What is Confidential Computing?
Confidential Computing helps protect data in use by encrypting and isolating in-memory data while workloads run. On OCI, Confidential Computing enabled Instances use AMD SEV with Secure Nested Paging and rely on keys generated at Instance creation and held in the AMD Secure Processor. The AMD Secure Processor manages the encryption keys, helping protect guest memory from access outside the confidential VM’s intended security boundary.
OCI Confidential Computing originally supported AMD SEV on the earlier E3 and E4 shape generations. OCI now supports AMD SEV with Secure Nested Paging on the newer E5 and E6 Standard instance families. Earlier SEV generations primarily focus on preventing the hypervisor from reading guest memory. AMD SEV with Secure Nested Paging adds strong memory integrity protection to help prevent malicious hypervisor-based attacks such as data replay and memory remapping. It also enables hardware-backed attestation that lets you cryptographically verify that your workload is running in the expected confidential environment before releasing secrets, including keys, tokens, and datasets. OCI E5 and E6 shapes support the Bring Your Own Attestation Service model, where customers deploy an attestation server using OCI guidance documents.
Confidential Computing encrypts and isolates data in-use and the applications processing that data, providing additional hardware-based protections against certain unauthorized memory-access and modification threats. By providing security through the lowest layers of hardware, Confidential Computing minimizes the list of trusted parties, including the OS, ecosystem partners, and administrators, thereby helping reduce the risk of data exposure. OCI delivers these benefits without application code changes and with minimal performance impact.
Attestation is an important complement to memory encryption. It lets a workload or an external verifier cryptographically validate the expected confidential guest environment before releasing secrets, such as tokens, keys, or protected datasets. OCI supports a Bring Your Own Attestation Service model for E5 and E6 shapes.
Key security features
- Memory Isolation: Each VM is encrypted with a unique key known only to the processor, protecting data even if the host system is compromised.
- No Code Changes: You can lift and shift existing workloads into these confidential environments without modifying your application code.
- Runtime Attestation: Supports hardware-backed remote attestation through a customer-deployed attestation service.
Example Use Cases
- Protecting PII and PHI during transformation, scoring, and analytics jobs.
- Secret-bearing services, such as tokenization, signing, and payments, where keys must not be exposed to infrastructure administrators.
- Multi-tenant SaaS workloads seeking stronger isolation guarantees between tenants.
- Confidential machine learning inference pipelines processing sensitive inputs.
- Secure data processing in CI and CD or build systems where credentials and proprietary source code reside in memory.
- Zero trust and assume-breach architectures that require hardware-backed isolation layers.
This blog presents the results of a benchmarking study that evaluates the performance impact of OCI Confidential Computing with AMD SEV with Secure Nested Paging on OCI virtual machines.
As organizations move sensitive and regulated workloads to the cloud, protecting data at rest and in transit is no longer sufficient. Data also needs protection while it is actively processed in memory. OCI Confidential Computing uses AMD SEV with Secure Nested Paging to provide hardware-backed memory encryption, isolation, integrity protection, and attestation capabilities for supported OCI compute shapes. A common question is whether these additional protections introduce a measurable performance cost. Memory encryption, isolation, and integrity controls can add work to the virtualized environment, potentially affecting CPU processing, memory throughput, application latency, and transaction performance. The practical impact, however, depends on the workload and environment.
To evaluate this impact, we compared two matched OCI VM.Standard.E6.Flex instances: one Standard VM and one Confidential VM launched with AMD SEV with Secure Nested Paging Confidential Computing enabled. Both VMs used the same OCPU and memory configuration, operating system, kernel, MySQL configuration, and private-network test environment. The study measured representative web-serving, CPU, memory, media-transcoding, and transactional database workloads using NGINX with wrk, Sysbench, FFmpeg, and HammerDB MySQL TPROC-C. Each measured test used repeated runs after the workload environment was prepared consistently. The objective was to identify measurable performance differences, if any, and assess whether OCI Confidential Computing can support the tested workloads with additional hardware-backed protections for data in use and what performance differences were observed under the test conditions.
| Capability | OCI position described in the July 2026 E5 and E6 announcement |
| Technology | AMD SEV with Secure Nested Paging on E5 and E6 Standard instance families |
| VM availability | VM.Standard.E6.Flex in all public regions; VM.Standard.E5.Flex in most public regions |
| Bare metal availability | BM.Standard.E5 and BM.Standard.E6 in all realms and regions |
| Supported images | Oracle Linux 9 UEK8, Oracle Linux 10 UEK8, and Ubuntu 24.04 |
| Operational model | Enable at instance launch; cannot be turned on or off later |
| Pricing | No additional charge |
Availability, supported images, operational requirements, and pricing are based on Oracle product documentation as of October 2026 and may vary by region, shape, and configuration.
