MACRO NEPAL
GCP Confidential Computing in Java: Complete Guide
awiskar acharya
December 15, 2025
2:45 pm

Introduction to GCP Confidential Computing

Google Cloud Platform (GCP) Confidential Computing provides hardware-based memory encryption and isolation using AMD SEV-SNP and Intel TDX technologies. This enables processing of sensitive data in memory without exposing it to the host system, cloud provider, or other tenants.

System Architecture Overview

GCP Confidential Computing Stack
├── Hardware Security
│   ├ - AMD SEV-SNP (Secure Encrypted Virtualization)
│   ├ - Intel TDX (Trust Domain Extensions)
│   └ - AMD SEV-ES (Encrypted State)
├── GCP Services
│   ├ - Confidential VMs
│   ├ - Confidential GKE Nodes
│   ├ - Confidential Space
│   └ - Confidential Computing Attestation
├── Java Integration
│   ├ - Enclave Runtime
│   ├ - Attestation Verification
│   └ - Secure Channel Setup
└── Application Security
├ - Data-in-Use Protection
├ - Secure Key Management
└ - Trusted Execution Environments

Core Implementation

1. Maven Dependencies

<properties>
<google.cloud.version>2.34.0</google.cloud.version>
<grpc.version>1.61.1</grpc.version>
<protobuf.version>3.25.1</protobuf.version>
<tink.version>1.12.0</tink.version>
</properties>
<dependencies>
<!-- Google Cloud Confidential Computing -->
<dependency>
<groupId>com.google.cloud</groupId>
<artifactId>google-cloud-confidentialcomputing</artifactId>
<version>1.0.0</version>
</dependency>
<!-- Google Cloud KMS -->
<dependency>
<groupId>com.google.cloud</groupId>
<artifactId>google-cloud-kms</artifactId>
<version>${google.cloud.version}</version>
</dependency>
<!-- Google Cloud Secret Manager -->
<dependency>
<groupId>com.google.cloud</groupId>
<artifactId>google-cloud-secret-manager</artifactId>
<version>${google.cloud.version}</version>
</dependency>
<!-- Tink Cryptography -->
<dependency>
<groupId>com.google.crypto.tink</groupId>
<artifactId>tink</artifactId>
<version>${tink.version}</version>
</dependency>
<!-- gRPC for attestation service -->
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-netty-shaded</artifactId>
<version>${grpc.version}</version>
</dependency>
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-protobuf</artifactId>
<version>${grpc.version}</version>
</dependency>
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-stub</artifactId>
<version>${grpc.version}</version>
</dependency>
<!-- Enclave SDK (for Intel SGX/AMD SEV) -->
<dependency>
<groupId>com.intel.sgx</groupId>
<artifactId>sgx-sdk</artifactId>
<version>2.19</version>
</dependency>
<!-- Open Enclave (for cross-platform) -->
<dependency>
<groupId>com.microsoft.openenclave</groupId>
<artifactId>openenclave-java</artifactId>
<version>0.19.0</version>
</dependency>
<!-- Asynchronous operations -->
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
<version>3.5.11</version>
</dependency>
<!-- Secure logging -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>2.0.9</version>
</dependency>
</dependencies>

