The
Azure Boost confidential device feature is now in preview.
Azure Boost
is a Microsoft Azure system that offloads virtualization tasks—such as
networking, storage, and host management—from the hypervisor and host OS to
purpose-built hardware and software, freeing CPU resources for customer
workloads while enhancing security through physical isolation and hardware root
of trust. By reducing maintenance impact and improving scalability, Azure Boost
enables faster, more secure, and highly efficient cloud operations for
demanding workloads.
The Azure
Boost confidential device feature is designed specifically for upcoming versions
of Azure confidential VMs and will allow the confidential computing trust
boundary of these VMs to be extended into the Azure Boost card using the PCIe
TDISP standard. This standard supports hardware-based attestation of the Azure
Boost card and hardware-based encryption of the PCIe data path. This feature
will enhance confidential VM performance by eliminating the need for a “bounce
buffer” when sensitive data within the trust boundary of the confidential VM is
shared outside of that trust boundary. This feature will deliver faster data
movement, reduce CPU overhead, and improve confidential VM performance without
compromising security.
Learn more.