When you run your AI models and send sensitive data to the cloud, do you really know who has access to them?
Although most companies believe their data is safe inside virtual machines (VMs), the reality is different. In a traditional cloud environment, the service provider (host), its operating system, the hypervisor, or any user with root privileges can access your machine's memory at any moment. That means your proprietary AI models, prompts, and confidential RAG documents lie fully exposed on someone else's hardware.
History has already given us serious breaches such as the Venom vulnerability (which allowed access to data in another VM through flaws in the hypervisor) or L1TF (where data leaked between VMs sharing the processor's L1 cache).
The conclusion is clear: traditional cloud AI demands a complete redefinition of security. The solution lies in a technology called TEE (Trusted Execution Environment).
The evolution of security: from protection rings to TEE
To understand TEE, we need to see where earlier technologies fell short in the context of the modern cloud:
- Protection Rings: This architecture isolates software within the operating system itself (e.g. Ring 0 for the kernel, Ring 3 for applications). However, it offers zero protection if the hypervisor or the host itself is compromised.
- TPM (Trusted Platform Module): A TPM is excellent for building a chain of trust during system boot, verifying that software has not been tampered with. However, it does not protect the confidentiality of data while applications are actually running.
This is where TEE (Trusted Execution Environment) enters the stage. A TEE is a hardware-isolated, encrypted environment inside the processor itself that guarantees two key things:
- Confidentiality: No external entity (not even a root user or the provider's hypervisor) can see the data or the code.
- Integrity: No outside party can modify the data or the code while it is executing.
The key to success: Remote Attestation
How can we trust hardware sitting in a remote data center? The answer is remote attestation.
- Fingerprint generation: The TEE generates a unique "fingerprint" (hash) of the code and configuration currently executing.
- Signing: It signs that fingerprint with a unique private key fused into the processor at the factory.
- Verification: An external verifier (e.g. Intel or AMD) checks that signature against the manufacturer's root certificate.
- Key delivery: Only once attestation succeeds does the KMS (Key Management Service) hand over the decryption keys. Data is never decrypted in an unverified environment.
Several leading implementations are on the market today: ARM TrustZone (splits the CPU into a "secure" and a "normal" world), Intel SGX (creates small, isolated "enclaves" for applications), and the more modern Intel TDX, which isolates entire virtual machines from the rest of the system.
The GPU security gap and NVIDIA Confidential Computing
Although TEE processors were revolutionary, the AI industry quickly ran into a huge problem. AI models don't run on CPUs - they demand graphics processors (GPUs).
In standard TEE systems, data would be safely decrypted inside the CPU and then sent to the GPU. However, the path between the CPU and the GPU (the PCIe bus) was completely unprotected. Anyone with physical or root access to the server could intercept data on the PCIe bus.
The solution came with NVIDIA Confidential Computing (CC) technology (available on the A100, H100, and newer architectures).
NVIDIA CC extends the trust boundary directly to the GPU through the following process:
- Encryption in transit: Data stays encrypted while traveling across the PCIe bus.
- Hardware handshake: The CPU and GPU establish a direct, secure communication channel over PCIe using the SPDM protocol.
- Dual attestation: Both the CPU (e.g. via Intel) and the GPU (via NVIDIA) must independently pass remote attestation. Only then does the KMS unlock the data directly inside the GPU's secure enclave.
The price of maximum security?
Implementing NVIDIA Confidential Computing brings minimal performance loss. Tests show the overhead (speed lost to encryption and verification) is just 5% to 10% compared to standard, unprotected GPU operation.
For companies handling medical data or financial reports, or protecting proprietary AI models worth millions, that is a negligible price for absolute privacy in the cloud.
What's the next step?
In an era where AI is becoming a core competitive advantage, data security is no longer optional - it is a precondition for success. TEE and NVIDIA Confidential Computing are changing the rules of the cloud game, enabling companies to retain full ownership and privacy over their AI operations.
Our team is already actively researching the integration of these technologies - analyzing cloud providers that offer advanced TEE and NVIDIA CC architectures and tracking their cost-to-performance ratio, so we can provide our clients with maximally secure AI environments.
Kada pokrećete AI modele i šaljete osjetljive podatke u cloud, da li zaista znate ko sve ima pristup njima?
Iako većina kompanija vjeruje da su podaci sigurni unutar virtuelnih mašina (VM), stvarnost je drugačija. U tradicionalnom cloud okruženju provajder usluga (host), njegov operativni sistem, hipervizor ili korisnik sa root privilegijama mogu u svakom trenutku pristupiti memoriji vaše mašine. To znači da vlasnički AI modeli, promptovi i povjerljivi RAG dokumenti leže potpuno izloženi na tuđem hardveru.
