In confidential computing, even we can't access your data: top IBM exec

In a Q&A, Dr Nataraj Nagaratnam, CTO, IBM Cloud Security says the client's data is always the client's, and that his firm does not use their data for anything else whatsoever

A rising technology in the area of cloud storage today is confidential computing. Broadly, the technology allows a company running workloads in the cloud to maintain full privacy and control over their data and storage, without even the company hosting the cloud space to gain access to data. IBM is one of the first few companies to offer this as a part of its cloud portfolio. Dr Nataraj Nagaratnam, IBM Fellow and Chief Technology Officer, IBM Cloud Security spoke to Neha Alawadhi about the applications of the technology and the way forward.

What is confidential computing?

From an IBM perspective, we have always been underlining the fundamental policy and strategy flow from a customer perspective. Their data is their data, we do not use their data for anything else. We do not use their data to do marketing or anything of that sort. From that angle, we not only have a policy, we wanted to make sure that we also back it up with technology and solutions. The confidential computing and the portfolio capabilities we provide are (meant) to achieve the ultimate total privacy assurance, for customers to be assured of the data privacy, data protection of their confidential and sensitive data. Because ultimately in chapter two of cloud, it's all about data. Customers are looking at moving more contracts into the cloud but they are worried. We are providing the technical assurance, and computing is a fundamental enabler and a strategy for us.

At what stage of deployment is the technology? 

It's definitely real, and customers are using it. The industry definition of confidential computing is data in (its) use. But the way we look at it is different. If you write down something in a paper and put it somewhere, and if someone steals it in clear text, that's data at rest. But when you send it over a courier, and someone is able to intercept and look at it, that's data in transit or in use. 

What kind of enterprises or businesses are using this technology?

For example, Daimler (owner of Mercedes-Benz) is a manufacturing facility for the automobiles that it globally delivers. And it wanted to make sure from a European Union perspective, that its data belongs to it. And even the cloud provider cannot access the data. And IBM is only cloud provider who was able to do that to them. Where even if data is at rest, or in transit, it is their data. Similarly for financial services players like Bank of America.

In healthcare, we work with Apple. There is the Health app, they have an SDK that can integrate with the backend. Apple is serious on security on the mobile side, they wanted to partner with someone who has the expertise and the conviction to make that on the server side, and they worked with us to use Hyper Protect services (IBM's confidential computing product) to make that happen. 

From an IBM perspective, is confidential computing part of existing services or products or will this be structured as a separate offering?

It is already part of IBM Cloud. These are capabilities and products that are offered as part of IBM Cloud. For customers who use IBM Cloud, they can leverage a set of complex computing technologies to protect their data. We were the first ones to introduce these technologies, starting with blockchain in 2015. And then with Hyper Protect services, the first in the industry to roll it out globally.

What are the industries that are using confidential computing and how is the journey of the technology in India versus other geographies?

It is across industries, be it financial services, healthcare, insurance, industry, even manufacturing and automobiles. Many of our customers are global companies that we work with. And they in turn, work with companies in India and Asia. So from that aspect, we are working with companies who have presence in India or they are making it available, the customers may not even know that they're using because it's in the backend. 

Is confidential computing mainstream yet?

I think from an awareness perspective, we're only getting there now. Technology wise, awareness is there. I would definitely say from a hype cycle, adoption perspective, it is very early stages. But what needs to be understood there is when we use confidential computing, look at the business problems that are being solved.