Protect your data with the broadest selection of data security and encryption technologies from IBM Z, IBM LinuxONE, and Intel® Xeon®
Trusted Security for Mission-Critical Enterprise Workloads
Confidential Computing with IBM includes a range of services from the IBM Confidential Computing on IBM Z and LinuxONE portfolio and Intel® Xeon portfolios spanning containers, key management services, and high-performance computing (HPC) to help ensure data confidentiality and code integrity.
Protect data across the entire compute lifecycle
For years, cloud providers have offered encryption services to help protect data at rest and data in transit, but not data in use. Confidential computing protects data during processing by performing computation in a hardware-based, trusted execution environment (TEE), which eliminates the remaining data security vulnerability.
- IBM Confidential Computing product family
- Intel® Xeon®-based IBM Cloud Bare Metal
- Intel® Xeon®-based IBM Cloud Virtual Servers with Intel® TDX
The IBM Confidential Computing product family utilizes IBM Secure Execution for Linux technology to safeguard the entire data lifecycle. These confidential computing solutions offer enhanced privacy assurance, designed to keep full control over data at rest, in transit, and in use. They provide an integrated developer experience, allowing you to ensure that even system administrators, container platform administrators or service providers cannot access sensitive data and containerized applications or solution stacks.
Intel® Xeon®-based IBM Cloud Bare Metal and Virtual Servers with Intel® SGX® help protect data in use via application isolation technology. By protecting selected code and data from modification, developers can partition their application into hardened enclaves or trusted execution modules to help increase application security. All Intel® SGX® confidential computing on IBM Cloud runs on 4th Gen Intel® Xeon® processors, the newest generation of HPC microarchitecture with built-in Intel® Accelerator Engines, improved power efficiency, DDR5 memory and PCIe 5 support.
Intel® Xeon®-based IBM Cloud Virtual Servers with Intel® TDX aim to provide an additional layer of security through hardware-based isolation and encryption. By running virtual servers within an encrypted enclave, Intel TDX helps ensure that data is protected from unauthorized access, even from IBM Cloud. This creates a multi-tenant cloud environment designed for security by heightening trust for critical applications and strengthening data sovereignty for peace of mind and compliance.
Address your security concerns when you move mission-critical workloads to hybrid cloud through a variety of as-a-service solutions based on x86 hardware technology. You have exclusive control over your encryption keys, data, and applications to meet data sovereignty requirements.
Quickly scale out and maintain maximum resiliency while protecting your workloads at-rest, in-transit, and now in use inside the logically isolated IBM Cloud VPC network. Choose from a variety of virtual server profile sizes and pay-as-you- use options needed to protect your applications.
Ensure maximum confidentiality for your applications and data through fine-grained runtime isolation, encrypted contracts, and secure enclaves. Prevent unauthorized access, even from IBM Cloud infrastructure admins, with zero trust enforcement and remote attestation. This ensures that your data and code is not altered at any time.
Products and services
Resources
Intel TDX on 4th Gen Intel Xeon Now Available on IBM Cloud in Frankfurt. On 4th Gen Intel Xeon processors, Intel TDX adds minimal performance overhead while maintaining full virtualization flexibility – ideal for enterprise-grade confidential workloads.
Offer clients a secured and scalable pathway to integrate their preferred processors and cloud environments, helping to reduce the time to market for new deployments.
Intel Trust Authority is designed to deliver reliable attestation for Intel TEEs. It complements IBM Cloud confidential computing solutions with Intel TDX and Intel SGX by helping organizations validate platform trust across their environments.
Shows more details about the IBM Confidential Computing: the underlying technology and how the services support your hybrid cloud strategy.
Introduces how you can leverage confidential computing to solve your business challenges and achieve unparalleled security.
Learn more about how IBM Confidential Computing protect your data with a special focus on key management.
Introduces the basics of confidential computing, how it works, and why it is so important.
Learn more about Intel® SGX and Intel® TDX inside IBM Cloud Virtual Servers for VPC, including step-by-step instructions for enabling a confidential computing profile, secure boot, and attestation.
Provisioning a bare metal server with Intel® SGX®.
Introduces the latest high-performance compute microarchitecture behind confidential computing with Intel® SGX® on IBM Cloud servers.
Frequently asked questions
Confidential Computing refers to the protection of data in use by performing computation in an attested, hardware-based Trusted Execution Environment (TEE), ensuring data is encrypted and isolated during processing. IBM Confidential Computing Platform utilize this concept to protect mission-critical workloads and sensitive data.
Operational assurance ensures that the operations conducted by service providers and others are compliant and do not intentionally or unintentionally compromise security. This is based on operational measures - which are breakable resulting in the need to trust.
Technical assurance ensures that the security features are ingrained in the technology, and it is technically impossible for unauthorized access or changes to occur. This ensures that data is secured at all times, without the need to trust any person or organization to not exploit privileged access in the case of internal or external attacks.
IBM Confidential Computing Platform leverages IBM Secure Execution for Linux technology that includes hardware and firmware features such as memory encryption, encrypted contracts, and an Ultravisor to create isolated, secure environments for workloads.
Intel® Software Guard Extensions (SGX) protects your data through hardware-based server security by using isolated memory regions that are known as encrypted enclaves. This hardware-based computation helps protect your data from disclosure or modification. Which means that your sensitive data is encrypted while it is in virtual server instance memory by allowing applications to run in private memory space. To use Intel® SGX®, you must install the Intel® SGX® drivers and platform software on Intel® SGX®-capable worker nodes. Then, design your app to run in an Intel® SGX® environment.
Intel Trust Domain Extensions (Intel TDX) is Intel's newest confidential computing technology. This hardware-based trusted execution environment (TEE) facilitates the deployment of trust domains (TD), which are hardware-isolated virtual machines (VM) designed to protect sensitive data and applications from unauthorized access. A CPU-measured Intel TDX module enables Intel TDX.