Google Cloud Unveils Confidential VMs to Protect Data in Use

Confidential Virtual Machines, now in beta, will let Google Cloud customers keep data encrypted while its in use.

Google Cloud today announced a confidential computing feature called Confidential Virtual Machines, which keeps data encrypted while its being processed. Confidential VMs is the first product in Google Clouds confidential computing lineup, and its now available in beta.
While Google Cloud already encrypts data at rest and in transit, information must be decrypted for organizations to use it. Businesses with vast amounts of cloud data want to query and index their data or use it to train machine learning models. Most in regulated industries, including financial, healthcare, and government sectors, worry about protecting their data in the cloud.
In addition to the isolation and sandboxing Google already uses in its cloud infrastructure, its Confidential VMs will include memory encryption so businesses can further isolate workloads in the cloud. Confidential computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU), Google Cloud explains in a blog post.
Your data will stay encrypted while it is used, indexed, queried, or trained on,
according to the post
. Encryption keys are generated in hardware, per VM, and not exportable.
Confidential VMs run on second-generation AMD Epyc processors and leverage a feature called Secure Encrypted Virtualization, or SEV. This enables high performance while keeping the VM memory encrypted using a dedicated per-VM key generated and managed by the Epyc CPU. These keys are generated by the AMD processor during the creation of each VM and reside only within the VM, so theyre inaccessible to Google and other VMs running on the same host.
The way we implement this technology offers real time encryption in use, so customers can ensure confidentiality of [their] most sensitive data in the cloud even while its being processed, Sunil Potti, general manager and vice president of security for Google Cloud, said in a press briefing.
Confidential VMs are built on Shielded VMs to further harden the OS image and confirm the integrity of the firmware, kernel binaries, and drivers, officials say. Shielded VMs are a precursor to Confidential VMs in terms of security, Potti said. The new technology builds on the protection Shielded VMs provide against rootkits and bootkits to ensure integrity of the operating system.
Google worked with AMD to ensure the memory encryption doesnt interfere with performance by adding support for new OSS drivers (NVMe and gVNIC) to handle storage and network traffic with higher throughput than older protocols. Use cases of Confidential VMs include collaborating on sensitive data sets and conducting research without affecting the datas confidentiality.
All Google Cloud Platform workloads that currently run in VMs can also run as a Confidential VM, the company says. Businesses only need to check a box to enable it.
Related Content:
7 Tips for Effective Deception
Crypto-Primer: Encryption Basics Every Security Pro Should Know
How Enterprises Are Developing and Maintaining Secure Applications
Decoding the Verizon DBIR Report: An Insiders Look Beyond the Headlines

Register now for this years fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for detail on
conference information
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Cloud Unveils Confidential VMs to Protect Data in Use