AMD EPYC Hardware Memory Encryption
Hardware accelerated memory encryption for data-in-use protection. Takes advantage of new security components available in AMD EPYC processors
- AES-128 encryption engine embedded in the memory controller. Automatically encrypts and decrypts data in main memory when an appropriate key is provided.
- AMD Secure Processor. Provides cryptographic functionality for secure key generation and key management.
AMD Secure Memory Encryption (SME)
Uses a single key to encrypt system memory. The key is generated by the AMD Secure Processor at boot. SME requires enablement in the system BIOS or operating system. When enabled in the BIOS, memory encryption is transparent and can be run with any operating system.
AMD Secure Encrypted Virtualization (SEV)
Uses one key per virtual machine to isolate guests and the hypervisor from one another. The keys are managed by the AMD Secure Processor. SEV requires enablement in the guest operating system and hypervisor. The guest changes allow the VM to indicate which pages in memory should be encrypted. The hypervisor changes use hardware virtualization instructions and communication with the AMD Secure processor to manage the appropriate keys in the memory controller.
AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES)
Encrypts all CPU register contents when a VM stops running. This prevents the leakage of information in CPU registers to components like the hypervisor, and can even detect malicious modifications to a CPU register state.
White Papers & Specifications
|AMD Memory Encryption||Introduction to Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV).||April
|Protecting VM Register State With SEV-ES||Technical overview of the SEV-ES feature, the principles behind the architecture, and protections offered to further isolate encrypted VMs.||February
|Secure Encrypted Virtualization API||Documents the API available to the host hypervisor for management of keys and secure data transfer between host hypervisor and guest VM memory||0.17||October
|AMD64 Architecture Programmer’s Manual Volume 2||Describes the AMD64 architecture’s resources and functions that are managed by system software. Note sections
|Guest Hypervisor Communication Block (GHCB) Standardization||Standardizes the Guest-Hypervisor Communication Block (GHCB) format and specifies the required exit support and associated guest state to be provided in the GHCB to allow interoperability between hypervisors and SEV-ES guests.||0.70||October
Scripts & Source
|https://github.com/AMDESE/AMDSEV||Setup scripts useful for running SEV guests. Site also hosts Linux open source code under development (note SEV support has been accepted in upstream projects)|
|Linux Security Summit (2017)||Protecting VM Register State with AMD SEV-ES||September 2017|
|Linux Security Summit (2016)||AMD x86 Memory Encryption Technologies||December 2016|
|KVM Forum||AMD’s Virtualization Memory Encryption Technology||September 2016|
|Usenix Security Symposium||AMD x86 Memory Encryption Technologies||August 2016|
|Xen Summit||AMD’s Virtualization Memory Encryption Technology||September 2016|