Dr. Nigel Edwards

When the data is loaded into the virtual machines, it's encrypted in system memory.

It's only decrypted when it's loaded into the processor within the context of the virtual machine.

So if your malicious system administrator tries to load that data into the processor, because they're not inside the virtual machine, they're just a sysadmin on the system logged in as root, all they're going to see is encrypted data.

It'll look like random data then.

will use a secret key to decrypt the data.

So it's then available in clear to the legitimate processes that are allowed to access the data.

The idea of protected enclaves, protected execution environments has been around for a very, very long time.

Several decades, I would say.

The two dominant data center processor vendors have had capabilities going back, I think, to the mid sort of, you know, 2015, 2016.

But they were following a different approach, and so it really wasn't taking off.

And earlier this decade, that changed when the two major x86 vendors, still the dominant in the data center, adopted a common approach based around virtual machines.

So now you can start to use this with a common set of abstractions.

Back maybe 10 years or so ago, we were working on memory fabrics and memory-driven computing.

The idea was that there would be massive amounts of data, which surely we're seeing, and that this couldn't be processed in a single place.

We would have to have distributed memory and distributed computation devices.

And when you look inside a modern server chassis, that is indeed what is happening.

So out of our memory-driven computing work and work on memory fabrics, when we looked at that, we realized, well, actually, when you have all these different components that involve processing the data,

How do you know that nothing's gone wrong?

How do you know they're all in a good state?

How do you protect that data?