# 专题日跟踪 · 机密计算 · 2026-09-03

> 日期：2026-09-03（Asia/Shanghai）。原文摘录保持源语言。不改写厂商基准数字的含义。

## 摘要

- **VMware + AMD（2026-08-27）**：VCF 9.1 上 SEV-SNP 机密计算生产可用，随 **Advanced Cyber Compliance**；9.0 为 RPQ/有限可用。FAQ 写明 TDX 与 SNP 均走 ACC，**不含在 VCF/VVF/独立 vSphere**。
- **Red Hat（2026-04-13）**：OpenShift sandboxed containers 1.12 裸金属机密容器 GA（TDX / SEV-SNP / IBM SEL）；NVIDIA Hopper 机密 GPU 为 Technology Preview；Trustee 1.1 管证明与放密钥。
- **NVIDIA Blackwell CC**：硬件 RoT + NRAS；B200/B300 最多 8 卡 NVLink 加密；厂商基准称相对非 CC 约 98% 性能，Qwen3.5-397B 表内 Δ 约 -1%～-8%。
- **OpenNebula（2026-06-09）**：加入 CCC；公开点名 SNP / TDX / Arm CCA CVM；7.2 含 vTPM 与硬件信任根。
- **Proxmox VE 9.1**：Intel TDX 初始支持（CanaryBit 稿）；SNP 已非实验。
- **Rafay × Fortanix（2026-03-16）**：编排层机密 AI——CVM + 复合证明 + DSM 放密钥。
- **华为**：鲲鹏 virtCCA/CCA 套件与昇盾 NPU TEE 有文档；**FusionCube HCI 页未闭环为可订 SKU，且不得并入超聚变**。
- **SmartX HCT**：国密加速+HA，明确 **不是** 内存 TEE。国内主流 HCI（深信服/ZStack/超聚变/Nutanix）本日仍无公开 CVM SKU。

## 原文摘录

### [Securing the Memory Layer: How Broadcom and AMD Are Bringing Confidential Computing to the Enterprise](https://blogs.vmware.com/cloud-foundation/2026/08/27/securing-the-memory-layer-how-broadcom-and-amd-are-bringing-confidential-computing-to-the-enterprise/)

- 来源：VMware Cloud Foundation Blog / August 27, 2026

> AMD SEV with Secure Nested Paging, available on AMD EPYC processors, creates hardware-isolated virtual machines where each VM’s memory is encrypted with keys that the hypervisor cannot access. The host operating system, the hypervisor, and anyone with administrative access to the physical server are structurally blocked from reading that memory.
>
> Confidential computing supporting AMD SEV-SNP with Quickboot support became generally available with VMware Cloud Foundation 9.1, delivered as part of VMware Advanced Cyber Compliance.
>
> The growth of AI inference and agentic AI has amplified this exposure significantly. A model running inference on patient records, financial transactions, or proprietary training data sits in memory for the full duration of the job.

### [vSphere with VCF 9.1 FAQ](https://www.vmware.com/docs/vsphere-9-1-faq)

- 来源：VMware Docs

> Q10. What confidential computing capabilities are available to customers, and what benefits do they provide? A. The base functionality includes turning on confidential computing on Intel and AMD based servers specifically for Intel TDX and AMD SEV-SNP respectively. In 9.0, VCF customers needed to go through an RPQ process in order to access the confidential computing functionality. In release 9.1, this functionality will become generally available as part of ACC.
>
> Q11. Is confidential computing capability included with VCF, VVF and/or standalone vSphere? A. No, confidential computing will be available with the ACC SKU.

### [Red Hat OpenShift sandboxed containers 1.12 and Red Hat build of Trustee 1.1…](https://www.redhat.com/en/blog/red-hat-openshift-sandboxed-containers-112-and-red-hat-build-trustee-11-bring-confidential-computing-bare-metal-and-ai-workloads)

- 来源：Red Hat Blog / April 13, 2026

> These releases graduate confidential containers on bare metal from Technology Preview to General Availability (GA), delivering production-ready, hardware-based memory encryption and attestation for on-premise and hybrid cloud infrastructure.
>
> This GA release supports the following trusted execution environment (TEE) hardware: Intel Trust Domain Extensions (TDX) … AMD Secure Nested Paging (SEV-SNP) … IBM Secure Execution for Linux (SEL) …
>
> OpenShift sandboxed containers 1.12 includes for the first time Technology Preview support for confidential containers with confidential GPU accelerators… The NVIDIA Hopper GPU is the primary supported platform, with full Confidential Computing capability.
>
> Key attestation and secret management workflows are now validated … including Intel TDX, AMD SEV-SNP, and IBM SEL bare-metal deployments at GA, as well as NVIDIA Hopper confidential GPU environments in Technology Preview.