Summary Results
| Benchmark | Standard VM mean | Confidential VM mean | Comparison | Interpretation |
| NGINX requests/sec | 56,858.45 | 56,687.41 | -0.30% | No material difference |
| Sysbench CPU events/sec | 8,127.20 | 8,064.78 | -0.77% | Within 1% |
| Sysbench memory read MiB/sec | 378,787.24 | 376,973.79 | -0.48% | Within 1% |
| Sysbench memory write MiB/sec | 125,941.85 | 124,879.46 | -0.84% | Within 1% |
| FFmpeg elapsed seconds | 13.97 | 14.44 | +3.38% time | Single-digit increase in runtime |
| MySQL TPROC-C NOPM | 56,844 | 54,271 | -4.53% | Single-digit throughput reduction |
These results represent the mean of five measured runs for each workload in the specified test environment. The comparisons are between two OCI VM configurations and are not comparisons against third-party cloud providers. Performance may vary depending on workload characteristics, system configuration, and operating conditions.
Benchmarking Infrastructure Setup
The comparison used a newly provisioned Standard VM and confidential VM in the same OCI region and availability domain. Both were configured with the same shape, OCPU count, memory allocation, image family, kernel, and MySQL settings. An independent client VM generated the MySQL and web workload traffic over private networking.
| Item | Standard VM | Confidential VM |
| Instance name | e6-cc-no | e6-cc-yes |
| Shape | VM.Standard.E6.Flex | VM.Standard.E6.Flex |
| Shape configuration | 4 OCPUs, 12 GB memory, 4 Gbps | 4 OCPUs, 12 GB memory, 4 Gbps |
| Region and placement | eu-frankfurt-1, AD-1, fault domain 2 | eu-frankfurt-1, AD-1, fault domain 2 |
| Guest OS and kernel | Oracle Linux 9, UEK 6.12.0-204.92.4.4.3 | Oracle Linux 9, UEK 6.12.0-204.92.4.4.3 |
| Guest CPU presentation | AMD EPYC 9J45 128-Core Processor | AMD EPYC 9J45 128-Core Processor |
| Confidential evidence | No SEV or SNP guest evidence | UEK reported SEV-SNP, SNP VMPL0, SNP CPUID table, and confidential virtualization |
Database and Client Configuration
| Component | Configuration |
| MySQL | MySQL Community Server 8.4.11 on each database VM |
| InnoDB | 8 GB buffer pool; 2 GB redo capacity; innodb_flush_log_at_trx_commit=1; sync_binlog=1; binary logging disabled |
| Connection settings | bind_address 0.0.0.0; max_connections 512; skip_name_resolve ON |
| Load generator | mysql-db at 10.0.0.23, Oracle Linux 9, HammerDB 6.0, sysbench 1.0.20, and locally built wrk |
Workloads Tested
Each measured workload used five repetitions after a warm-up run. Higher is better for throughput metrics; lower is better for FFmpeg elapsed time. The warm-up results are excluded from the result summary.
| Workload | Purpose | Primary metric |
| NGINX and wrk | Static HTTP serving from a 4 KiB file | Requests per second |
| Sysbench CPU | Prime-number CPU work across eight threads | Events per second |
| Sysbench memory | Sequential local memory read and write across eight threads | MiB per second |
| FFmpeg | H.264 1080p video transcode to a null output | Elapsed seconds |
| MySQL TPROC-C | HammerDB TPC-C-like online transaction processing workload | NOPM and MySQL TPM |
Web Server Benchmark with NGINX and wrk
NGINX 1.20.1 served a 4 KiB static object. The client sent requests from the dedicated mysql-db VM over private networking. Access logging and gzip were disabled so the measurement emphasized web-server request processing rather than logging or compression.
Test Configuration
| Parameter | Value |
| Client tool | wrk built from source |
| Concurrency | 8 threads and 128 connections |
| Run structure | 10-second warm-up; 60-second measured interval; five measured runs |
| Endpoint | Private IP address of each target VM; HTTP static 4 KiB object |
Results
| Configuration | Run 1 | Run 2 | Run 3 | Run 4 | Run 5 | Mean | Median |
| Standard VM – Request/s | 57561.44 | 56597.04 | 56771.69 | 56702.34 | 56659.74 | 56858.45 | 56702.34 |
| Confidential VM – Request/s | 56600.55 | 56799.83 | 56650.41 | 56575.69 | 56810.55 | 56687.41 | 56650.41 |
| Comparison | -0.30% |
- Across five measured runs, the Confidential VM averaged 56,687.41 requests/sec, compared with 56,858.45 requests/sec for the Standard VM. This represents a 0.30% lower mean request rate for the Confidential VM under the tested conditions.
