# 机密计算 · 日跟踪 · 2026-09-16

> 日期：2026-09-16（Asia/Shanghai）。专题正文：`intel/topics/confidential.md`。原料：`/workspace/intel/archive/2026-09-16/`；对照 2026-09-15 日跟踪。

## 摘要

- **新稿 · RH × Arqit：机密容器 + 量子安全组网实现 SaaS 数据主权：** 基于 **Red Hat validated pattern for confidential containers**，跑在支持机密计算的 **OpenShift**；内/外 trustee 解环（外 trustee 在可信本地、内 trustee 在云端 TEE）；集群间 **hybrid TLS = ECDH + ML-KEM（PQC）**，在 TEE 边界内终止，避免明文落宿主机。用例：Arqit Encryption Intelligence 多租户 SaaS。属 **机密容器验证模式 + 后量子在途保护**，非新 CPU TEE SKU。
- **续档：** Azure Local Confidential VM preview（SEV-SNP）；Open Secure AI Alliance trusted foundation；neocloud 需求侧点名 confidential computing；**OpenShell ≠ TEE**。
- **交叉 · ARO HCP：** BYOK / etcd 加密 / HSM——托管控制面安全姿态，**不是** TEE 机密 VM 通稿（见 openshift/security）。

## 原文摘录

### Confidential containers + quantum-safe networking

- 归档：`redhat/achieving-data-sovereignty-for-saas-with-confidential-containers-and-q-e4069356.txt`
- URL：https://www.redhat.com/en/blog/achieving-data-sovereignty-saas-confidential-containers-and-quantum-safe-networking
- 文面日期：September 15, 2026

> Arqit uses the Red Hat validated pattern for confidential containers as a base. It runs on Red Hat OpenShift with hardware that supports confidential computing.  
> We solve this problem by introducing an inner and outer trustee. The outer trustee runs outside confidential computing on trusted infrastructure in Arqit’s on-premise environment. … distributes trust to the inner trustee running in the cloud.  
> A hybrid TLS implementation—classical Elliptic Curve Diffie-Hellman (ECDH) with additional Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) post-quantum cryptographic (PQC) key exchange—terminates the transport layer within the TEE boundary, making sure data is never available in plaintext to the host environment.  
> … Adding quantum-safe networking between the customer’s environment and the cloud helps keep data from being visible to the infrastructure provider…

### 续档指针

- Azure Local Confidential VM / Alliance：见 2026-09-14～15 confidential 日跟踪。