customers control what their collaborators can do with their data, what they can access, and what they cannot access,” Kolga said.

It’s a game changer for data security, making it easier for organizations to protect their increasingly multicloud technology stacks and sensitive personal data while enabling the collaboration needed to nurture future growth. 

Unfortunately, enabling multi-party collaborations like these can be incredibly difficult, especially in highly-regulated industries burdened by privacy rules and requirements. 

“When we talk about multi-party, none of the parties actually trust each other,” said Nelly Porter, group product manager of Confidential Computing at Google Cloud, during the same podcast.

After all, how can you let people work with your data without actually sharing it with them? As it turns out, you can do it with Confidential Computing. 

A safe, secure space to collaborate

What Confidential Space brings into play are new capabilities to protect against the workload operator.

“This is why it’s so critically important,” Porter said. “It means that if somebody is nominated to run and host a pipeline and workload, they can not cheat. They can not get access to the sensitive data of everyone else.” 

An easier way to understand how this works is to imagine that two banks want to team up to identify fraudulent activity, such as money laundering. Sharing data is a tricky business — not only are they competitors but also financial institutions that have strict regulations like PCI compliance or GDPR.

As long as these institutions can agree on fraud detection code or model, they could run their analysis in a Confidential Space across their joint dataset. This can be accomplished without having to give up any control over their data.

“It’s sharing data without sharing data,” Kolga explained. “You share data with some code, with some workflow, that you have together created or have agreed upon. The data is only seen by the code but not by the collaborators.” 

Welcome to the new age of data security

Conceptually, Confidential Computing may not sound all that different from other existing privacy-preserving mechanisms, such as differential privacy or zero-knowledge proofs. However, as Porter pointed out on the podcast, these are highly sophisticated mathematical techniques to accomplish a similar goal. 

“The problem is that it’s not generic enough. It’s very tied to specific queries and specific implementations of algorithms,” Porter said. “We’ve found that we have so many variations of what people need to do together, and we needed something more general.”

The growing importance of Confidential Computing is just another step towards the vision of ensuring data is protected, no matter its state — and making it as easy to implement as possible. Teams can encrypt data and models in use without any extra code changes, isolating it in multitenant environments and preventing unauthorized access by cloud providers or other threats. 

“It unlocks some cool use cases that weren’t previously possible,” Kolga said. “It’s all about secure multiparty collaboration where multiple teams within the same organization or multiple external organizations can perform computation on super sensitive data together without sharing that data with each other. ”

In addition to financial services companies such as MonetaGo, healthcare and medical technology companies can tap into machine learning to improve diagnostics or pharmaceutical development without any fear of compromising patient data, or facing compliance penalties for violating international data privacy laws. Ad techs worried about the demise of third-party cookies will have more freedom to enable privacy-preserving analytics in a trusted environment. 

In addition, Web3 companies can instantly transact digital assets, allowing distributed collaborators to implement multi-party computation (MPC) models. These solutions enable an auditable signing process without exposing their private signing keys to anyone else, including the platform operator. 

And these use cases are just the beginning. Porter’s advice to organizations looking to improve the confidentiality of their data and provide higher-level guarantees for data security is to think about hardware-based controls. 

“It’s still an emerging technology. It’s still the future, and we still have serious work to do to explain the full value it provides,” Porter said. “We strongly believe that Confidential Computing will be an enabler for many exciting use cases to help customers collaborate securely while preserving privacy.”

For more on Confidential Computing, you can listen to the Cloud Security Podcast here and check out our latest Confidential Computing announcement from the RSA Conference.