- Average data transfer rates were similarly close: 235.22 MB/sec for the Confidential VM and 235.93 MB/sec for the Standard VM.
Sysbench CPU and Memory Benchmark
Sysbench 1.0.20 was used to isolate CPU work and local memory movement. These tests were run directly on each target VM, with the database service stopped, so they are not network or storage measurements.
Test Configuration
| Test Type | Configuration |
| CPU | 8 threads; cpu-max-prime 20000; 60 seconds; five measured runs after warm-up |
| Memory read/write | 8 threads; 1 MiB block size; local scope; sequential access; 100 TB total operation size; 60 seconds; five measured runs after warm-up |
CPU Test Results
| Configuration | Run 1 | Run 2 | Run 3 | Run 4 | Run 5 | Mean | Median |
| Standard VM – Events/sec | 8128.87 | 8113.51 | 8130.46 | 8131.21 | 8131.97 | 8127.20 | 8130.46 |
| Confidential VM – Events/sec | 8063.12 | 8066.14 | 8064.28 | 8065.70 | 8064.66 | 8064.78 | 8064.66 |
| Comparison | -0.77% |
Memory Test Results
| Metric | Standard VM MiB/sec | Confidential VM MiB/sec | Comparison |
| Sequential read | 378787.24 | 376973.79 | -0.48% |
| Sequential write | 125941.85 | 124879.46 | -0.84% |
- CPU throughput on the Confidential VM was 0.77% lower than on the Standard VM. Memory throughput was also slightly lower: 0.48% for sequential reads and 0.84% for sequential writes.
FFmpeg Video Transcode Benchmark
FFmpeg exercised a CPU-intensive H.264 transcode using the same 1080p video input on each VM. Both systems used the identical statically linked FFmpeg 7.0.2 binary and the same input file checksum.
Test Configuration
| Parameter | Value |
| Binary | FFmpeg 7.0.2 static build; matching SHA-256 on both VMs |
| Input | 1080p H.264 video, 52.208 seconds, 1920 x 1080 |
| Output | H.264 transcode directed to a null output |
| Runs | One warm-up followed by five measured runs; elapsed wall-clock seconds collected |
Test Results
| Configuration | Run 1 | Run 2 | Run 3 | Run 4 | Run 5 | Mean | Median |
| Standard VM – elapsed time (sec) | 13.98 | 13.91 | 14.00 | 13.94 | 14.01 | 13.97 | 13.98 |
| Confidential VM – elapsed time (sec) | 14.48 | 14.46 | 14.42 | 14.35 | 14.49 | 14.44 | 14.46 |
| Comparison | +3.38% |
- The Confidential VM required 3.38% more elapsed time for this compute heavy transcode.
MySQL TPROC-C Benchmark with HammerDB
HammerDB 6.0 generated a TPROC-C workload against MySQL Community Server 8.4.11 running on each target VM. TPROC-C is a TPC-C-like online transaction processing workload.
Test Configuration
| Parameter | Value |
| Schema | 10 warehouses; built independently on each target database |
| Virtual users | 4 active build VUs; 8 execution VUs plus the monitor VU |
| Measured run | 1-minute ramp-up followed by 5-minute timed workload; five measured runs after warm-up |
| Primary metric | New Orders per Minute (NOPM); MySQL TPM also captured |
| Run validity | All reported measured runs completed successfully with no lock-wait timeout errors |
Test Results
| Configuration | Run 1 | Run 2 | Run 3 | Run 4 | Run 5 | Mean | Median |
| Standard VM – NOPM | 55595 | 56689 | 56454 | 57716 | 57766 | 56844 | 56689 |
| Confidential VM – NOPM | 54233 | 55296 | 54134 | 54087 | 53603 | 54271 | 54134 |
| Comparison | -4.53% |
- The Confidential VM mean was 4.53% lower in this transactional workload. The result should be read with the workload-specific context rather than generalized to all database applications.
Conclusion
In this OCI performance study, the Confidential VM showed relatively small performance differences in the tested workloads with the Standard VM across the tested workloads. Mean throughput was 0.30% lower for NGINX, 0.77% lower for Sysbench CPU, and 0.48% and 0.84% lower for sequential memory reads and writes, respectively. FFmpeg required 3.38% more elapsed time, while MySQL TPROC-C achieved 4.53% fewer new orders per minute.
These findings suggest that OCI Confidential Computing can provide additional hardware-backed protections for data in use, with the observed performance differences varying by workload in the tested configuration. The results are specific to the tested environment and workloads; customers should validate their own applications against their performance and security requirements.
Explore More
OCI Confidential Computing on E5 and E6 VM and Bare Metal Shapes
OCI Confidential Computing documentation