TechPrufer
Get started
Google
Google logoGoogle · Feature trail

Confidential Computing and Attested Encryption

4 posts · Aug 2023 – Aug 2026

What this trail covers

Google Cloud's Confidential Computing, specifically Confidential Space and Oak Functions, enables the creation of end-to-end confidential services. This involves hardware-level protection for data during processing, with attestation providing verifiable proof of the environment's integrity and the identity of the running code. Oak Session provides application-level, end-to-end encryption over load-balanced connections, using the Noise framework for a smaller, auditable cryptographic footprint. The GenC open-source project simplifies the use of Confidential Computing with Gemma models for private generative AI applications, enabling hybrid architectures with on-device and cloud-based TEE processing.

All Google trails
  1. Introducing Credentio: Open Source C++ Library for C2PA Content Credentials from Google- Google Developers BlogIntroduced Credentio, an open-source C++ library for C2PA Content Credentials, enabling local-first validation for performance, privacy, and scalability. This library removes the need for cloud-based validation, offering zero bandwidth overhead, instant validation verdicts, and complete data privacy. It features a high-performance engine with a small memory footprint, detailed validation capabilities including trust list integration and comprehensive parsing, and flexible trust management. The library is designed for developers building C2PA validator products and plans to expand to include generation of Content Credentials.
  2. Don't Trust, Verify: Building End-to-End Confidential Applications on Google Cloud- Google Developers BlogThis post details the architecture and implementation of building end-to-end confidential services on Google Cloud using Confidential Space and Oak Functions. It introduces Oak Session, an open-source library for application-level end-to-end encryption over load-balanced connections, utilizing the Noise framework and attestation for verifiable proof of integrity and workload identity. It explains how to establish trust by verifying JWTs, binding verification keys, session tokens, and container identities, and discusses endorsement strategies for trusted OCI registries.
  3. Enabling more private generative AI- Google Developers BlogIntroduces GenC, an open-source project that simplifies the integration of Confidential Computing (specifically Confidential Space TEEs) with Gemma open-source models for private generative AI applications. Details a hybrid architecture using on-device Gemma 2B and cloud-hosted Gemma 7B within a TEE, connected via a model cascade. Explains the attestation process for verifying TEE integrity and the use of an Intermediate Representation (IR) for portable and language-independent deployment. Provides a Python code example demonstrating the setup.
  4. Expanding our Fully Homomorphic Encryption offering- Google Developers BlogIntroduced new tools to expand Fully Homomorphic Encryption (FHE) capabilities for video files and other complex data. This includes a TensorFlow-to-FHE compiler for trained ML models, the Jaxite software crypto library for running FHE on hardware accelerators (GPUs, TPUs), and the Homomorphic Encryption Intermediate Representation (HEIR) open-source compiler toolchain for FHE program interoperability. The TensorFlow-to-FHE compiler can compile TensorFlow Lite models to FHE, achieving private inference in 16 seconds for a 3-layer neural network. Jaxite leverages JAX for FHE computations on accelerators. HEIR is built on MLIR to lower barriers to privacy engineering and research.