WIXLIB

Solution Brief5G Communications Service ProvidersConfidential ComputingConfidential Computingfor 5G NetworksThe solution ecosystem for 5G network security includes the Fortanix confidentialcomputing environment, which enables network operators to run code inIntel SGX enclaves, deployed in containers using Red Hat OpenShift , withouttailored development.As communication service providers (CoSPs) refine their strategic courses for the 5G era, migrating to cloud-nativearchitecture offers significant advantages. An architecture based on cloud-native network functions (CNFs)—developed asmicroservices and deployed in containers—dramatically increases the environment’s flexibility, agility, and scalability. Theability to reconfigure the network on demand means that new services can be brought to market rapidly, and because changesare enacted in granular, modular microservices, discrete changes can be rolled back with minimal disruption to increaseresilience and reduce business risk.The shift to cloud-native comes at a time when CoSPs must manage multiple simultaneous transitions. In place of the singlevendor proprietary interfaces that predominated in previous technology generations, a service-based architecture is theemerging standard, combining network functions from multiple vendors. Each network function exposes a service-basedinterface that enables components to be interconnected using Web APIs in a software-defined infrastructure that can berecomposed at will. Rather than being centralized, as in previous network generations, 5G network functions are highlydistributed, from the network core to the edge, across multiple clouds.The Rising Importance of Confidential Computing in a 5G WorldThese transitions dramatically change the security landscape for 5G, as there are more vulnerable areas. A few examples ofthe enlarged attack surface and novel challenges for protecting data in use are shown in Figure 1. The traditional networkperimeter has vanished, and data must be protected while in use at the level of the individual network function. Confidentialcomputing protects data that would otherwise be exposed in RAM while a workload is operating, complementing protectionsfor data at rest and in transit, which are provided by data and transport-channel encryption, respectively.5GSecure web-based HTTP SBI mesh using TLS-private keyslocked downNSSFNnssfSecure network access to vertical industries(key amfNsmfAUSFAMFSMFN1N2N4UEUE AUSF UDMauthentication is fully encrypted andprivate keys must be locked down(R)ANN3UPFN5DNUser plane will distribute to non-secure locations.Requires UP encryption & acceleratoin LI & billing privacyFigure 1. Increased 5G attack surface and challenges for protecting data in use.

Solution Brief Confidential Computing for 5G NetworksIntel Platform Support for 5G Use CasesTogether with other hardware security measures such as crypto acceleration, Intel SGX enables a range of 5G use cases,including the following: Confidential communication for service-based architecture Secure authentication and secure converged edge Secure federated multitenant content delivery Secure communication edge-to-core and between networks Assured integrity of billing information with an audit trailConfidential computing is chiefly concerned with isolatingdata from other workloads operating in their sharedmulti-tenant, multicloud infrastructure, preventing bothinadvertent and malicious leaks. A prevalent approach is toprovide an isolated trusted execution environment (TEE),where code can be run beyond the reach of outside software.CoSPs use TEEs to help meet challenges associated withprotecting data in use by highly distributed 5G services infunctional areas such as the following:CPU PACKAGERAMCORESAMEX: 3224134584-26864Jco3lks937wENCLAVE Service-based architecture web-based integrationof network functions, protected using transport layersecurity (TLS) Key management for secure network access extendedto in dustry partners and customersSnoop Authentication with the Authentication Server Function(AUSF) and unified data management (UDM)Snoop Distributed user plane, including to non-secure physicallocationsIn addition to isolation, TEEs provide assurance to outsideentities that the code running inside them has not beencorrupted or tampered with through the process ofattestation. By attesting to the authenticity of its workload,a TEE can therefore give the CoSP’s remote partnersand customers confidence that the destination they areconnecting to is legitimate and trustworthy, as well as beingprotected from interception by third parties.Figure 2. Data and code protection in Intel SGX enclaves.EnclaveAPPAPPProtected Enclaves with Intel Software GuardExtensions (Intel SGX)Intel SGX is a set of processor instructions supported by3rd Gen Intel Xeon Scalable processors that is used forpartitioning a region of memory as a secure enclave thatisolates and protects specific data and code, as shown inFigure 2. The contents of the enclave are encrypted using acryptographic key generated within the CPU, and likewise,the data and code are only decrypted inside the CPU. Thisarrangement protects data and code from compromise withinRAM or in transit between the CPU and RAM.The enclave prevents data from being leaked to othersoftware running on the same platform, including otherworkloads as well as processes running at high privilegelevels, such as the OS, hypervisor, BIOS, or firmware. The useof enclaves therefore dramatically reduces the attack surface,as shown in Figure 3.APPOSHYPERVISORHARDWAREConventional Attack SurfaceAttack Surface with Intel SGXFigure 3. Reduced attack surface.2

