Confidential Computing with Conclave

In my previous blog, I introduced how confidential computing can be a useful tool to help us better protect our data while it is in use. This article will show you the platform that R3 has developed to make confidential computing application development easier.

Introducing Conclave

Conclave is a revolutionary new platform from R3 that enables the development of solutions that securely pool and process sensitive data from multiple parties. It leverages cutting-edge technologies like confidential computing and Intel® SGX.

Intel Software Guard Extensions (Intel® SGX) offer hardware-based memory encryption that isolates specific application code and data in memory. Intel® SGX allows user-level code to allocate private regions of memory, called enclaves, which are designed to be protected from processes running at higher privilege levels.

There are many ways to use confidential computing, but utilizing hardware (enclaves) is by far the most cost-efficient and effective way to adopt the concept.

As it says in the quote, the enclave will block all access to the data while it's being used. Therefore, we are technically assured that the data used in the enclave is protected and won't be tampered with during computation.

Components of a Conclave application

There are three parts to a Conclave application—the host, enclave and the client.

• The host starts the enclave and passes data between the client and the enclave. Since the host is still operating in an operating system, we will view it as an untrusted environment.
• The enclave is the isolated in-memory engine that will run your confidential computing applications.
• The client is the external communication port that sends encrypted data to the enclave to process. However, the client does not directly communicate with the enclave. All of the data is passed to the host and the host will deliver it to the enclave.

Data communication with Conclave

The communication between the components is handled by the Mail API. The API makes it easy to deliver encrypted messages that only the enclave can read. Here's how it works: data is packaged in a mail, and each mail has two parts—the header and the body. The header can store strong sequence numbers, which can help hold multiple conversations simultaneously. Mail also can be used by an enclave to persist (sealed) data. There may be a situation where the enclave stops and has to be restarted. It may want to save the unprocessed data somewhere and retrieve it when it is started again. As of now, this is handled by the enclave. By sending mail to itself, the enclave can store chunks of data that will be fed back to it at startup. And again, this is done with the help of the Mail API.

I hope you will find that this article answers some of the questions you have about Conclave and confidential computing. In my next blog post, I will start covering some of the implementation details of a Conclave application. Stay tuned!

Want to learn more?

Want to learn more about Conclave and confidential computing in the meantime? Here are some helpful resources:

• Check out the Conclave docsite.
• Explore our repository of sample Conclave applications.