x86 Memory Encryption
Original talk about the white paper of SME & SEV.
From the talk in USENIX Security '16 & Xen projects & Linux Security Summit 2016.
SEV is an extension to the AMD-V architecture which supports running encrypted virtual machine under the control of KVM.
Each encrypted VM is associated with a unique encryption key.
At least, I will go through all public files AMD offered.
AMD x86 Memory Encryption
Overview
Motivation: Cloud usage
Hypervisor must enforce full isolation between co-resident VMs.
Cloud users must fully trust the cloud hoster.
Defend:
can defend user access attacks and physical access attacks.
How?
Secure Memory Encryption & Secure Encrypted Virtualization
Hardware AES engine. -> for DRAM
Minimal performance impact. extra latency only taken for encrypted pages.
No applications changes required.
Encryption keys are managed by the AMD Secure Processor and are hardware isolated. They are not known to any softwares on the CPU.
To be detailed, OS/Hypervisor chooses pages to encrypt via page tables. This will prevent unpriviledged access to memory.
The Secure Memory Encryption process is shown below:
Briefly, it is the C-bit that counts.
Transparent SME
enables memory encryption without OS modifications.
This will forces C-bit on all accesses, configured by AMD Secure Processor during boot x86 is released.
SEV
Hypervisor, guest VMs are seperateds cryptographically.
SEV details
Address Space ID(ASID) determines VM encryption key.
HW and Guest page tables determine if a page is private or shared
DMA must occur to shared pages
The difference is shown below:
SEV Arch:
The graph above shows the basic arch of SEV. Basically A memory Controller and a 32-bit AMD-SP are located in the SOC. The AMD-SP is the only one that has the access to the red part of the Memory Controller. The red part stores keys of Guest Owners which is the base of cryptographically isolation infrastructure of SEV.
An abstraction is provided for The Hypervisor to use some APIs to provide services for Guest VMs, and these services are enabled by the SEV Driver in it.
Since the Hypervisor is deemed as attackers, it serves as untrusted communication channel for guest owner and AMD SP communications. To avoid man-in-the-middle attack, more checks are embeded during these processes.
@Boot Time
The boot time process is well described in this pdf. Please focus on page 11 to 16. Bear it in mind!!
Key management
This part is also included in the video, when we have to do remote attestation, we should refer to this part.
Last updated