End-To-End Confidentiality with Sev-Snp Leveraging in-Memory Storage

Confidential computing ensures data in-use protection in untrusted cloud environments, yet securing data at-rest typically relies on Full Disk Encryption (FDE), which imposes significant performance overhead. This work proposes an alternative in-memory storage approach that eliminates FDE by leveraging SEV-SNP confidential virtual machines (CVMs). Our framework extends SNPGuard, an open-source platform for booting and attesting SEV-SNP VMs, to manage workload execution using temporary file systems (tmpfs), inherently secured by CVM memory encryption. By enabling seamless deployment of Docker based applications, our approach improves runtime and throughput by 20% on average, with peak gains of 45% in read-only database workloads. These findings establish in-memory storage as a secure and performant alternative to FDE for handling temporary intermediate data in storage intensive workflows, laying the foundation for future research in this direction.