2. Confidential VM Configuration Service

package com.gcp.confidential;
import com.google.cloud.confidentialcomputing.v1.*;
import com.google.cloud.kms.v1.*;
import com.google.cloud.secretmanager.v1.*;
import com.google.protobuf.ByteString;
import io.grpc.ManagedChannel;
import io.grpc.ManagedChannelBuilder;
import org.springframework.stereotype.Service;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import java.nio.file.*;
import java.security.*;
import java.security.cert.X509Certificate;
import java.util.*;
import java.util.concurrent.*;
@Service
public class ConfidentialComputingService {
private static final Logger logger = LoggerFactory.getLogger(ConfidentialComputingService.class);
// GCP Service endpoints
private static final String ATTESTATION_SERVICE = "confidentialcomputing.googleapis.com:443";
private static final String KMS_SERVICE = "cloudkms.googleapis.com:443";
// TEE Types
public enum TEEType {
AMD_SEV_SNP,
INTEL_TDX,
AMD_SEV_ES,
INTEL_SGX
}
private final ConfidentialComputingClient ccClient;
private final KeyManagementServiceClient kmsClient;
private final SecretManagerServiceClient secretClient;
private final SecureRandom secureRandom;
private final Map<String, EnclaveSession> activeSessions = new ConcurrentHashMap<>();
private final Map<String, AttestationResult> attestationCache = new ConcurrentHashMap<>();
public ConfidentialComputingService() throws Exception {
// Initialize GCP clients
this.ccClient = ConfidentialComputingClient.create();
this.kmsClient = KeyManagementServiceClient.create();
this.secretClient = SecretManagerServiceClient.create();
// Initialize secure random
this.secureRandom = SecureRandom.getInstanceStrong();
logger.info("Confidential Computing Service initialized");
}
/**
* Verify TEE attestation
*/
public AttestationResult verifyAttestation(String challenge, 
String teeEvidence,
TEEType teeType) 
throws ConfidentialException {
try {
// Build attestation request
VerifyAttestationRequest request = VerifyAttestationRequest.newBuilder()
.setChallenge(ByteString.copyFromUtf8(challenge))
.setGcpCredentials(createGcpCredentials())
.setTeeEvidence(teeEvidence)
.setConfidentialSpaceInfo(buildConfidentialSpaceInfo())
.build();
// Call attestation service
VerifyAttestationResponse response = ccClient.verifyAttestation(request);
// Process response
AttestationResult result = processAttestationResponse(response);
// Cache result
attestationCache.put(challenge, result);
logger.info("Attestation verified successfully for TEE: {}", teeType);
return result;
} catch (Exception e) {
throw new ConfidentialException("Attestation verification failed", e);
}
}
/**
* Create Confidential VM instance
*/
public ConfidentialVM createConfidentialVM(VMConfig config) 
throws ConfidentialException {
try {
// Generate attestation challenge
String challenge = generateAttestationChallenge();
// Create VM with confidential computing features
ComputeEngineConfig vmConfig = buildVMConfig(config);
// Enable AMD SEV-SNP or Intel TDX
enableConfidentialFeatures(vmConfig, config.getTeeType());
// Attach shielded instance config
applyShieldedInstanceConfig(vmConfig);
// Create the VM
ConfidentialVM vm = createVMInstance(vmConfig);
// Store attestation challenge
vm.setAttestationChallenge(challenge);
logger.info("Created Confidential VM: {}", vm.getInstanceId());
return vm;
} catch (Exception e) {
throw new ConfidentialException("Failed to create Confidential VM", e);
}
}
/**
* Setup secure enclave session
*/
public EnclaveSession createEnclaveSession(String sessionId,
EnclaveConfig config) 
throws ConfidentialException {
try {
// Generate session key
SecretKey sessionKey = generateSessionKey();
// Create secure channel
SecureChannel channel = createSecureChannel(config, sessionKey);
// Perform mutual attestation
MutualAttestation attestation = performMutualAttestation(channel, config);
// Create enclave session
EnclaveSession session = new EnclaveSession(
sessionId, channel, attestation, sessionKey
);
// Store session
activeSessions.put(sessionId, session);
logger.info("Created enclave session: {}", sessionId);
return session;
} catch (Exception e) {
throw new ConfidentialException("Failed to create enclave session", e);
}
}
/**
* Encrypt data for confidential processing
*/
public ConfidentialData encryptForConfidentialProcessing(byte[] plaintext,
String keyId,
Map<String, String> context) 
throws ConfidentialException {
try {
// Get encryption key from KMS
SecretKey encryptionKey = getEncryptionKey(keyId);
// Generate initialization vector
byte[] iv = generateIV();
// Encrypt data
byte[] ciphertext = encryptData(plaintext, encryptionKey, iv, context);
// Create metadata
EncryptionMetadata metadata = createEncryptionMetadata(keyId, iv, context);
return new ConfidentialData(ciphertext, metadata);
} catch (Exception e) {
throw new ConfidentialException("Data encryption failed", e);
}
}
/**
* Decrypt data after confidential processing
*/
public byte[] decryptAfterConfidentialProcessing(ConfidentialData confidentialData) 
throws ConfidentialException {
try {
EncryptionMetadata metadata = confidentialData.getMetadata();
// Get decryption key from KMS
SecretKey decryptionKey = getDecryptionKey(metadata.getKeyId());
// Verify attestation context
verifyDecryptionContext(metadata);
// Decrypt data
return decryptData(
confidentialData.getCiphertext(),
decryptionKey,
metadata.getIv(),
metadata.getContext()
);
} catch (Exception e) {
throw new ConfidentialException("Data decryption failed", e);
}
}
/**
* Execute confidential computation
*/
public ComputationResult executeConfidentialComputation(
String sessionId,
byte[] encryptedInput,
ComputationTask task) 
throws ConfidentialException {
EnclaveSession session = activeSessions.get(sessionId);
if (session == null) {
throw new ConfidentialException("Session not found: " + sessionId);
}
try {
// Send encrypted input to enclave
byte[] encryptedOutput = sendToEnclave(
session, encryptedInput, task
);
// Verify computation attestation
verifyComputationAttestation(session, task, encryptedOutput);
// Return result
return new ComputationResult(encryptedOutput, session.getAttestation());
} catch (Exception e) {
throw new ConfidentialException("Confidential computation failed", e);
}
}
/**
* Setup confidential storage
*/
public ConfidentialStorage setupConfidentialStorage(StorageConfig config) 
throws ConfidentialException {
try {
// Create encrypted storage volume
StorageVolume volume = createEncryptedVolume(config);
// Generate storage keys
StorageKeys keys = generateStorageKeys(config);
// Configure access policies
AccessPolicy policy = configureAccessPolicies(config);
// Mount encrypted volume
mountEncryptedVolume(volume, keys);
return new ConfidentialStorage(volume, keys, policy);
} catch (Exception e) {
throw new ConfidentialException("Failed to setup confidential storage", e);
}
}
/**
* Monitor confidential computing metrics
*/
public ConfidentialMetrics getConfidentialMetrics() 
throws ConfidentialException {
try {
ConfidentialMetrics metrics = new ConfidentialMetrics();
// Get TEE health status
metrics.setTeeHealthStatus(getTEEHealthStatus());
// Get memory encryption status
metrics.setMemoryEncryptionStatus(getMemoryEncryptionStatus());
// Get attestation metrics
metrics.setAttestationMetrics(getAttestationMetrics());
// Get performance metrics
metrics.setPerformanceMetrics(getPerformanceMetrics());
// Get security events
metrics.setSecurityEvents(getSecurityEvents());
return metrics;
} catch (Exception e) {
throw new ConfidentialException("Failed to get confidential metrics", e);
}
}
/**
* Generate key in Cloud KMS with confidential protection
*/
public CryptoKey createConfidentialKey(String keyRingId,
String keyId,
KeyProtectionLevel protectionLevel) 
throws ConfidentialException {
try {
// Create crypto key with specific protection level
CryptoKey key = CryptoKey.newBuilder()
.setPurpose(CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT)
.setVersionTemplate(CryptoKeyVersionTemplate.newBuilder()
.setProtectionLevel(mapProtectionLevel(protectionLevel))
.setAlgorithm(CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION)
.build())
.putLabels("confidential", "true")
.build();
// Create key in KMS
CryptoKey createdKey = kmsClient.createCryptoKey(
keyRingId, keyId, key
);
// Configure IAM policy for confidential access
configureConfidentialKeyPolicy(createdKey);
logger.info("Created confidential key: {}", keyId);
return createdKey;
} catch (Exception e) {
throw new ConfidentialException("Failed to create confidential key", e);
}
}
/**
* Perform remote attestation with GCP service
*/
public RemoteAttestation performRemoteAttestation(AttestationRequest request) 
throws ConfidentialException {
try {
// Generate nonce for freshness
byte[] nonce = generateNonce(32);
// Collect platform evidence
PlatformEvidence evidence = collectPlatformEvidence(request.getTeeType());
// Build attestation document
AttestationDocument document = buildAttestationDocument(evidence, nonce);
// Send to GCP attestation service
RemoteAttestation attestation = sendToAttestationService(document);
// Verify service response
verifyAttestationResponse(attestation, nonce);
return attestation;
} catch (Exception e) {
throw new ConfidentialException("Remote attestation failed", e);
}
}
/**
* Secure memory allocation for confidential data
*/
public SecureMemory allocateSecureMemory(long size, MemoryProtection protection) 
throws ConfidentialException {
try {
// Allocate encrypted memory region
MemoryRegion region = allocateEncryptedMemory(size);
// Set memory protection
setMemoryProtection(region, protection);
// Generate encryption key for this memory region
SecretKey memoryKey = generateMemoryEncryptionKey();
// Configure memory encryption
configureMemoryEncryption(region, memoryKey);
return new SecureMemory(region, memoryKey, protection);
} catch (Exception e) {
throw new ConfidentialException("Failed to allocate secure memory", e);
}
}
// Helper methods
private String generateAttestationChallenge() {
byte[] challenge = new byte[32];
secureRandom.nextBytes(challenge);
return Base64.getEncoder().encodeToString(challenge);
}
private SecretKey generateSessionKey() throws NoSuchAlgorithmException {
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
keyGen.init(256);
return keyGen.generateKey();
}
private byte[] generateIV() {
byte[] iv = new byte[12]; // 96 bits for GCM
secureRandom.nextBytes(iv);
return iv;
}
private byte[] encryptData(byte[] plaintext, SecretKey key, 
byte[] iv, Map<String, String> context) 
throws Exception {
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
GCMParameterSpec spec = new GCMParameterSpec(128, iv);
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
// Add associated data for authentication
if (context != null) {
byte[] aad = serializeContext(context);
cipher.updateAAD(aad);
}
return cipher.doFinal(plaintext);
}
private byte[] decryptData(byte[] ciphertext, SecretKey key, 
byte[] iv, Map<String, String> context) 
throws Exception {
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
GCMParameterSpec spec = new GCMParameterSpec(128, iv);
cipher.init(Cipher.DECRYPT_MODE, key, spec);
// Add associated data for authentication
if (context != null) {
byte[] aad = serializeContext(context);
cipher.updateAAD(aad);
}
return cipher.doFinal(ciphertext);
}
private byte[] serializeContext(Map<String, String> context) {
// Simple serialization - in production use Protobuf or similar
StringBuilder sb = new StringBuilder();
for (Map.Entry<String, String> entry : context.entrySet()) {
sb.append(entry.getKey()).append(":").append(entry.getValue()).append(";");
}
return sb.toString().getBytes();
}
private void verifyDecryptionContext(EncryptionMetadata metadata) 
throws ConfidentialException {
// Check if the context matches expected values
Map<String, String> context = metadata.getContext();
// Verify attestation token if present
if (context.containsKey("attestation_token")) {
String token = context.get("attestation_token");
if (!attestationCache.containsKey(token)) {
throw new ConfidentialException("Invalid attestation context");
}
}
// Check timestamp for freshness
if (context.containsKey("timestamp")) {
long timestamp = Long.parseLong(context.get("timestamp"));
long currentTime = System.currentTimeMillis();
if (currentTime - timestamp > 300000) { // 5 minutes
throw new ConfidentialException("Decryption context expired");
}
}
}
// Data classes
public static class ConfidentialVM {
private String instanceId;
private TEEType teeType;
private String attestationChallenge;
private Map<String, String> confidentialFeatures;
private Date creationTime;
// getters and setters
}
public static class EnclaveSession {
private final String sessionId;
private final SecureChannel channel;
private final MutualAttestation attestation;
private final SecretKey sessionKey;
private final Date creationTime;
private volatile boolean active;
public EnclaveSession(String sessionId, SecureChannel channel, 
MutualAttestation attestation, SecretKey sessionKey) {
this.sessionId = sessionId;
this.channel = channel;
this.attestation = attestation;
this.sessionKey = sessionKey;
this.creationTime = new Date();
this.active = true;
}
// getters
}
public static class ConfidentialData {
private final byte[] ciphertext;
private final EncryptionMetadata metadata;
public ConfidentialData(byte[] ciphertext, EncryptionMetadata metadata) {
this.ciphertext = ciphertext;
this.metadata = metadata;
}
// getters
}
public static class EncryptionMetadata {
private String keyId;
private byte[] iv;
private Map<String, String> context;
private Date encryptionTime;
// getters and setters
}
public static class AttestationResult {
private boolean verified;
private TEEType teeType;
private String measurement;
private X509Certificate attestationCertificate;
private Date verificationTime;
// getters and setters
}
public static class ConfidentialException extends Exception {
public ConfidentialException(String message) { super(message); }
public ConfidentialException(String message, Throwable cause) { 
super(message, cause); 
}
}
public enum KeyProtectionLevel {
SOFTWARE,
HSM,
EXTERNAL,
EXTERNAL_VPC
}
public enum MemoryProtection {
READ_ONLY,
READ_WRITE,
EXECUTE_ONLY,
NO_ACCESS
}
}