Solution Brief Confidential Computing for 5G NetworksThe native method of adapting software for use with IntelSGX is for the developer to identify the sensitive portionof the application—designated the trusted portion—anddefine an enclave for it to operate within by using the IntelSGX SDK. The Intel SGX enclave is deployed as a sharedlibrary. The remaining, untrusted portion of the applicationoperates outside the enclave, and Intel SGX treats it ascompromised by default. The trusted and untrusted portionsof the application communicate with each other using specificIntel SGX instructions. The Intel Attestation Service plays avital role in establishing and maintaining the trusted status ofcode by enabling applications to verify the following factorscryptographically: The code is running as-built in a genuine enclave The hardware is a secure Intel SGX-capable platform withall needed microcode updates applied All necessary Intel SGX hardware and softwareconfigurations are made correctlyFortanix solutions help streamline the implementationof confidential computing based on Intel SGX for 5Gapplications, including efficient attestation for 5G virtualizednetwork functions (VNFs) at scale.Platform Capabilities that ComplementIntel SGX3rd Gen Intel Xeon Scalable processors incorporatemultiple hardware-resident security features that workin conjunction with Intel SGX. The following features areof particular interest to CoSPs as they deploy 5G networkfunctions: Built-in crypto acceleration. To help CoSPs handlethe performance impact of pervasive encryption in 5G,platform results include up to 4.2x higher TLS encryptedconnections per second.1 Intel Platform Resilience. To protect fundamentalplatform firmware components, this Intel FPGA-basedsolution establishes a chain of trust and verifies firmwareimages before execution.Data Security Manager Data Security ManagerData Security Manager provides acloud-ready unified HSM, KMS, andKMIP solution with FIPS 140-2 Level3 certification.Confidential Computing with Fortanix SolutionsFortanix technologies implement Intel SGX across a rangeof confidential computing functions, as illustrated in Figure4. The Fortanix Data Security Manager implements IntelSGX in its key-management service (KMS), which providessecure generation, storage, and use of cryptographic keys,certificates, and secrets. Runtime Encryption Technologyprovides a comprehensive environment for developing,operating, and maintaining Intel SGX enclaves.Enclave OS is the runtime environment for code to run insideenclaves, based on simply repackaging existing imageswithout requiring any changes to application binaries.The ability to run existing software without modificationdramatically reduces the time, cost, and complexityassociated with deploying it in a confidential computingenvironment. Enclave OS operates a root of trust establishedin the CPU to create a region of memory that is inaccessibleto any process outside the application itself, regardless ofprivilege level. The CPU autonomously generates the keythat it uses to encrypt this memory on the fly, using a secretprovisioned at the time of manufacture, so the key is neverexposed outside the CPU itself.The Confidential Computing Manager is a cloud-native SaaSenvironment that provides a single pane of glass for managingsecure enclaves and confidential computing nodes, onprem or in any cloud or hosted environment (on nodes thatsupport Intel SGX). It controls the enclave lifecycle, includingenablement for policy enforcement measures on runningapplications. For example, whitelisting allows applicationsto run only on a predefined list of hosts, providing addedassurances of integrity and protection. Geofencing restrictsthe geographic area within which an application can run in amulticloud environment, for regulatory and audit purposes.The Confidential Computing Manager also performs highlyefficient attestation services, with minimal burden placed ondevelopers and network operators.The Enclave Development Platform (EDP) is an open sourceenvironment for writing Intel SGX enclaves from scratch,using the Rust programming language. The design of theEDP is optimized by years of in-house use by Fortanix todevelop various products, making it exceptionally efficientand developer-friendly. Rust combines high computationalperformance with built-in code safety measures, especiallyfor safe concurrency and memory safety. The Rust compilerRuntime Encryption Technology ENCLAVE OSConfidential ComputingManagerRuntime Encrytion allows you torun any application unmodifiedinside Intel SGX.Figure 4. Fortanix technology portfolio for confidential computing.EDPThe Enclave Development Platformbrings best of Rust and Intel SGX.3