Confidential computing is a way of running a program inside a locked area of the processor, so that nobody outside that area can see the data while the program is using it. This includes the cloud provider that owns the server. The locked area is called a hardware enclave, or a trusted execution environment (TEE).
Data has three states. It is at rest when it is stored on a disk. It is in transit when it is being sent over a network. It is in use when a program is working on it. Encryption has protected the first two states for many years. But to work on data, a program normally has to decrypt it in the server's memory. At that moment, anyone with full control of the server can read it. That could be a cloud provider's administrator, or an attacker who has taken over the server. Confidential computing protects the third state.
How does it work? Recent server processors have a feature that keeps a section of memory encrypted with a key that only the processor knows. Code inside the enclave sees the data in readable form. The operating system, other programs and the cloud provider see only scrambled bytes. Before anyone sends data in, the enclave proves which code it is running. The processor produces a signed report that contains a fingerprint of the code. This proof is called attestation.
Consider three lenders in Mumbai that want to find borrowers who are taking loans from several of them at the same time. None of them wants to show its customer list to the others. They agree on a small matching program, and run it in an enclave on a cloud server. Each lender checks the attestation report, to confirm that the enclave is running exactly the agreed program. Then each lender sends its encrypted list of PAN numbers: 1.2 lakh, 80,000 and 60,000 borrowers. Inside the enclave, the program finds 312 PAN numbers that appear on two or more lists. Each lender receives only its own borrowers among the 312. No lender, and not the cloud provider, ever sees another lender's list.
The keys to the data are released by encryption key management only after the attestation report has been checked. This is why the two are often sold together.
Confidential computing changes one line of the shared responsibility model of the cloud. Normally, the customer must trust the cloud provider with its data while the data is in use. With an enclave, the customer trusts the processor's design instead. The method has costs. Programs run somewhat slower, and an enclave is only as safe as that design: researchers have found weaknesses in some enclave designs in the past. It is one of the methods of data protection, and it is also used to protect AI models and the data sent to them.