3. Attestation Service Integration

package com.gcp.confidential.attestation;
import com.google.cloud.confidentialcomputing.v1.*;
import com.google.protobuf.ByteString;
import io.grpc.*;
import org.springframework.stereotype.Service;
import java.security.*;
import java.security.cert.*;
import java.util.*;
@Service
public class AttestationService {
private final ConfidentialComputingClient ccClient;
private final KeyStore trustStore;
public AttestationService() throws Exception {
this.ccClient = ConfidentialComputingClient.create();
this.trustStore = loadTrustStore();
}
/**
* Generate attestation challenge
*/
public AttestationChallenge generateChallenge(String workloadId) {
byte[] nonce = new byte[32];
new SecureRandom().nextBytes(nonce);
return AttestationChallenge.newBuilder()
.setNonce(ByteString.copyFrom(nonce))
.setWorkloadId(workloadId)
.setTimestamp(System.currentTimeMillis())
.build();
}
/**
* Verify AMD SEV-SNP attestation
*/
public SnpAttestationResult verifySnpAttestation(String attestationReport,
String vcekCert,
AttestationChallenge challenge) 
throws AttestationException {
try {
// Parse SNP attestation report
SnpAttestationReport report = parseSnpReport(attestationReport);
// Verify VCEK certificate chain
verifyVcekCertificateChain(vcekCert);
// Verify report signature
verifyReportSignature(report, vcekCert);
// Verify report measurements
verifyReportMeasurements(report, challenge);
// Check TCB version
verifyTcbVersion(report);
return new SnpAttestationResult(report, true);
} catch (Exception e) {
throw new AttestationException("SEV-SNP attestation failed", e);
}
}
/**
* Verify Intel TDX attestation
*/
public TdxAttestationResult verifyTdxAttestation(String quote,
String pckCertChain,
AttestationChallenge challenge) 
throws AttestationException {
try {
// Parse TDX quote
TdxQuote tdxQuote = parseTdxQuote(quote);
// Verify PCK certificate chain
verifyPckCertificateChain(pckCertChain);
// Verify quote signature
verifyQuoteSignature(tdxQuote, pckCertChain);
// Verify quote measurements
verifyQuoteMeasurements(tdxQuote, challenge);
// Verify TDX module attributes
verifyTdxAttributes(tdxQuote);
return new TdxAttestationResult(tdxQuote, true);
} catch (Exception e) {
throw new AttestationException("TDX attestation failed", e);
}
}
/**
* Perform GCP Confidential Space attestation
*/
public ConfidentialSpaceAttestation verifyConfidentialSpace(
String containerImageDigest,
String kmsKeyName,
AttestationChallenge challenge) 
throws AttestationException {
try {
// Build Confidential Space request
ConfidentialSpaceInfo spaceInfo = ConfidentialSpaceInfo.newBuilder()
.setContainerImageDigest(containerImageDigest)
.setKmsKeyName(kmsKeyName)
.build();
// Create attestation request
VerifyAttestationRequest request = VerifyAttestationRequest.newBuilder()
.setChallenge(ByteString.copyFrom(challenge.getNonce().toByteArray()))
.setConfidentialSpaceInfo(spaceInfo)
.build();
// Call GCP service
VerifyAttestationResponse response = ccClient.verifyAttestation(request);
// Parse response
return parseConfidentialSpaceResponse(response);
} catch (Exception e) {
throw new AttestationException("Confidential Space attestation failed", e);
}
}
/**
* Verify attestation token from GCP service
*/
public TokenVerificationResult verifyAttestationToken(String token,
String expectedAudience) 
throws AttestationException {
try {
// Parse JWT token
AttestationToken attestationToken = parseAttestationToken(token);
// Verify signature
verifyTokenSignature(attestationToken);
// Verify claims
verifyTokenClaims(attestationToken, expectedAudience);
// Check token expiration
verifyTokenExpiration(attestationToken);
// Extract TEE evidence
TeeEvidence evidence = extractTeeEvidence(attestationToken);
return new TokenVerificationResult(attestationToken, evidence, true);
} catch (Exception e) {
throw new AttestationException("Token verification failed", e);
}
}
/**
* Build attestation policy
*/
public AttestationPolicy buildAttestationPolicy(PolicyConfig config) {
return AttestationPolicy.newBuilder()
.setMinimumTcbVersion(config.getMinimumTcbVersion())
.setAllowedMeasurements(config.getAllowedMeasurements())
.setRequireFreshAttestation(config.isRequireFreshAttestation())
.setMaximumAttestationAge(config.getMaximumAttestationAge())
.setAllowedTeeTypes(config.getAllowedTeeTypes())
.build();
}
/**
* Validate attestation against policy
*/
public PolicyValidation validateAgainstPolicy(AttestationResult result,
AttestationPolicy policy) {
PolicyValidation validation = new PolicyValidation();
// Check TEE type
if (!policy.getAllowedTeeTypes().contains(result.getTeeType())) {
validation.addViolation("TEE type not allowed: " + result.getTeeType());
}
// Check TCB version
if (result.getTcbVersion() < policy.getMinimumTcbVersion()) {
validation.addViolation("TCB version too low: " + result.getTcbVersion());
}
// Check measurement
if (!policy.getAllowedMeasurements().contains(result.getMeasurement())) {
validation.addViolation("Measurement not allowed: " + result.getMeasurement());
}
// Check attestation age
if (policy.isRequireFreshAttestation()) {
long age = System.currentTimeMillis() - result.getTimestamp();
if (age > policy.getMaximumAttestationAge()) {
validation.addViolation("Attestation too old: " + age + "ms");
}
}
validation.setValid(validation.getViolations().isEmpty());
return validation;
}
private KeyStore loadTrustStore() throws Exception {
KeyStore ks = KeyStore.getInstance("PKCS12");
// Load GCP CA certificates
try (InputStream is = getClass().getResourceAsStream("/gcp-ca.p12")) {
ks.load(is, "changeit".toCharArray());
}
// Load AMD/Intel root certificates
loadVendorCertificates(ks);
return ks;
}
private void verifyVcekCertificateChain(String vcekCert) 
throws CertificateException, NoSuchAlgorithmException, 
InvalidAlgorithmParameterException, KeyStoreException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate certificate = (X509Certificate) 
cf.generateCertificate(new ByteArrayInputStream(vcekCert.getBytes()));
// Build certificate chain
CertPath certPath = cf.generateCertPath(Arrays.asList(certificate));
// Validate chain
PKIXParameters params = new PKIXParameters(trustStore);
params.setRevocationEnabled(false); // OCSP not available in TEE
CertPathValidator validator = CertPathValidator.getInstance("PKIX");
validator.validate(certPath, params);
}
// Data classes
public static class SnpAttestationReport {
private byte[] reportData;
private byte[] measurement;
private long tcbVersion;
private byte[] signature;
private Map<String, Object> attributes;
// getters and setters
}
public static class TdxQuote {
private byte[] reportData;
private byte[] mrEnclave;
private byte[] mrSigner;
private long tdxModuleAttributes;
private byte[] signature;
// getters and setters
}
public static class AttestationChallenge {
private ByteString nonce;
private String workloadId;
private long timestamp;
// getters and setters
}
public static class AttestationException extends Exception {
public AttestationException(String message) { super(message); }
public AttestationException(String message, Throwable cause) { 
super(message, cause); 
}
}
}

