Towards Confidential Computing: A Secure Cloud Architecture for Big Data Analytics and AI

Naweiluo Zhou,Florent Dufour,Vinzent Bode,Peter Zinterhof,Nicolay J Hammer,Dieter Kranzlmüller

2023-05-29

Abstract:Cloud computing provisions computer resources at a cost-effective way based on demand. Therefore it has become a viable solution for big data analytics and artificial intelligence which have been widely adopted in various domain science. Data security in certain fields such as biomedical research remains a major concern when moving their workflows to cloud, because cloud environments are generally outsourced which are more exposed to risks. We present a secure cloud architecture and describes how it enables workflow packaging and scheduling while keeping its data, logic and computation secure in transit, in use and at rest.

Distributed, Parallel, and Cluster Computing,Artificial Intelligence

What problem does this paper attempt to address?

The paper attempts to address the issue of data security in big data analysis and artificial intelligence applications within a cloud environment. Specifically, the authors focus on how to protect sensitive data (such as genomic data in biomedical research) in the cloud, ensuring that this data remains secure during transmission, usage, and storage. To solve this problem, the paper proposes a secure cloud computing architecture that achieves data security through the following methods:

1. **Workflow Containerization and Scheduling**: Encapsulating the user's workflow in encrypted containers and scheduling them through a middleware system to ensure that the workflow remains encrypted during migration between different nodes.

2. **Virtual Machine Encryption**: Using AMD SEV (Secure Encrypted Virtualization) technology to encrypt virtual machines, preventing malicious administrators or compromised hypervisors from accessing data in the virtual machine's memory.

3. **Storage Encryption**: Encrypting data in both local and remote storage to ensure that data is secure at rest. Using the Quobyte storage management system to partition and isolate data, further enhancing security.

4. **Network Isolation**: Implementing network isolation measures to reduce security risks during data transmission.

Through these technical means, the paper aims to provide a secure and efficient cloud computing environment, enabling users to safely handle sensitive data without sacrificing performance.