Today we are excited to announce the general availability of Azure IoT Edge security with enclaves to help protect sensitive assets and workloads at runtime when deployed to an IoT Edge enclave enabled device.
A major roadblock to edge computing and Internet of Things (IoT) experiences is the risk of exposing sensitive assets and workloads to exfiltration or malicious tampering. Sensitive assets include proprietary algorithms, private data, artificial intelligence models, and real-time computational insights, while sensitive workloads entail edge computing on sensitive assets which in some cases create valuable insights that generate actions to directly control critical infrastructure. While these assets and workloads can be secured in transit and storage using encryption, they become vulnerable at runtime when they are decrypted for execution. The lack of solutions protecting the confidentiality of sensitive assets and workloads has held back IoT solution operators from distributing rich cloud computing experiences to the edge, until now.
The solution builds on the robust edge compute application deployment mechanism of Azure IoT Edge to encrypted workloads (and data) known as trusted applications or simply TA, to Azure IoT Edge enclave enabled devices for safe and secured execution inside of enclaves. The TA is encrypted from when it leaves the developer build machine to when it lands inside of the devices trusted execution environment (TEE) or enclave where it is decrypted for safe execution.
We previously announced a public preview of this solution in a blog post where we detailed the types of blocking challenges and showed how a true solution requires deep integrations and collaboration with ecosystem partners. These integrations and collaboration are necessary to abstract the complexities away from IoT solution builders so they can focus on respective business transformations. We highlighted one example of the requisite collaboration of ecosystem partners to simplify this experience. We have since maintained focus and now observing dividends such as from this example alone, a solution builder is now able to:
- Procure an Azure IoT Edge certified and enclave enabled device such as Scalys TrustBox Edge that features collaborative integration of Arm® TrustZone®, NXP Layerscape®, and Confidential Computing Consortium (CCC) governed Open Enclave SDK OSS secure technologies for the trusted execution environment.
- Procure the device as a commercial off-the-shelf product from global distributors such as Arrow.
- Optionally download and install Open Enclave extension for Visual Studio Code to help facilitate development, debugging, and deployment of trusted applications.
- Optionally setup service level contracts with Scalys for device management and updates.
In general, the ability to deploy TA is available now on IoT Edge certified enclave enabled devices built on Arm TrustZone® and Intel® Software Extension Guard (SGX®) technologies. Building on Open Enclave SDK means you only develop once and deploy to both Arm and Intel platforms. Moreover, Open Enclave SDK automatically opens possibilities for rich cloud-edge confidential computing patterns such as:
- Asymmetrical compute workload distribution e.g. train ML models in the cloud rich environment and only inference in resource constrained edge devices.
- Cloud-to-edge end-to-end confidential computing with workloads encrypted everywhere except for TEE at the edge or in the cloud e.g. deploy the same workload in Azure IoT Edge enclave at the edge or Azure Confidential Computing virtual machines in the cloud.
Our commitment to simplifying confidential computing in collaboration with a wide ecosystem of partners is yielding greater maturity to Open Enclave SDK, developer tooling, and availability of commercial off-the-shelf IoT Edge enclave enabled devices. We now offer secure deployments of trusted applications from cloud to edge at scale because of these accomplishments.
What’s Next
Simplifying confidential computing is a massive undertaking anywhere and more so at the edge where collaboration between many ecosystem roles and stakeholders must thrive to succeed. Delivering an end-to-end deployment experiences is a major success milestone but there’s always opportunity for continuous improvements, such as in attestations in which you can check out our progress with Microsoft Azure Attestation.
We now invite you to unleash your rich edge compute experiences with greater confidence:
- Watch a demonstration of confidential ML inferencing using Azure IoT Edge enclaves
- Learn more about deploying trusted applications with Azure IoT Edge
- Learn more about Azure IoT Edge
- Learn more about Open Enclave SDK
- Learn more about confidential computing on Azure
- Learn more about Microsoft Azure Attestation
- Become an active participant in the Confidential Computing Consortium