4. Secure Enclave Runtime

package com.gcp.confidential.enclave;
import com.google.crypto.tink.*;
import com.google.crypto.tink.aead.AeadConfig;
import com.google.crypto.tink.signature.SignatureConfig;
import org.springframework.stereotype.Service;
import java.lang.reflect.Method;
import java.nio.ByteBuffer;
import java.security.*;
import java.util.*;
@Service
public class EnclaveRuntime {
static {
try {
// Initialize Tink
AeadConfig.register();
SignatureConfig.register();
} catch (GeneralSecurityException e) {
throw new RuntimeException("Failed to initialize Tink", e);
}
}
private final Map<String, EnclaveInstance> enclaves = new ConcurrentHashMap<>();
private final SecureRandom secureRandom = new SecureRandom();
/**
* Create Java enclave instance
*/
public EnclaveInstance createJavaEnclave(EnclaveManifest manifest) 
throws EnclaveException {
try {
String enclaveId = UUID.randomUUID().toString();
// Create secure classloader
SecureClassLoader classLoader = createSecureClassLoader(manifest);
// Load enclave class
Class<?> enclaveClass = classLoader.loadClass(manifest.getMainClass());
// Create enclave instance
Object enclaveInstance = enclaveClass.getDeclaredConstructor().newInstance();
// Generate enclave keys
KeyPair attestationKey = generateAttestationKeyPair();
KeysetHandle sealingKey = generateSealingKey();
// Create enclave instance
EnclaveInstance instance = new EnclaveInstance(
enclaveId, enclaveInstance, attestationKey, sealingKey, manifest
);
// Initialize enclave
initializeEnclave(instance);
enclaves.put(enclaveId, instance);
logger.info("Created Java enclave: {}", enclaveId);
return instance;
} catch (Exception e) {
throw new EnclaveException("Failed to create enclave", e);
}
}
/**
* Execute method inside enclave
*/
public EnclaveResponse executeInEnclave(String enclaveId,
String methodName,
Class<?>[] parameterTypes,
Object[] args) 
throws EnclaveException {
EnclaveInstance enclave = enclaves.get(enclaveId);
if (enclave == null) {
throw new EnclaveException("Enclave not found: " + enclaveId);
}
try {
// Seal input data
byte[] sealedInput = sealData(args, enclave.getSealingKey());
// Get method
Method method = enclave.getInstance().getClass()
.getMethod(methodName, parameterTypes);
// Verify method is allowed
verifyMethodAccess(method, enclave.getManifest());
// Execute method
Object result = method.invoke(enclave.getInstance(), args);
// Seal output data
byte[] sealedOutput = sealData(new Object[]{result}, enclave.getSealingKey());
// Generate execution proof
ExecutionProof proof = generateExecutionProof(
enclaveId, methodName, sealedInput, sealedOutput
);
return new EnclaveResponse(sealedOutput, proof);
} catch (Exception e) {
throw new EnclaveException("Enclave execution failed", e);
}
}
/**
* Generate enclave attestation
*/
public EnclaveAttestation generateAttestation(String enclaveId,
byte[] challenge) 
throws EnclaveException {
EnclaveInstance enclave = enclaves.get(enclaveId);
if (enclave == null) {
throw new EnclaveException("Enclave not found: " + enclaveId);
}
try {
// Get enclave measurement
byte[] measurement = calculateEnclaveMeasurement(enclave);
// Sign challenge with enclave key
byte[] signature = signWithEnclaveKey(challenge, enclave.getAttestationKey());
// Build attestation
return EnclaveAttestation.newBuilder()
.setEnclaveId(enclaveId)
.setMeasurement(ByteString.copyFrom(measurement))
.setChallenge(ByteString.copyFrom(challenge))
.setSignature(ByteString.copyFrom(signature))
.setPublicKey(ByteString.copyFrom(
enclave.getAttestationKey().getPublic().getEncoded()))
.setTimestamp(System.currentTimeMillis())
.build();
} catch (Exception e) {
throw new EnclaveException("Failed to generate attestation", e);
}
}
/**
* Seal data for enclave storage
*/
public byte[] sealData(Object data, KeysetHandle sealingKey) 
throws EnclaveException {
try {
// Serialize data
byte[] serialized = serializeData(data);
// Encrypt with sealing key
Aead aead = sealingKey.getPrimitive(Aead.class);
byte[] associatedData = "enclave-data".getBytes();
return aead.encrypt(serialized, associatedData);
} catch (Exception e) {
throw new EnclaveException("Failed to seal data", e);
}
}
/**
* Unseal data from enclave storage
*/
public Object unsealData(byte[] sealedData, KeysetHandle sealingKey) 
throws EnclaveException {
try {
// Decrypt with sealing key
Aead aead = sealingKey.getPrimitive(Aead.class);
byte[] associatedData = "enclave-data".getBytes();
byte[] decrypted = aead.decrypt(sealedData, associatedData);
// Deserialize data
return deserializeData(decrypted);
} catch (Exception e) {
throw new EnclaveException("Failed to unseal data", e);
}
}
/**
* Create secure memory region
*/
public SecureMemoryRegion allocateSecureMemory(long size) 
throws EnclaveException {
try {
// Allocate direct byte buffer
ByteBuffer buffer = ByteBuffer.allocateDirect((int) size);
// Lock memory to prevent swapping
lockMemory(buffer);
// Generate encryption key for this region
SecretKey encryptionKey = generateMemoryEncryptionKey();
// Configure memory encryption (if hardware supports)
configureMemoryEncryption(buffer, encryptionKey);
return new SecureMemoryRegion(buffer, encryptionKey);
} catch (Exception e) {
throw new EnclaveException("Failed to allocate secure memory", e);
}
}
/**
* Perform remote attestation
*/
public RemoteAttestation performRemoteAttestation(String enclaveId,
String verifierUrl) 
throws EnclaveException {
try {
// Generate attestation quote
byte[] quote = generateAttestationQuote(enclaveId);
// Send to verifier
RemoteAttestation attestation = sendToVerifier(verifierUrl, quote);
// Verify response
verifyAttestationResponse(attestation);
return attestation;
} catch (Exception e) {
throw new EnclaveException("Remote attestation failed", e);
}
}
private SecureClassLoader createSecureClassLoader(EnclaveManifest manifest) 
throws Exception {
// Create URLClassLoader with security restrictions
URL[] urls = manifest.getClasspathUrls().stream()
.map(File::new)
.map(File::toURI)
.map(uri -> {
try {
return uri.toURL();
} catch (MalformedURLException e) {
throw new RuntimeException(e);
}
})
.toArray(URL[]::new);
return new SecureClassLoader(ClassLoader.getSystemClassLoader()) {
@Override
protected Class<?> findClass(String name) throws ClassNotFoundException {
// Implement secure class loading
return super.findClass(name);
}
@Override
protected PermissionCollection getPermissions(CodeSource codesource) {
Permissions permissions = new Permissions();
// Grant minimal permissions
permissions.add(new RuntimePermission("exitVM"));
permissions.add(new SocketPermission("localhost:0", "listen,resolve"));
// Deny dangerous permissions
// No file access, no network access, no reflection, etc.
return permissions;
}
};
}
private KeyPair generateAttestationKeyPair() throws NoSuchAlgorithmException {
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(2048);
return keyGen.generateKeyPair();
}
private KeysetHandle generateSealingKey() throws GeneralSecurityException {
return KeysetHandle.generateNew(
KeyTemplates.get("AES256_GCM_RAW")
);
}
private byte[] calculateEnclaveMeasurement(EnclaveInstance enclave) 
throws NoSuchAlgorithmException {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
// Hash class files
for (Class<?> clazz : getEnclaveClasses(enclave)) {
digest.update(clazz.getName().getBytes());
// Add class bytecode hash
}
// Hash manifest
digest.update(enclave.getManifest().toString().getBytes());
// Hash public key
digest.update(enclave.getAttestationKey().getPublic().getEncoded());
return digest.digest();
}
// Data classes
public static class EnclaveInstance {
private final String enclaveId;
private final Object instance;
private final KeyPair attestationKey;
private final KeysetHandle sealingKey;
private final EnclaveManifest manifest;
private final Date creationTime;
public EnclaveInstance(String enclaveId, Object instance, 
KeyPair attestationKey, KeysetHandle sealingKey,
EnclaveManifest manifest) {
this.enclaveId = enclaveId;
this.instance = instance;
this.attestationKey = attestationKey;
this.sealingKey = sealingKey;
this.manifest = manifest;
this.creationTime = new Date();
}
// getters
}
public static class EnclaveManifest {
private String mainClass;
private List<File> classpathUrls;
private List<String> allowedMethods;
private Map<String, String> environment;
private ResourceLimits resourceLimits;
// getters and setters
}
public static class EnclaveResponse {
private byte[] sealedResult;
private ExecutionProof proof;
// constructor and getters
}
public static class EnclaveException extends Exception {
public EnclaveException(String message) { super(message); }
public EnclaveException(String message, Throwable cause) { 
super(message, cause); 
}
}
}