Istorija već bilježi ozbiljne propuste, poput Venom ranjivosti (pristup podacima iz jedne VM u drugu preko hipervizora) ili L1TF (curenje podataka između VM-ova koji dijele L1 keš procesora).
Zaključak je jasan: tradicionalni cloud za AI zahtijeva potpuno novi pristup sigurnosti. Rješenje leži u tehnologiji koja se zove TEE (Trusted Execution Environment) - pouzdano okruženje za izvršavanje.
Evolucija sigurnosti: od zaštitnih prstenova do TEE-a
Da bismo razumjeli TEE, treba vidjeti gdje su ranije tehnologije zakazale u modernom cloudu:
- Zaštitni prstenovi (Protection Rings): Arhitektura koja izoluje softver unutar samog operativnog sistema (npr. Ring 0 za kernel, Ring 3 za aplikacije). Međutim, ne štiti vas ako su hipervizor ili host kompromitovani.
- TPM (Trusted Platform Module): Odličan za lanac povjerenja pri podizanju sistema (boot), jer provjerava da softver nije mijenjan. Ipak, ne štiti povjerljivost podataka dok aplikacije rade.
Tu na scenu stupa TEE. To je hardverski izolovano i šifrovano okruženje unutar procesora koje garantuje dvije ključne stvari:
- Povjerljivost (Confidentiality): Nijedan vanjski akter - čak ni root korisnik ni hipervizor provajdera - ne može da vidi podatke ili kod.
- Integritet (Integrity): Niko sa strane ne može da izmijeni podatke ili kod dok se izvršavaju.
Ključ uspjeha: daljinska atestacija (Remote Attestation)
Kako vjerovati hardveru u udaljenom data centru? Odgovor je daljinska atestacija.
- Generisanje otiska: TEE pravi jedinstveni „otisak“ (hash) koda i konfiguracije koji se trenutno izvršavaju.
- Potpisivanje: TEE ga potpisuje privatnim ključem koji je fabrički utisnut u procesor.
- Provjera: Vanjski verifikator (npr. Intel ili AMD) upoređuje potpis sa korijenskim sertifikatom proizvođača.
- Isporuka ključeva: Tek kada atestacija uspije, KMS (Key Management Service) šalje ključeve za dešifrovanje. Podaci se nikad ne dešifruju u neprovjerenom okruženju.
Na tržištu danas vode: ARM TrustZone (dijeli CPU na „sigurni“ i „obični“ svijet), Intel SGX (male izolovane enklave za aplikacije) i moderniji Intel TDX, koji izoluje cijele virtuelne mašine od ostatka sistema.
Sigurnosni jaz na GPU-u i NVIDIA Confidential Computing
Iako su TEE procesori donijeli preokret, AI industrija se brzo suočila s drugim problemom. AI modeli se rijetko vrte samo na CPU-u - trebaju im grafički procesori (GPU).
Kod standardnih TEE sistema podaci se bezbjedno dešifruju u CPU-u, pa se šalju na GPU. Međutim, veza između CPU-a i GPU-a (PCIe magistrala) ostajala je nezaštićena. Ko ima fizički ili root pristup serveru, mogao je da presretne podatke na toj vezi.
Rješenje je NVIDIA Confidential Computing (CC) (dostupno na A100, H100 i novijim arhitekturama).
NVIDIA CC proširuje granicu povjerenja do GPU-a ovako:
- Šifrovanje u prenosu: Podaci ostaju šifrovani dok putuju PCIe magistralom.
- Hardversko uspostavljanje veze (handshake): CPU i GPU uspostavljaju direktan, siguran kanal preko PCIe veze koristeći SPDM protokol.
- Dvostruka atestacija: I CPU (npr. preko Intela) i GPU (preko NVIDIA) moraju nezavisno proći daljinsku atestaciju. Tek onda KMS otključava podatke unutar sigurne enklave GPU-a.
Kolika je cijena maksimalne sigurnosti?
NVIDIA Confidential Computing donosi mali pad performansi. Testovi pokazuju da je overhead (gubitak brzine zbog šifrovanja i provjera) od 5% do 10% u odnosu na nezaštićen rad GPU-a.
Za kompanije koje rade s medicinskim podacima, finansijskim izvještajima ili štite vlasničke AI modele vrijedne milione, to je zanemarljiva cijena za privatnost u cloudu.
Šta je sljedeći korak?
U eri u kojoj AI postaje konkurentska prednost, sigurnost podataka više nije opcija - preduslov je za uspjeh. TEE i NVIDIA Confidential Computing mijenjaju pravila u cloudu: kompanije mogu zadržati puno vlasništvo i privatnost nad AI operacijama.
Naš tim već istražuje integraciju ovih tehnologija - analizira provajdere koji nude napredne TEE i NVIDIA CC arhitekture i prati odnos cijene i performansi - kako bismo klijentima osigurali što sigurnija AI okruženja.