### [Hardware-Rooted AI Security That Won’t Slow You Down](https://developer.nvidia.com/blog/hardware-rooted-ai-security-that-wont-slow-you-down/)

- 来源：NVIDIA Technical Blog

> NVIDIA Confidential Computing delivers security at 98% of performance of solutions that don’t enable CC.
>
> The HGX B200 and HGX B300 GPUs support confidential computing across multiple GPUs (up to 8) with NVIDIA NVLink encryption. At the silicon level, the GPU maintains a private signing key that is fused at the time of manufacturing and never exposed to software, firmware, or the host system.
>
> The NVIDIA Remote Attestation Service (NRAS) verifies a signed evidence bundle—the GPU’s hardware report combined with CPU TEE measurements (AMD SEV-SNP or Intel TDX)—against a known-good reference integrity manifest (RIM).

（同文 Table 1 给出 Qwen/Qwen3.5-397B-A17B-FP8 在 HGX B300 上 CC vs OFF 的吞吐/TPOT Δ%，区间约 -1.0% 至 -8.1%。**厂商基准，非本档案测评。**）

### [OpenNebula Highlighted in Confidential Computing Consortium Report](https://opennebula.io/blog/product/confidential-computing-consortium/)

- 来源：OpenNebula Blog / Jun 9, 2026 / Jordi Guijarro

> For most organizations, the practical starting point is Level 1: Confidential Virtual Machines. At this stage, standard workloads are moved into CVMs that use hardware-backed isolation and memory protection technologies such as AMD SEV-SNP, Intel TDX, or Arm CCA.
>
> OpenNebula 7.2 expands confidential computing support with hardware-rooted trust, memory encryption for KVM workloads, and virtual TPM integration.

### [CanaryBit adds Intel TDX support in Proxmox VE 9.1](https://www.canarybit.eu/canarybit-adds-intel-tdx-support-in-proxmox-ve-9-1/)

- 来源：CanaryBit / 与 VE 9.1 同期

> CanaryBit has played a pivotal role in enabling AMD SEV-SNP support in Proxmox VE 8.4 early this year. Now, it has strengthened confidential computing capabilities … by enabling support for Intel TDX in the Proxmox VE 9.1 release.

### [Scaling Trust: The Fortanix and Rafay Integration…](https://docs.rafay.co/blog/2026/03/16/scaling-trust-the-fortanix-and-rafay-integration-for-enterprise-confidential-ai/)

- 来源：Rafay Product Documentation / 2026-03-16

> This module creates and manages Confidential Virtual Machines (CVMs) and containers. It performs Composite Attestation, a process that verifies the integrity of the hardware, the BIOS, and the software stack before any sensitive data is processed.
>
> Boots a Confidential VM. Triggers the Fortanix attestation client. Validates the security posture via the Fortanix CCM. Securely injects the necessary keys from the Fortanix DSM.

### [机密计算CCA套件技术原理](https://www.hikunpeng.com/document/detail/zh/kunpengcctrustzone/ccakit/twp/kunpengtee_19_0004.html)

- 来源：鲲鹏社区 BoostKit 文档

> CCA在ATF（Arm Trusted Firmware）基础上构建Realm World虚拟化管理模块RMM，实现机密虚拟机间的内存隔离、上下文管理、生命周期管理和页表管理等机制，支持客户应用无需修改即可迁移到机密环境中。
>
> 即使攻击者具有最高系统权限，也不能对CCA机密虚拟机中的数据和代码进行读取以及访问。

## 对专题档案的影响

- 机密计算对照表必须以 **ACC SKU / CoCo vs Virt 路线 / 无公开方案** 三档书写，禁止把 VCF 订阅默认写成含 TDX。
- NVIDIA CC 数字全部标厂商基准；规划含义强调证明链与 GPU 桥，而不是复制 98%。
- 华为 CCA/昇盾与 FusionCube/FusionOne 必须分文件引用。
- SmartX HCT 继续留在安全专题，不进入机密计算「有」列。