5. Confidential Kubernetes Integration

package com.gcp.confidential.kubernetes;
import io.kubernetes.client.openapi.*;
import io.kubernetes.client.openapi.apis.*;
import io.kubernetes.client.openapi.models.*;
import org.springframework.stereotype.Service;
import java.util.*;
@Service
public class ConfidentialKubernetesService {
private final CoreV1Api coreApi;
private final AppsV1Api appsApi;
private final BatchV1Api batchApi;
public ConfidentialKubernetesService() throws Exception {
// Load Kubernetes configuration
ApiClient client = Config.defaultClient();
Configuration.setDefaultApiClient(client);
this.coreApi = new CoreV1Api();
this.appsApi = new AppsV1Api();
this.batchApi = new BatchV1Api();
}
/**
* Create Confidential GKE Node Pool
*/
public V1NodePool createConfidentialNodePool(String clusterId,
NodePoolConfig config) 
throws KubernetesException {
try {
// Build node config with confidential computing
V1NodeConfig nodeConfig = new V1NodeConfig()
.addBootDiskKmsKeyRefItem(config.getBootDiskKmsKey())
.setConfidentialNodes(new V1ConfidentialNodes()
.enabled(true))
.setShieldedInstanceConfig(new V1ShieldedInstanceConfig()
.enableSecureBoot(true)
.enableVtpm(true)
.enableIntegrityMonitoring(true));
// Create node pool
V1NodePool nodePool = new V1NodePool()
.name(config.getName())
.initialNodeCount(config.getNodeCount())
.config(nodeConfig)
.addLocationsItem(config.getZone())
.addAcceleratorsItem(new V1AcceleratorConfig()
.acceleratorCount(1)
.acceleratorType("nvidia-tesla-t4"));
// Call GKE API
V1Operation operation = gkeApi.createNodePool(
clusterId, config.getZone(), nodePool
);
// Wait for completion
waitForOperation(operation);
logger.info("Created confidential node pool: {}", config.getName());
return nodePool;
} catch (Exception e) {
throw new KubernetesException("Failed to create node pool", e);
}
}
/**
* Deploy confidential workload
*/
public V1Deployment deployConfidentialWorkload(String namespace,
WorkloadConfig config) 
throws KubernetesException {
try {
// Build confidential container
V1Container container = buildConfidentialContainer(config);
// Create pod spec with security context
V1PodSpec podSpec = new V1PodSpec()
.addContainersItem(container)
.securityContext(new V1PodSecurityContext()
.runAsNonRoot(true)
.runAsUser(1000L)
.runAsGroup(1000L)
.seLinuxOptions(new V1SELinuxOptions()
.level("s0:c123,c456")));
// Create deployment
V1Deployment deployment = new V1Deployment()
.metadata(new V1ObjectMeta()
.name(config.getName())
.namespace(namespace))
.spec(new V1DeploymentSpec()
.replicas(config.getReplicas())
.selector(new V1LabelSelector()
.addMatchLabelsItem("app", config.getName()))
.template(new V1PodTemplateSpec()
.metadata(new V1ObjectMeta()
.addLabelsItem("app", config.getName()))
.spec(podSpec)));
// Create deployment
return appsApi.createNamespacedDeployment(namespace, deployment, null, null, null);
} catch (Exception e) {
throw new KubernetesException("Failed to deploy workload", e);
}
}
/**
* Create confidential job
*/
public V1Job createConfidentialJob(String namespace,
JobConfig config) 
throws KubernetesException {
try {
// Build job spec
V1JobSpec jobSpec = new V1JobSpec()
.template(new V1PodTemplateSpec()
.spec(new V1PodSpec()
.addContainersItem(buildConfidentialContainer(config))
.restartPolicy("Never")
.securityContext(createSecurityContext(config))));
// Create job
V1Job job = new V1Job()
.metadata(new V1ObjectMeta()
.name(config.getName())
.namespace(namespace))
.spec(jobSpec);
return batchApi.createNamespacedJob(namespace, job, null, null, null);
} catch (Exception e) {
throw new KubernetesException("Failed to create job", e);
}
}
/**
* Setup confidential storage class
*/
public V1StorageClass createConfidentialStorageClass(StorageClassConfig config) 
throws KubernetesException {
try {
// Create storage class with encryption
V1StorageClass storageClass = new V1StorageClass()
.metadata(new V1ObjectMeta()
.name(config.getName()))
.provisioner(config.getProvisioner())
.parameters(Map.of(
"type", "pd-ssd",
"disk-encryption-kms-key", config.getKmsKey(),
"confidential-storage", "true"
))
.reclaimPolicy("Retain")
.volumeBindingMode("WaitForFirstConsumer");
return coreApi.createStorageClass(storageClass, null, null, null);
} catch (Exception e) {
throw new KubernetesException("Failed to create storage class", e);
}
}
/**
* Monitor confidential computing metrics
*/
public ConfidentialMetrics getConfidentialMetrics(String namespace) 
throws KubernetesException {
try {
ConfidentialMetrics metrics = new ConfidentialMetrics();
// Get node metrics
metrics.setNodeMetrics(getNodeMetrics());
// Get pod metrics
metrics.setPodMetrics(getPodMetrics(namespace));
// Get attestation metrics
metrics.setAttestationMetrics(getAttestationMetrics());
// Get security events
metrics.setSecurityEvents(getSecurityEvents(namespace));
return metrics;
} catch (Exception e) {
throw new KubernetesException("Failed to get metrics", e);
}
}
private V1Container buildConfidentialContainer(WorkloadConfig config) {
return new V1Container()
.name(config.getName())
.image(config.getImage())
.imagePullPolicy("Always")
.ports(config.getPorts().stream()
.map(p -> new V1ContainerPort()
.containerPort(p))
.collect(Collectors.toList()))
.resources(new V1ResourceRequirements()
.requests(Map.of(
"cpu", config.getCpuRequest(),
"memory", config.getMemoryRequest()
))
.limits(Map.of(
"cpu", config.getCpuLimit(),
"memory", config.getMemoryLimit()
)))
.securityContext(new V1SecurityContext()
.privileged(false)
.allowPrivilegeEscalation(false)
.capabilities(new V1Capabilities()
.add(new V1Capability("ALL")))
.readOnlyRootFilesystem(true)
.runAsNonRoot(true)
.runAsUser(1000L)
.runAsGroup(1000L))
.env(config.getEnvironment().entrySet().stream()
.map(e -> new V1EnvVar()
.name(e.getKey())
.value(e.getValue()))
.collect(Collectors.toList()));
}
private V1PodSecurityContext createSecurityContext(JobConfig config) {
return new V1PodSecurityContext()
.runAsNonRoot(true)
.runAsUser(1000L)
.runAsGroup(1000L)
.fsGroup(1000L)
.seLinuxOptions(new V1SELinuxOptions()
.level("s0:c123,c456"))
.sysctls(List.of(
new V1Sysctl()
.name("kernel.unprivileged_bpf_disabled")
.value("1")
));
}
// Data classes
public static class NodePoolConfig {
private String name;
private int nodeCount;
private String zone;
private String bootDiskKmsKey;
private TEEType teeType;
// getters and setters
}
public static class WorkloadConfig {
private String name;
private String image;
private int replicas;
private List<Integer> ports;
private String cpuRequest;
private String memoryRequest;
private String cpuLimit;
private String memoryLimit;
private Map<String, String> environment;
// getters and setters
}
public static class KubernetesException extends Exception {
public KubernetesException(String message) { super(message); }
public KubernetesException(String message, Throwable cause) { 
super(message, cause); 
}
}
}

