Your submission was sent successfully! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates from Canonical and upcoming events where you can meet our team.Close

Thank you for contacting our team. We will be in touch shortly.Close

  1. Blog
  2. Article

Canonical
on 14 December 2023

Canonical and Intel’s strategic collaboration brings you confidential computing with Intel® TDX on Ubuntu


Ensuring data security at run-time has long been an open computing challenge and a tough problem to solve. This gap arises because data must be decrypted in system memory for processing, even when it is stored encrypted. This exposes it to a large attack surface of threats posed by potentially malicious system software, such as a compromised operating system, hypervisor, or firmware, as well as individuals with elevated privileges. Confidential Computing is an industry movement to address this security gap, designed to protect data in use.  Intel® Trust Domain Extensions (Intel® TDX) is Intel’s latest addition to their confidential computing portfolio.

To make use of these new hardware primitives, the entire software stack needs to be enlightened. To address this, Canonical and Intel have forged a strategic collaboration, enabling customers to always have access to an Intel-optimised Ubuntu build, which has all the latest necessary end-to-end host-to-guest patches available by default, even before they make it upstream. As the upstreaming process progresses, these patches will subsequently also become available on the generic Ubuntu images. 

Intel® TDX on 5th Gen Intel® Xeon Scalable Processors

Intel® TDX introduces new architectural elements that address the challenge of run-time security in virtualised environments head-on. Intel TDX has been designed to establish secure and isolated virtual machines known as trust domains (TDs), and to protect them from various potential software threats, including those originating from the virtual-machine manager and other non-trust domain software on the platform. Intel TDX also strengthens defence against specific physical access attacks on platform memory, such as cold-boot attacks and active attacks on DRAM interfaces. To achieve this, Intel TDX capable CPUs incorporate a new AES-128 hardware encryption engine which encrypts memory pages at run-time, using an encryption key that is protected by the TDX hardware root of trust and is exclusively accessed by the TD guest owner. 

To achieve such strong security guarantees, the solution relies on Intel’s innovations at the silicon level. Initially, this capability was only available on select SKUs of their 4th Gen Intel® Xeon scalable processors, offered via a limited number of public cloud providers. Now, Intel has announced general Intel TDX market availability through its 5th Gen Intel® Xeon Scalable processors, formerly code-named Emerald Rapids. 

5th Gen Intel® Xeon® Scalable processors help maximise the longevity and return on IT investments with compatibility with the previous generation to minimise testing and validation. Intel’s industry-leading portfolio for data security helps unlock opportunities with silicon-based security features and trust services. 

“Intel has a well-established and collaborative relationship with Canonical, and we work closely to enable our security capabilities within the Ubuntu operating environment. Through our collaboration, Canonical now offers an Intel-optimised version of their enterprise distributions that incorporates all the latest Intel TDX architectural elements and innovations in 5th Gen Xeon Scalable processors. This will provide customers with the confidence that their most sensitive data is more secure, while also helping maintain privacy and promote compliance.“– Mark Skarpness, Vice President and General Manager of System Software Engineering, Intel.

“We are excited to extend our long-standing partnership with Intel into Intel TDX! This will enable 5th Gen Intel Xeon Scalable processors’ users to start building their confidential computing infrastructure with Ubuntu today, and benefit from its strong hardware-rooted confidentiality and integrity security guarantees”, said Cindy Goldberg, VP of Silicon Alliance, Canonical.

For customers and end-users eagerly anticipating the hardware upgrade, it fully unlocks the potential of these silicon security innovations and also necessitates enablement at the software level. In the Linux ecosystem, achieving this involves the upstreaming of patches before integration into downstream distributions. This is a time intensive process, and with it comes the imminent risk of a widening gap between silicon innovation and software readiness, which will only get compounded as Intel continues to push the boundaries of hardware innovation for 5th Gen Intel Xeon scalable processors and beyond.

