Confidential computing solutions
Alibaba Cloud confidential computing is built on hardware-based trusted execution environments (TEEs). It uses a hardware root of trust to measure the boot chain, memory encryption to ensure data confidentiality at runtime, and remote attestation to provide verifiable trust credentials. This creates a closed-loop security model covering the entire data lifecycle, from boot to runtime and verification. By also encrypting data at rest and in transit, this solution delivers end-to-end security for sensitive workloads, ensuring that data is "usable but not visible" on the cloud.
Key features
Rich security features: Provides transparent memory encryption and vTPM for trusted boot, along with multi-architecture confidential computing capabilities, including Intel SGX, Intel TDX, and DragonWell Enclave, for both CPU and GPU workloads. This delivers end-to-end data protection from boot to runtime.
Outstanding computing performance: The 9th-generation ECS instance (g9i) combines vTPM and Intel TDX technology to deliver powerful CPU performance and low-latency I/O. You can run high-throughput workloads without compromising on security.
Comprehensive data security: In partnership with the Anolis Community, this solution provides open-source options that integrate storage and transport encryption to achieve end-to-end data security across both CPU and GPU computing architectures.
Enterprise-grade reliability: It provides enterprise-grade stability with a service level agreement (SLA) of 99.975% for single ECS instance availability. For deployments across multiple availability zones within a single region, the SLA is up to 99.995%.
Security architecture
Best practices
Scenario 1: End-to-end AI inference security
Large language model (LLM) inferencing often involves sensitive data and valuable model assets that are vulnerable in traditional environments. The confidential AI solution uses hardware-based confidential computing technologies, such as Intel TDX and GPU TEEs, to create an end-to-end security barrier for your inference workloads.
Use cases: AI inference workloads that require strong security for prompts and model assets.
Advantages:
Zero code changes: Enables smooth migration of your workloads without requiring changes to business code or images.
High security: It provides end-to-end encryption and hardware-based isolation to ensure data is "usable but not visible".
Related documentation: Securely deploy a vLLM inference service in a heterogeneous confidential computing cluster of ACK
Scenario 2: Confidential computing for sensitive data
This scenario lets you create encrypted images in a trusted environment, ensuring your data remains encrypted at all times on the cloud. The instance runs in a confidential environment and receives the decryption key only after remote attestation verifies its trustworthiness. This ensures that you maintain full control over your keys, which are never exposed to the cloud platform.
Use cases: Computing tasks involving high-value data, such as financial data, healthcare records, and personally identifiable information (PII).
Advantages:
Easy to implement: Compatible with containerization and can be directly integrated as a node, making it transparent to upstream applications.
Full control: Data on the cloud is fully encrypted, and you retain exclusive control over your keys.
Related documentation: System disk measurement and encryption protection for confidential computing instances
Scenario 3: Protecting wallet private keys with DragonWell Enclave
In this scenario, you deploy your core wallet service as a container within a confidential DragonWell Enclave environment. Remote attestation, along with strict Resource Access Management (RAM) policies and key management, ensures that only the intended software artifact can access credentials, preventing any unauthorized access.
Use cases: Digital wallet providers and customers who require a high level of protection for their credentials.
Advantages:
Developer-friendly: It supports containerized delivery of software artifacts and is not dependent on specific languages or frameworks.
Minimal isolation: The DragonWell Enclave environment has no persistent storage or external network access. It communicates only through a restricted vsock, which minimizes the attack surface.
Hardware-level security: Credentials are stored in a hardware security module (HSM), and only verified software within the enclave can access them.