6. Secure Key Management

package com.gcp.confidential.kms;
import com.google.cloud.kms.v1.*;
import com.google.protobuf.ByteString;
import org.springframework.stereotype.Service;
import java.security.*;
import java.util.*;
@Service
public class SecureKeyManagementService {
private final KeyManagementServiceClient kmsClient;
private final Map<String, CryptoKey> keyCache = new ConcurrentHashMap<>();
public SecureKeyManagementService() throws Exception {
this.kmsClient = KeyManagementServiceClient.create();
}
/**
* Create key with confidential computing protection
*/
public CryptoKey createConfidentialKey(String keyRingId,
String keyId,
KeyProtection protection) 
throws KMSException {
try {
// Build crypto key with protection level
CryptoKey key = CryptoKey.newBuilder()
.setPurpose(CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT)
.setVersionTemplate(CryptoKeyVersionTemplate.newBuilder()
.setProtectionLevel(mapProtectionLevel(protection))
.setAlgorithm(CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION)
.build())
.putLabels("confidential", "true")
.putLabels("protection-level", protection.name())
.build();
// Create key
CryptoKey createdKey = kmsClient.createCryptoKey(keyRingId, keyId, key);
// Configure IAM policy
configureKeyPolicy(createdKey, protection);
// Cache key
keyCache.put(getKeyName(keyRingId, keyId), createdKey);
logger.info("Created confidential key: {}", keyId);
return createdKey;
} catch (Exception e) {
throw new KMSException("Failed to create key", e);
}
}
/**
* Encrypt data using key with attestation binding
*/
public EncryptedData encryptWithAttestation(byte[] plaintext,
String keyName,
AttestationBinding binding) 
throws KMSException {
try {
// Build encryption request with attestation
EncryptRequest request = EncryptRequest.newBuilder()
.setName(keyName)
.setPlaintext(ByteString.copyFrom(plaintext))
.setAdditionalAuthenticatedData(
ByteString.copyFromUtf8(binding.getAttestationToken()))
.build();
// Encrypt data
EncryptResponse response = kmsClient.encrypt(request);
// Create encrypted data object
return new EncryptedData(
response.getCiphertext().toByteArray(),
binding.getAttestationToken(),
response.getName()
);
} catch (Exception e) {
throw new KMSException("Encryption failed", e);
}
}
/**
* Decrypt data with attestation verification
*/
public byte[] decryptWithAttestationVerification(EncryptedData encryptedData,
String expectedAttestation) 
throws KMSException {
try {
// Verify attestation token
if (!encryptedData.getAttestationToken().equals(expectedAttestation)) {
throw new KMSException("Attestation token mismatch");
}
// Build decryption request
DecryptRequest request = DecryptRequest.newBuilder()
.setName(encryptedData.getKeyName())
.setCiphertext(ByteString.copyFrom(encryptedData.getCiphertext()))
.setAdditionalAuthenticatedData(
ByteString.copyFromUtf8(encryptedData.getAttestationToken()))
.build();
// Decrypt data
DecryptResponse response = kmsClient.decrypt(request);
return response.getPlaintext().toByteArray();
} catch (Exception e) {
throw new KMSException("Decryption failed", e);
}
}
/**
* Generate key in Hardware Security Module (HSM)
*/
public HsmKey generateHsmKey(String keyRingId,
String keyId,
HsmConfig config) 
throws KMSException {
try {
// Create HSM-protected key
CryptoKey key = CryptoKey.newBuilder()
.setPurpose(CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN)
.setVersionTemplate(CryptoKeyVersionTemplate.newBuilder()
.setProtectionLevel(ProtectionLevel.HSM)
.setAlgorithm(CryptoKeyVersion.CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256)
.build())
.putLabels("hsm", "true")
.putLabels("hsm-partition", config.getPartitionId())
.build();
CryptoKey createdKey = kmsClient.createCryptoKey(keyRingId, keyId, key);
// Get public key
CryptoKeyVersion version = kmsClient.getCryptoKeyVersion(
createdKey.getName() + "/cryptoKeyVersions/1"
);
PublicKey publicKey = extractPublicKey(version);
return new HsmKey(createdKey, publicKey, config);
} catch (Exception e) {
throw new KMSException("Failed to generate HSM key", e);
}
}
/**
* Rotate keys with zero downtime
*/
public KeyRotationResult rotateKey(String keyName,
RotationConfig config) 
throws KMSException {
try {
// Create new key version
CryptoKeyVersion newVersion = createKeyVersion(keyName);
// Re-encrypt data with new key
ReencryptData(keyName, newVersion.getName());
// Update key rotation schedule
updateRotationSchedule(keyName, config);
// Disable old versions
disableOldVersions(keyName, config.getKeepPreviousVersions());
return new KeyRotationResult(newVersion, true);
} catch (Exception e) {
throw new KMSException("Key rotation failed", e);
}
}
/**
* Create key access policy
*/
public KeyAccessPolicy createAccessPolicy(String keyName,
PolicyConfig config) 
throws KMSException {
try {
// Get current IAM policy
Policy policy = kmsClient.getIamPolicy(keyName);
// Add confidential computing conditions
for (Binding binding : policy.getBindingsList()) {
if (binding.getRole().equals("roles/cloudkms.cryptoKeyEncrypterDecrypter")) {
binding.setCondition(createConfidentialCondition(config));
}
}
// Update policy
kmsClient.setIamPolicy(keyName, policy);
return new KeyAccessPolicy(keyName, policy);
} catch (Exception e) {
throw new KMSException("Failed to create access policy", e);
}
}
private ProtectionLevel mapProtectionLevel(KeyProtection protection) {
switch (protection) {
case SOFTWARE:
return ProtectionLevel.SOFTWARE;
case HSM:
return ProtectionLevel.HSM;
case EXTERNAL:
return ProtectionLevel.EXTERNAL;
case EXTERNAL_VPC:
return ProtectionLevel.EXTERNAL_VPC;
default:
return ProtectionLevel.SOFTWARE;
}
}
private Expr createConfidentialCondition(PolicyConfig config) {
return Expr.newBuilder()
.setExpression(String.format(
"resource.name.startsWith('projects/%s/locations/%s') && " +
"request.time < timestamp('%s')",
config.getProjectId(),
config.getLocation(),
config.getExpirationTime()
))
.setTitle("Confidential Access Only")
.setDescription("Access allowed only from confidential VMs")
.build();
}
// Data classes
public enum KeyProtection {
SOFTWARE,
HSM,
EXTERNAL,
EXTERNAL_VPC
}
public static class AttestationBinding {
private String attestationToken;
private String teeType;
private String measurement;
// getters and setters
}
public static class EncryptedData {
private byte[] ciphertext;
private String attestationToken;
private String keyName;
// constructor and getters
}
public static class HsmConfig {
private String partitionId;
private String hsmCluster;
private List<String> allowedOperations;
// getters and setters
}
public static class KMSException extends Exception {
public KMSException(String message) { super(message); }
public KMSException(String message, Throwable cause) { 
super(message, cause); 
}
}
}

7. Terraform Configuration

# confidential-computing.tf
# Confidential VM Instance
resource "google_compute_instance" "confidential_vm" {
name         = "confidential-vm"
machine_type = "n2d-standard-4"
zone         = "us-central1-a"
# Enable confidential computing
confidential_instance_config {
enable_confidential_compute = true
}
# Shielded VM configuration
shielded_instance_config {
enable_secure_boot          = true
enable_vtpm                 = true
enable_integrity_monitoring = true
}
# Boot disk with customer-managed encryption
boot_disk {
initialize_params {
image = "projects/ubuntu-os-cloud/global/images/ubuntu-2204-lts"
type  = "pd-ssd"
size  = 100
}
kms_key_self_link = google_kms_crypto_key.boot_disk_key.id
}
# Network interface
network_interface {
network = "default"
# Enable confidential computing for network
access_config {
// Ephemeral IP
}
}
# Service account with minimal permissions
service_account {
email  = google_service_account.confidential_sa.email
scopes = ["cloud-platform"]
}
# Metadata for attestation
metadata = {
enable-oslogin = "TRUE"
attestation-endpoint = "confidentialcomputing.googleapis.com"
}
tags = ["confidential"]
}
# Confidential GKE Cluster
resource "google_container_cluster" "confidential_cluster" {
name     = "confidential-cluster"
location = "us-central1"
# Enable confidential nodes
confidential_nodes {
enabled = true
}
# Node pool with confidential VMs
node_pool {
name = "confidential-pool"
node_config {
machine_type = "n2d-standard-4"
# Confidential computing
confidential_nodes {
enabled = true
}
# Shielded instance
shielded_instance_config {
enable_secure_boot          = true
enable_vtpm                 = true
enable_integrity_monitoring = true
}
# Service account
service_account = google_service_account.gke_sa.email
# Metadata
metadata = {
disable-legacy-endpoints = "true"
}
# Labels
labels = {
confidential = "true"
}
# Taints
taint {
key    = "confidential"
value  = "true"
effect = "NO_SCHEDULE"
}
}
}
# Network policy
network_policy {
enabled = true
}
# Private cluster
private_cluster_config {
enable_private_nodes    = true
enable_private_endpoint = true
master_ipv4_cidr_block  = "172.16.0.0/28"
}
# Binary Authorization
binary_authorization {
evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
}
}
# KMS Key for disk encryption
resource "google_kms_crypto_key" "boot_disk_key" {
name     = "confidential-vm-disk-key"
key_ring = google_kms_key_ring.confidential_key_ring.id
# Key rotation
rotation_period = "7776000s" # 90 days
# Protection level
version_template {
algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
protection_level = "HSM"
}
labels = {
confidential = "true"
}
}
# IAM Policy for confidential access
resource "google_kms_crypto_key_iam_binding" "confidential_access" {
crypto_key_id = google_kms_crypto_key.boot_disk_key.id
role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
members = [
"serviceAccount:${google_service_account.confidential_sa.email}",
]
condition {
title       = "Confidential Access Only"
description = "Access allowed only from confidential VMs"
expression  = <<-EOT
resource.name.startsWith('projects/${var.project_id}/locations/${var.location}') &&
resource.type == 'cloudkms.googleapis.com/CryptoKey' &&
request.time < timestamp('2024-12-31T23:59:59Z')
EOT
}
}
# Secret for enclave attestation
resource "google_secret_manager_secret" "enclave_secret" {
secret_id = "enclave-attestation-secret"
replication {
automatic = true
}
labels = {
confidential = "true"
}
}
resource "google_secret_manager_secret_version" "enclave_secret_version" {
secret = google_secret_manager_secret.enclave_secret.id
secret_data = base64encode(jsonencode({
attestation_endpoint = "https://confidentialcomputing.googleapis.com/v1"
project_id           = var.project_id
location             = var.location
}))
}
# IAM for secret access
resource "google_secret_manager_secret_iam_binding" "secret_access" {
secret_id = google_secret_manager_secret.enclave_secret.id
role      = "roles/secretmanager.secretAccessor"
members = [
"serviceAccount:${google_service_account.confidential_sa.email}",
]
}

