In this post, we’ll show you how to build a Personal Identifiable Information (PII) - protecting web application architecture using Azure confidential computing (ACC). ACC completes your traditional cloud privacy with protections for data in use based on state-of-the-art hardware available in Azure today.
The diagram below showcases a typical architecture pattern for hosting a web application (e.g. On-Premises or Cloud Platform):
Typical architecture for a web application
The problem with this typical approach is that malicious actors could gain access to, as well as manipulate, sensitive data running on this architecture. For example:
Curious VM admin - with access to application logs can manipulate sensitive application logs, e.g. to erase a subset of the history.
Curious host/provider admin - with access to the underlying Hypervisor can access the Virtual Machines.
Azure confidential computing enhances the security posture of your applications by protecting data and code when in use, that is when running and being processed in memory. This additional level of protection elevates the existing security posture in Azure by running application in hardware-encrypted trusted execution environments.
All components of this architecture, including Sensitive Data, Sensitive Data Encryption Keys, Sensitive Application Logic and Sensitive Application logs - are hosted at or above the blue dotted line highlighted below:
Trust boundary across Azure confidential computing services.
To transform an existing (or net-new) application to leverage confidentiality via ACC – the following activities can be easily accomplished for each of the 3 tiers of the application: Data, Code and Logs:
Sensitive Data: For an existing database, to migrate the data to Azure SQL DB – Always Encrypted with secure enclaves, we can leverage any of the migration techniques available with Azure SQL DB today. For a net new database, we can leverage several techniques to hydrate our database – as illustrated in this repository via T-SQL.
Sensitive Application Code: Azure Confidential VM with AMD EPYC 3 Sev-SNP allows us to lift-and-shift existing application logic - meaning there are no code changes expected of our application to take advantage of the elevated confidentiality. Any web app framework (see demo below for a simple ASP.NET example) can continue to function as is.
Sensitive Application Logs: To programmatically send sensitive application logs to Azure Confidential Ledger, we can use any of the SDKs available. In the demo below, we use the Python SDK from PyPi for demonstration – at the time of writing Java and .NET SDK are available as well.
A live demonstration of this architecture pattern is showcased in the short demo video below. In this demonstration, we leverage a Confidential VM to emphasize one core point - no code changes are required of an existing application (in our case, an ASP.NET Web App) to run on an AMD Sev-SNP enabled Virtual Machine on Azure: