Google Cloud is ramping up production of its latest security offering, Confidential VMs, which allows users to encrypt sensitive data in the cloud while it is being processed, also known as confidential computing.

After four years of research and development, Google Cloud fully rolled out its Confidential VM services this week to nine regions in the U.S., Asia and Europe, according to Ulku Rowe, technical director of financial services.

Encrypting in-use sensitive data and IP in the cloud allows banks to collaborate with third parties in real time — modeling, indexing, querying data — while preserving privacy. Confidential computing has been called the next frontier in security.

A handful of the largest cloud providers launched their confidential computing products only this year. In October, Amazon World Services debuted its version of confidential computing with the AWS Nitro Enclaves extension, and Microsoft Azure released its DCsv2-series VMs to the market in April. IBM was ahead of the pack when it announced its generally-available confidential computing capabilities back in 2018.

Competition aside, some of the biggest names in tech are working together to advance the technology and use of confidential computing. In 2019, the Confidential Computing Consortium formed with the goal to create industrywide standards and promote the development of open source confidential computing tools. Founding members include: Alibaba, Huawei, Oracle, Tencent, Red Hat and Intel, along with Microsoft, IBM and Google. In June, the consortium grew to 27 members.

Google is embedding itself further into financial services. Read up on the company’s latest banking endeavors here.

Traditionally, cloud providers have offered the ability to encrypt stored data and data in transit, but that requires data to be decrypted for processing. In order to encrypt data while it is in use, Google Cloud had to innovate with its CPUs [central processing units].

The CPU architecture required to process the amount of memory necessary for confidential computing did not exist until about three years ago, according to Nelly Porter, the senior product manager leading Google’s cloud security team and confidential computing efforts.

Google Cloud uses specific servers from AMD, which have next-gen CPUs with an extension called “Secure Encrypted Virtualization,” on which Google has built its product, Porter said. Keys used to decrypt the data are kept within the hardware itself. This has allowed for a more efficient way to encrypt memory, while limiting risk as the keys aren’t accessible or extractable by software — only the hardware has the ability to operate the key.

It’s the real-time aspect of the processing that requires this complex architecture, Porter said. “When you process your data or your workloads, you load it in memory,” she said. However, every time there’s a change to — or manipulation of — the data or the application, latency increases. “The memory that you need to encrypt simultaneously and keep it encrypted all the time, it’s tremendous; you’re talking about almost terabytes of memory,” she said.

Ease of use was a key priority for Google Cloud’s confidential computing team. For financial institutions already operating VMs, enabling the Confidential VM capability on existing or new workloads comes to down to clicking a box on Google Cloud’s console, and no code changes are necessary, Porter said.