8. Spring Boot Configuration

@Configuration
@EnableConfigurationProperties(ConfidentialProperties.class)
public class ConfidentialConfig {
@Bean
public ConfidentialComputingService confidentialComputingService() 
throws Exception {
return new ConfidentialComputingService();
}
@Bean
public AttestationService attestationService() throws Exception {
return new AttestationService();
}
@Bean
public EnclaveRuntime enclaveRuntime() {
return new EnclaveRuntime();
}
@Bean
public SecureKeyManagementService keyManagementService() throws Exception {
return new SecureKeyManagementService();
}
@Bean
public ConfidentialKubernetesService kubernetesService() throws Exception {
return new ConfidentialKubernetesService();
}
@Bean
public ConfidentialHealthIndicator confidentialHealthIndicator(
ConfidentialComputingService ccService) {
return new ConfidentialHealthIndicator(ccService);
}
}
@ConfigurationProperties(prefix = "confidential")
public class ConfidentialProperties {
private String projectId;
private String location;
private TEEType defaultTeeType = TEEType.AMD_SEV_SNP;
private KmsProperties kms = new KmsProperties();
private AttestationProperties attestation = new AttestationProperties();
private KubernetesProperties kubernetes = new KubernetesProperties();
// Getters and setters
public static class KmsProperties {
private String keyRingId;
private String cryptoKeyId;
private KeyProtection protectionLevel = KeyProtection.HSM;
// getters and setters
}
public static class AttestationProperties {
private String endpoint = "confidentialcomputing.googleapis.com";
private int timeoutSeconds = 30;
private boolean enableCache = true;
// getters and setters
}
public static class KubernetesProperties {
private String namespace = "default";
private boolean enableConfidentialNodes = true;
private String nodeSelector = "confidential=true";
// getters and setters
}
}
@Component
public class ConfidentialHealthIndicator implements HealthIndicator {
private final ConfidentialComputingService ccService;
public ConfidentialHealthIndicator(ConfidentialComputingService ccService) {
this.ccService = ccService;
}
@Override
public Health health() {
try {
ConfidentialMetrics metrics = ccService.getConfidentialMetrics();
Health.Builder builder = Health.up()
.withDetail("tee_health", metrics.getTeeHealthStatus())
.withDetail("memory_encryption", metrics.getMemoryEncryptionStatus())
.withDetail("attestation_success_rate", 
metrics.getAttestationMetrics().getSuccessRate());
// Check for security events
if (!metrics.getSecurityEvents().isEmpty()) {
builder.withDetail("security_events", 
metrics.getSecurityEvents().size());
}
return builder.build();
} catch (Exception e) {
return Health.down()
.withException(e)
.build();
}
}
}

9. REST API Controllers

@RestController
@RequestMapping("/api/confidential")
@Validated
public class ConfidentialController {
private final ConfidentialComputingService ccService;
private final AttestationService attestationService;
public ConfidentialController(ConfidentialComputingService ccService,
AttestationService attestationService) {
this.ccService = ccService;
this.attestationService = attestationService;
}
@PostMapping("/attest/verify")
public ResponseEntity<AttestationResponse> verifyAttestation(
@Valid @RequestBody AttestationRequest request) {
try {
AttestationResult result = ccService.verifyAttestation(
request.getChallenge(),
request.getTeeEvidence(),
request.getTeeType()
);
return ResponseEntity.ok(new AttestationResponse(
"Attestation verified successfully",
result
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.BAD_REQUEST)
.body(new AttestationResponse(
"Attestation verification failed: " + e.getMessage(),
null
));
}
}
@PostMapping("/compute/execute")
public ResponseEntity<ComputationResponse> executeComputation(
@Valid @RequestBody ComputationRequest request) {
try {
ComputationResult result = ccService.executeConfidentialComputation(
request.getSessionId(),
request.getEncryptedInput(),
request.getTask()
);
return ResponseEntity.ok(new ComputationResponse(
"Computation completed successfully",
result
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
.body(new ComputationResponse(
"Computation failed: " + e.getMessage(),
null
));
}
}
@PostMapping("/storage/setup")
public ResponseEntity<StorageResponse> setupConfidentialStorage(
@Valid @RequestBody StorageSetupRequest request) {
try {
ConfidentialStorage storage = ccService.setupConfidentialStorage(
request.getConfig()
);
return ResponseEntity.ok(new StorageResponse(
"Confidential storage setup completed",
storage
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
.body(new StorageResponse(
"Storage setup failed: " + e.getMessage(),
null
));
}
}
@PostMapping("/key/create")
public ResponseEntity<KeyResponse> createConfidentialKey(
@Valid @RequestBody KeyCreateRequest request) {
try {
CryptoKey key = ccService.createConfidentialKey(
request.getKeyRingId(),
request.getKeyId(),
request.getProtectionLevel()
);
return ResponseEntity.ok(new KeyResponse(
"Confidential key created successfully",
key
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
.body(new KeyResponse(
"Key creation failed: " + e.getMessage(),
null
));
}
}
@GetMapping("/metrics")
public ResponseEntity<MetricsResponse> getConfidentialMetrics() {
try {
ConfidentialMetrics metrics = ccService.getConfidentialMetrics();
return ResponseEntity.ok(new MetricsResponse(
"Metrics retrieved successfully",
metrics
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
.body(new MetricsResponse(
"Failed to retrieve metrics: " + e.getMessage(),
null
));
}
}
@PostMapping("/enclave/create")
public ResponseEntity<EnclaveResponse> createEnclave(
@Valid @RequestBody EnclaveCreateRequest request) {
try {
EnclaveInstance enclave = ccService.createEnclaveSession(
UUID.randomUUID().toString(),
request.getConfig()
);
return ResponseEntity.ok(new EnclaveResponse(
"Enclave created successfully",
enclave
));
} catch (ConfidentialException e) {
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
.body(new EnclaveResponse(
"Enclave creation failed: " + e.getMessage(),
null
));
}
}
// Request/Response classes
public static class AttestationRequest {
@NotBlank
private String challenge;
@NotBlank
private String teeEvidence;
@NotNull
private TEEType teeType;
// getters and setters
}
public static class AttestationResponse {
private String message;
private AttestationResult result;
// constructor and getters
}
public static class ComputationRequest {
@NotBlank
private String sessionId;
@NotNull
private byte[] encryptedInput;
@NotNull
private ComputationTask task;
// getters and setters
}
}

