I have been wanting this for a while as well. Performance is not a huge issue in this scenario for me, as security is the really the reason anyone would use this. I would want to prevent data from leaking completely if possible. My ideal scenario is that an adversary/host could take down my box, but they couldn't get at the content inside without my authentication. I don't want my instance to be clonable/rootable by the FBI, NSA, the hosting provider, or anyone else. Ideally I should be able to set up a Tor host in this instance, no one should be able to see inside under any condition, and I should have some proof/verification that it is secure from outsiders as claimed. If they realize that something undesirable is going on, I have no problem with the instance being shut down, but I don't want my privacy/security compromised.

So you don't ask for much then :). As I'm sure you're aware, even with TPMs/TXT/SGX/Trustzone etc, once your threat model includes a capable adversary like the NSA with physical access to your box, it's hard to see how you can provide bullet-proof guarantees. I'm excluding fully homomorphic encryption based systems on the grounds of practicality here (although there are interesting 'somewhat homomorphic' systems out there that achieve practicality by restricting what kind of operations you can perform on the data).

I guess, but it still seems like no one offers this and its not trivial. Do you know of any research/systems/practical offerings in this area? This has been something that I would be interested in learning a lot more about honestly. I agree that bullet-proof guarantees are basically impossible and that physical security is probably going to be the weak point at the end of the day. Maybe some system could be created that made it hard to individually tamper with one instance without alerting others, or made it hard to isolate one from another from a hardware view? Do you think even something like SGX can't prevent some level of physical threats? It seems like it would at least make it harder/reduce the scenarios in which hardware is vulnerable, but I haven't researched it extensively.

SGX is pretty reasonable IFF you believe in the Intel PKI.

I have been looking at how to do cheap ($20-50 slow USB connected (essentially smartcard), $500-1000 PCIe) HSMs. If you do shared-computation with a host (with or without SGX/TXT), you can get pretty decent performance with quite modest HSM hardware.

Those provide NSA-type protection -- in that attacking a single instance isn't guaranteed, and takes time, so a system with key rotation or k of n split across locations is going to provide pretty reasonable security.

Private Core is definitely the most interesting TXT-based solution today; if you built an IaaS provider with that tech plus live video monitoring, alarms, etc., you could probably offer quite reasonable security assurances to people. (i.e. the tools to defeat it require physical access, and if no one can gain physical access to a rack once the rack is put into production...)

The k of n split across multiple locations idea is interesting.

I agree that if you're paranoid about the NSA it probably doesn't make too much sense to have faith in the Intel PKI. When you say pretty decent performance for your HSM, do you mean less than 10 % for real world apps?

I'm currently assuming a threat model where an attacker doesn't have physical access however, and looking more into how to use hardware to bootstrap a minimal TCB that doesn't require OS or application rewrites but still gives good performance. Even if only for specific use cases.

ARM or possibly Atom in a box, so pretty decent performance. The pain of the HSM is the physical packaging, and my ultimate goal is to make that reusable and let users select their own components and do their own final assembly and certification.