SCONE Confidential Computing Environment: Protecting Applications Against
Powerful Adversaries

Abstract

Our objective is to protect the code, data, and keys of applications against all users with access to the computer systems. In some domains (e.g., healthcare domain), this must be guaranteed, even if the application is not entirely correct. To simplify the adoption of confidential computing, SCONE transforms cloud-native applications into confidential cloud-native applications running on vanilla Kubernetes clusters. The applications can run on Intel SGX, Intel TDX, and AMD SEV. In the near future, SCONE will also support confidential GPUs. The confidentiality, integrity, and consistency of an application’s data and keys are guaranteed by always keeping the data encrypted, i.e., at rest, in transit, and in use. This enables us to add a protection layer around applications to prevent data loss caused be bugs and backdoors in the application code.