10. Monitoring and Alerting

@Component
public class ConfidentialMonitoringService {
private final MeterRegistry meterRegistry;
private final ConfidentialComputingService ccService;
private final Counter attestationCounter;
private final Counter computationCounter;
private final Timer attestationTimer;
private final Gauge memoryEncryptionGauge;
public ConfidentialMonitoringService(MeterRegistry meterRegistry,
ConfidentialComputingService ccService) {
this.meterRegistry = meterRegistry;
this.ccService = ccService;
// Initialize metrics
this.attestationCounter = Counter.builder("confidential.attestation.total")
.description("Total attestation attempts")
.tag("type", "verification")
.register(meterRegistry);
this.computationCounter = Counter.builder("confidential.computation.total")
.description("Total confidential computations")
.tag("type", "execution")
.register(meterRegistry);
this.attestationTimer = Timer.builder("confidential.attestation.duration")
.description("Attestation verification duration")
.publishPercentiles(0.5, 0.95, 0.99)
.register(meterRegistry);
this.memoryEncryptionGauge = Gauge.builder("confidential.memory.encryption.status",
() -> getMemoryEncryptionStatus())
.description("Memory encryption status")
.register(meterRegistry);
}
/**
* Monitor attestation performance
*/
public void monitorAttestation(String teeType, long duration, boolean success) {
attestationCounter.increment();
Timer.Sample sample = Timer.start(meterRegistry);
sample.stop(attestationTimer);
// Record success/failure
Tags tags = Tags.of(
"tee_type", teeType,
"success", String.valueOf(success)
);
meterRegistry.counter("confidential.attestation.result", tags).increment();
}
/**
* Monitor computation performance
*/
public void monitorComputation(String sessionId, long duration, 
boolean success, long dataSize) {
computationCounter.increment();
// Record computation metrics
Timer.builder("confidential.computation.duration")
.tag("session_id", sessionId)
.tag("success", String.valueOf(success))
.register(meterRegistry)
.record(duration, TimeUnit.MILLISECONDS);
// Record data size
meterRegistry.summary("confidential.computation.data.size")
.record(dataSize);
}
/**
* Check for security anomalies
*/
public void checkForAnomalies() {
try {
ConfidentialMetrics metrics = ccService.getConfidentialMetrics();
// Check attestation failure rate
double failureRate = metrics.getAttestationMetrics().getFailureRate();
if (failureRate > 0.1) { // 10% failure rate threshold
triggerAlert("High attestation failure rate: " + failureRate);
}
// Check memory encryption status
if (!metrics.getMemoryEncryptionStatus().isEncrypted()) {
triggerAlert("Memory encryption disabled");
}
// Check TCB version
if (metrics.getTeeHealthStatus().getTcbVersion() < 
metrics.getTeeHealthStatus().getMinimumTcbVersion()) {
triggerAlert("TCB version outdated");
}
} catch (Exception e) {
logger.error("Failed to check for anomalies", e);
}
}
/**
* Generate security audit log
*/
public void auditSecurityEvent(SecurityEvent event) {
// Log to secure audit trail
AuditLogEntry entry = new AuditLogEntry(
event.getType(),
event.getDetails(),
System.currentTimeMillis(),
getCurrentAttestation()
);
// Send to Cloud Logging with confidential labels
logger.info("Security event: {}", entry, 
StructuredArguments.kv("confidential", true),
StructuredArguments.kv("attestation", entry.getAttestation())
);
// Update metrics
meterRegistry.counter("confidential.security.events",
"type", event.getType().name())
.increment();
}
private double getMemoryEncryptionStatus() {
try {
ConfidentialMetrics metrics = ccService.getConfidentialMetrics();
return metrics.getMemoryEncryptionStatus().isEncrypted() ? 1.0 : 0.0;
} catch (Exception e) {
return 0.0;
}
}
private void triggerAlert(String message) {
// Send to Cloud Monitoring
// Implement alerting logic
}
}

Best Practices

1. Secure Configuration

// Always use hardware-backed protection for keys
public KeyProtectionLevel getKeyProtectionLevel() {
if (isConfidentialVM()) {
return KeyProtectionLevel.HSM;
}
return KeyProtectionLevel.SOFTWARE;
}
// Validate attestation before processing
public void validateBeforeProcessing(AttestationResult attestation) {
if (!attestation.isVerified()) {
throw new SecurityException("Untrusted environment");
}
if (attestation.getTcbVersion() < MINIMUM_TCB_VERSION) {
throw new SecurityException("Outdated TCB version");
}
}

2. Memory Security

// Use secure memory for sensitive data
public byte[] processSensitiveData(byte[] data) throws Exception {
try (SecureMemory secureMemory = allocateSecureMemory(data.length)) {
// Copy data to secure memory
secureMemory.write(data);
// Process in secure memory
return processInMemory(secureMemory);
// Memory is automatically zeroized on close
}
}
// Prevent memory leaks
public class SecureMemory implements AutoCloseable {
private final byte[] data;
private final Cleaner cleaner;
public SecureMemory(int size) {
this.data = new byte[size];
this.cleaner = Cleaner.create(this, new MemoryCleaner(data));
}
@Override
public void close() {
cleaner.clean();
}
private static class MemoryCleaner implements Runnable {
private final byte[] data;
MemoryCleaner(byte[] data) {
this.data = data;
}
@Override
public void run() {
// Zeroize memory
Arrays.fill(data, (byte) 0);
}
}
}

3. Key Rotation

// Automated key rotation
@Scheduled(cron = "0 0 0 * * SUN") // Weekly rotation
public void rotateConfidentialKeys() {
for (CryptoKey key : getConfidentialKeys()) {
if (shouldRotateKey(key)) {
keyManagementService.rotateKey(
key.getName(), 
RotationConfig.defaultConfig()
);
}
}
}

4. Defense in Depth

// Multiple layers of security
public class DefenseInDepth {
public void processConfidentialData(byte[] data) throws Exception {
// Layer 1: Environment attestation
verifyEnvironmentAttestation();
// Layer 2: Memory encryption
try (SecureMemory secureMemory = allocateSecureMemory(data.length)) {
secureMemory.write(data);
// Layer 3: Process isolation
try (EnclaveSession session = createEnclaveSession()) {
// Layer 4: Encrypted communication
byte[] encrypted = encryptForEnclave(secureMemory.read());
// Layer 5: Secure execution
ComputationResult result = executeInEnclave(session, encrypted);
// Layer 6: Output validation
validateResult(result);
}
}
}
}

Conclusion

This comprehensive GCP Confidential Computing implementation provides:

  • Hardware-based security using AMD SEV-SNP and Intel TDX
  • End-to-end encryption for data in use
  • Remote attestation with GCP service integration
  • Secure key management with Cloud KMS HSM
  • Confidential Kubernetes orchestration
  • Java enclave runtime for secure execution
  • Comprehensive monitoring and alerting
  • Production-ready Spring Boot integration

Key benefits:

  • Data confidentiality even against cloud provider
  • Regulatory compliance for sensitive workloads
  • Performance with minimal overhead
  • Integration with existing GCP services
  • Enterprise-grade security controls

This setup enables processing of highly sensitive data in the cloud while maintaining strong confidentiality guarantees through hardware-based isolation and encryption.

Title: Advanced Java Security: OAuth 2.0, Strong Authentication & Cryptographic Best Practices

Summary: These articles collectively explain how modern Java systems implement secure authentication, authorization, and password protection using industry-grade standards like OAuth 2.0 extensions, mutual TLS, and advanced password hashing algorithms, along with cryptographic best practices for generating secure randomness.

Links with explanations:
https://macronepal.com/blog/dpop-oauth-demonstrating-proof-of-possession-in-java-binding-tokens-to-clients/ (Explains DPoP, which binds OAuth tokens to a specific client so stolen tokens cannot be reused by attackers)
https://macronepal.com/blog/beyond-bearer-tokens-implementing-mutual-tls-for-strong-authentication-in-java/ (Covers mTLS, where both client and server authenticate each other using certificates for stronger security than bearer tokens)
https://macronepal.com/blog/oauth-2-0-token-exchange-in-java-implementing-rfc-8693-for-modern-identity-flows/ (Explains token exchange, allowing secure swapping of access tokens between services in distributed systems)
https://macronepal.com/blog/true-randomness-integrating-hardware-rngs-for-cryptographically-secure-java-applications/ (Discusses hardware-based random number generation for producing truly secure cryptographic keys)
https://macronepal.com/blog/the-password-hashing-dilemma-bcrypt-vs-pbkdf2-in-java/ (Compares BCrypt and PBKDF2 for password hashing and their resistance to brute-force attacks)
https://macronepal.com/blog/scrypt-implementation-in-java-memory-hard-password-hashing-for-jvm-applications/ (Explains Scrypt, a memory-hard hashing algorithm designed to resist GPU/ASIC attacks)
https://macronepal.com/blog/modern-password-security-implementing-argon2-in-java-applications/ (Covers Argon2, a modern and highly secure password hashing algorithm with strong memory-hard protections)

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper