AMD EPYC Hardware Memory Encryption
Hardware accelerated memory encryption for data-in-use protection. Takes advantage of new security components available in AMD EPYC processors
- AES-128 encryption engine embedded in the memory controller. Automatically encrypts and decrypts data in main memory when an appropriate key is provided.
- AMD Secure Processor. Provides cryptographic functionality for secure key generation and key management.
AMD Secure Memory Encryption (SME)
Uses a single key to encrypt system memory. The key is generated by the AMD Secure Processor at boot. SME requires enablement in the system BIOS or operating system. When enabled in the BIOS, memory encryption is transparent and can be run with any operating system.
AMD Secure Encrypted Virtualization (SEV)
Uses one key per virtual machine to isolate guests and the hypervisor from one another. The keys are managed by the AMD Secure Processor. SEV requires enablement in the guest operating system and hypervisor. The guest changes allow the VM to indicate which pages in memory should be encrypted. The hypervisor changes use hardware virtualization instructions and communication with the AMD Secure processor to manage the appropriate keys in the memory controller.
AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES)
Encrypts all CPU register contents when a VM stops running. This prevents the leakage of information in CPU registers to components like the hypervisor, and can even detect malicious modifications to a CPU register state.
White Papers & Specifications
|Guest Hypervisor Communication Block (GHCB) Standardization||Standardizes the Guest-Hypervisor Communication Block (GHCB) format and specifies the required exit support and associated guest state to be provided in the GHCB to allow interoperability between hypervisors and SEV-ES guests.||0.85||January
|AMD SEV-SNP||Strengthening VM isolation with integrity protection and more.||January
|Secure Encrypted Virtualization API||Documents the API available to the host hypervisor for management of keys and secure data transfer between host hypervisor and guest VM memory||0.22||July
|OpenStack: libvirt driver launching AMD SEV-encrypted instances||Proposes work required in order for nova’s libvirt driver to support launching of KVM instances which are encrypted using AMD’s SEV (Secure Encrypted Virtualization) technology.||January
|AMD64 Architecture Programmer’s Manual Volume 2||Describes the AMD64 architecture’s resources and functions that are managed by system software. Note sections
|Protecting VM Register State With SEV-ES||Technical overview of the SEV-ES feature, the principles behind the architecture, and protections offered to further isolate encrypted VMs.||February
|AMD Memory Encryption||Introduction to Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV).||April
Links & Downloads
|https://github.com/AMDESE/AMDSEV||Setup scripts useful for running SEV guests. Site also hosts Linux open source code under development (note SEV support has been accepted in upstream projects)|
|Using AMD Secure Memory Encryption with Oracle Linux||Oracle UEK support for SME and SEV.|
|SUSE: AMD Secure Encrypted Virtualization (AMD-SEV) Guide||Provides a basic understanding of how SEV works, how to enable and configure it, and some of the limitations and restrictions that its use causes as compared to non-encrypted virtualization.|
|ask_ark_naples.cert||ASK/ARK certificates for EPYC 7xx1 (Naples)|
|ask_ark_rome.cert||ASK/ARK certificates for EPYC 7xx2 (Rome)|
|amd_sev_fam17h_model0xh_0.17b22.zip||SEV Firmware | SEV firmware for Naples|
|CEK certificate web page||Interactive tool for obtaining CEK certificate. Also available as https://kdsintf.amd.com/cek/id/<GetIDValue>|
|https://github.com/AMDESE/sev-tool||AMD SEV Tool for managing SEV platform certificates|
|https://github.com/AMDESE/runtime||SEV runtime for Kata Containers|
|Linux Security Summit (2019)||Upcoming x86 Technologies for Malicious Hypervisor Protection||November 2019|
|KVM Forum (2019)||Secure Encrypted Virtualization – What’s Next?||November 2019|
|Linux Security Summit (2019)||Enarx – Attested, Secured Execution with AMD’s SEV||August 2019|
|Linux Security Summit (2018)||AMD Encrypted Virtualization Update||November 2018|
|KVM Forum (2018)||Extending Secure Encrypted Virtualization with SEV-ES||October 2018|
|Linux Security Summit (2017)||Protecting VM Register State with AMD SEV-ES||September 2017|
|Linux Security Summit (2016)||AMD x86 Memory Encryption Technologies||December 2016|
|KVM Forum (2016)||AMD’s Virtualization Memory Encryption Technology||September 2016|
|Xen Summit||AMD’s Virtualization Memory Encryption Technology||September 2016|
|Usenix Security Symposium||AMD x86 Memory Encryption Technologies||August 2016|