Linux Conversations | Episode 5: Securing the Untrusted: How Confidential Computing Protects Your Data with Joerg Roedel

March 13, 2025 | By: Sebastian Martinez

SUSE Linux

Welcome back to “Linux Conversations,” our blog series where we chat with SUSE experts about the challenges and innovations shaping the world of Linux. In this episode, we’re diving into the world of Confidential Computing with Joerg Roedel, a Linux kernel developer at SUSE. Confidential Computing is revolutionizing how we protect sensitive data in untrusted environments, and SUSE is at the forefront of this exciting technology.

Join us as we explore what Confidential Computing is, how it works, and why it’s crucial in today’s world of cloud computing and edge deployments. Joerg will share his insights on the technology, its benefits, and how SUSE is enabling its customers to leverage its power.

Interview

Rick Spencer: Joerg, can you tell me a little bit about your role at SUSE and how long you’ve been working here?

Joerg Roedel: Hey Rick, thanks for having me. I’ve been with SUSE for 11 years now. I started as a Linux kernel developer, and in recent years, I’ve been focusing on Confidential Computing and making our products ready for all kinds of Confidential Computing workloads and hardware.

Rick Spencer: Confidential Computing is an interesting topic, and I think SUSE is quite innovative in this space. But can you explain what Confidential Computing means at a high level?

Joerg Roedel: Sure, Confidential Computing is a set of technologies that allows customers to stay in control of their data by protecting it at runtime. This means the data is encrypted while it’s being processed in the memory of the machine. Customers also get cryptographic proofs of the software that is operating on your data.

Rick Spencer: What’s the upshot? So, for instance, you can have a sensitive workload running on the cloud, and even the cloud provider can’t steal the data because it’s encrypted, right?

Joerg Roedel: Right. It enables customers to run sensitive workloads in untrusted environments like the cloud. When using Confidential Computing technologies, the cloud service provider has no way to access your data. Data Security is always guaranteed by the Confidential Computing hardware and the technologies built on top of it.

Rick Spencer: How does the system work? It sounds complex.

Joerg Roedel: On a low level, it works with hardware extensions added by CPU vendors. These allow you to create a trusted execution environment on the CPU, isolated from the rest of the system. Most extensions today use a virtualization-based approach. You can run a confidential virtual machine which is encrypted. This means the memory and all related states of that virtual machine are encrypted and not visible to the rest of the system, including the hypervisor as operated by a cloud service provider. The hardware guarantees that they cannot access the data or influence the execution flow within the virtual machine.

Rick Spencer: So, it’s encrypted nonsense to them. And this takes both a hardware and a software side. As a kernel developer, you must be working with our hardware partners.

Joerg Roedel: Yes, we work a lot with our hardware partners to enable these technologies. It’s not only about CPU enablement but also about platform hardware that provides Confidential Computing features. The first part was always kernel enablement for the guest side, making the Linux operating system ready to run in a confidential virtual machine. We achieved this some time ago, SUSE Linux Enterprise Server and all our products can run in all confidential guest environments on the market. But there’s also the virtualization side, where we are still working on full support. We currently provide it as a technology preview for certain platforms, allowing customers to run confidential virtual machines on their own hardware.

Rick Spencer: So that’s like providing a hypervisor that is Confidential Computing capable. What sort of workloads have people expressed interest in running on Confidential Computing environments?

Joerg Roedel: The first adopters are highly regulated industries like banking, finance, insurance, healthcare, military, and the public sector. A big use case is confidential AI. Customers want to ensure their training data and models stay secure.

Rick Spencer: That makes sense. You need to make sure your model hasn’t been tampered with.

Joerg Roedel: Right. And also, make sure nobody can steal your model.

Rick Spencer: I usually think about Confidential Computing in the context of cloud providers, but it sounds valuable for edge deployments too. You might have thousands of devices deployed worldwide, and you can’t have an armed guard for each one. This way, you could run more sensitive workloads in those edge environments.

Joerg Roedel: Right. edge devices are usually not physically protected like a machine in your data center. So they need better protection against external tampering. This is a primary use case for Confidential Computing. First, you can protect the workloads by encrypting them, making it impossible for an attacker to steal the processed data. But another important aspect is attestation. It allows customers to ensure their edge devices are running the intended software. It’s a powerful tool to cryptographically prove the integrity of the software stack.

Rick Spencer: So if I try to slip in a different Linux kernel or something naughty into the stack, the cryptographic signature would change, and the hypervisor would reject it. That attack vector is blocked.

Joerg Roedel: Right. When someone tries to inject malicious software into your edge device, you can detect that. You get a cryptographic measurement of everything running there, and if you find something unexpected, the usual response is to disable the device. This ensures that none of your data is stolen and that the edge device is doing what it’s supposed to do.

Rick Spencer: This sounds valuable. Is there a way for anyone to try it today?

Joerg Roedel: Yes. Our Linux products run seamlessly as guests in Confidential Computing environments. Different cloud service providers already have confidential VM offerings where our customers benefit from that. For customers who want to try the hypervisor side, we offer the Confidential Computing module for SUSE Linux Enterprise Server 15 SP6, currently in tech preview. It’s based on the distribution code base, so the difference from a stock SUSE Linux Enterprise Server installation is minimal. This can be used today to run confidential virtual machines yourself today on supported hardware.

Rick Spencer: So, users of 15 SP7 and 16 will be able to use Confidential Computing as hosts and guests?

Joerg Roedel: With 15 SP7, we are moving the Confidential Computing hosts feature on AMD hardware to a fully supported state. Others remain in tech preview due to our upstream-first policy. We can only fully support features which are enabled in the upstream projects. But for others, we continue to provide the tech preview with 15 SP7.

Rick Spencer: But that’s pretty cool. Okay, anything else you want to add?

Joerg Roedel: Just that it’s amazing to work on the edge of the latest open source technology and use it to enhance data security for our customers. Confidential Computing brings them more flexibility on where to run sensitive workloads and also enables a whole bunch of new use-cases.

Conclusion

Joerg’s insights into Confidential Computing highlight its growing importance in protecting sensitive data, particularly in untrusted environments like the cloud and edge deployments. SUSE’s commitment to enabling Confidential Computing capabilities in its products underscores its dedication to providing robust security solutions for its customers.

As the use cases for confidential computing expand, from protecting financial data to securing AI models, SUSE’s leadership in this space will undoubtedly contribute to building a more secure and trustworthy digital future. We hope you found this discussion insightful.

If you are interested, you can read my past blog about this topic, titled: Confidential Computing. Enabling Enterprise Innovation While Securing Your Data

Linux Conversations | Episode 5: Securing the Untrusted: How Confidential Computing Protects Your Data with Joerg Roedel

Interview

Conclusion

More from this Series:

Related Articles

Mac meets SUSE Edge: Deploying Linux, K3s & Rancher with EIB

AI’s Role in Compliance and Governance in Evolving Regulatory Environments

Empowering Innovation: Celebrating Partner Excellence

CentOS Alternatives: Migrating Workloads From CentOS To OpenSUSE Leap – Migrating your webserver