A staged approach to enable Intel® TDX for confidential computing

The results of this strategic partnership are already here, with our recently released Intel TDX private preview on Ubuntu 23.10, it is empowering our customers to confidently start their confidential computing journey with Ubuntu on Intel TDX today, while also laying the groundwork for more extensive and long-term plans for Ubuntu 24.04 LTS and beyond.

Canonical’s vision for Intel TDX on Ubuntu is ambitious and all-encompassing. Once customers acquire a 5th Gen Intel Xeon Scalable processor, they will be ready to easily deploy both an Ubuntu host for Intel TDX with the kernel, Libvirt QEMU, and  Trust Domain Virtual Firmware (TDVF), and an Ubuntu guest Intel TDX VM equipped with the necessary enlightened kernel, Shim, and Grub. 

Fig.1 End-2-End Intel TDX software stack with Ubuntu

Security maintenance and enterprise support

Anticipating Intel TDX’s integration into the generic Ubuntu 24.04 images, Canonical is taking an incremental approach to the level of security maintenance and enterprise support the company offers for these Intel TDX optimised builds. Starting with Ubuntu 23.10, an Intel TDX limited preview is already live for both host and guest enablement, where Canonical provides user-friendly scripts for effortless confidential environment setup. Remote attestation capability is expected by December 2023, and setup assets are accessible on GitHub. Canonical leads first line support during this technical preview, with Intel handling second line support. The 6.5 kernel stays updated with security patches, and user space PPAs for QEMU, Libvirt, and TDVF track upstream changes. 

Looking ahead

This strategic collaboration effort between Canonical and Intel marks a significant commitment to advancing confidential computing. Beyond the immediate benefits of Intel TDX, this partnership seeks to bridge the ever-growing gap between cutting-edge silicon innovation and the software ecosystem’s ability to keep pace. Organisations can now confidently embrace the full potential of Intel TDX, ensuring a secure and optimised experience for end-users.

Furthermore, the availability of Ubuntu-based Intel TDX on many major public cloud providers, including Microsoft Azure and Google Cloud, empowers you to confidently start the development of your multi-cloud hybrid confidential computing strategy with Ubuntu today, providing a unified and secure environment for your computing needs.

Canonical invites you to deploy the Ubuntu Intel TDX build, and share your valuable feedback and questions. Get started with confidential computing and share your feedback with us. Your input is crucial as we collaboratively drive innovation and fortify data security for the future.

Additional resources about TDX and confidential computing

About Canonical 

Canonical, the publisher of Ubuntu, provides open source security, support and services. Our portfolio covers critical systems, from the smallest devices to the largest clouds, from the kernel to containers, from databases to AI. With customers that include top tech brands, emerging startups, governments and home users, Canonical delivers trusted open source for everyone. 

Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries .

Related posts


ijlal-loutfi
3 November 2023

Intel® TDX 1.0 technology preview available on Ubuntu 23.10

Confidential computing Article

Today’s security landscape faces a significant challenge: the lack of adequate protection for data in active use. Data breaches can happen at runtime (that is, when computation is taking place on a machine’s main memory), stemming from a range of vectors such as malicious insiders with elevated privileges or hackers exploiting vulnerabili ...


Michael Hudson-Doyle
12 December 2023

Optimising Ubuntu performance on amd64 architecture

Ubuntu Article

Everyone wants the Linux distribution they are using to be fast. This is practically a content-free statement, of course: who would want their distro to be slow? But at the same time, what does it mean for your distribution to be fast? For example, Ubuntu 21.10 switched the default compression for packages to zstd, which ...


Felicia Jia
8 September 2023

Meet Canonical at Intel® Innovation 2023

Confidential computing Article

Intel® Innovation, one of Intel®’s flagship developer events, continues to span the worlds of architecture innovation, software tools and technology & research. Canonical is proud to be the silver sponsor in 2023 and will demonstrate our joint solutions from cloud to the edge.  As industry leaders in hardware and software, Intel and Canon ...