AMD EPYC Hardware Memory Encryption

Hardware accelerated memory encryption for data-in-use protection. Takes advantage of new security components available in AMD EPYC processors

  1. AES-128 encryption engine embedded in the memory controller. Automatically encrypts and decrypts data in main memory when an appropriate key is provided.
  2. AMD Secure Processor. Provides cryptographic functionality for secure key generation and key management.

Feature Overview

AMD Secure Memory Encryption (SME)

Uses a single key to encrypt system memory. The key is generated by the AMD Secure Processor at boot. SME requires enablement in the system BIOS or operating system. When enabled in the BIOS, memory encryption is transparent and can be run with any operating system.

AMD Secure Encrypted Virtualization (SEV)

Uses one key per virtual machine to isolate guests and the hypervisor from one another. The keys are managed by the AMD Secure Processor. SEV requires enablement in the guest operating system and hypervisor. The guest changes allow the VM to indicate which pages in memory should be encrypted. The hypervisor changes use hardware virtualization instructions and communication with the AMD Secure processor to manage the appropriate keys in the memory controller.

AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES)

Encrypts all CPU register contents when a VM stops running. This prevents the leakage of information in CPU registers to components like the hypervisor, and can even detect malicious modifications to a CPU register state.

News

Product Briefs

White Papers & Specifications

Document Description Revision Date
AMD Memory Encryption Introduction to Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV). April
2016
Protecting VM Register State With SEV-ES Technical overview of the SEV-ES feature, the principles behind the architecture, and protections offered to further isolate encrypted VMs. February
2017
Secure Encrypted Virtualization API Documents the API available to the host hypervisor for management of keys and secure data transfer between host hypervisor and guest VM memory 0.17 October
2018
AMD64 Architecture Programmer’s Manual Volume 2 Describes the AMD64 architecture’s resources and functions that are managed by system software. Note sections

  • 15.34. Secure Encrypted Virtualization and
  • 15.35. Encrypted State (SEV-ES)
3.30 September
2018
Guest Hypervisor Communication Block (GHCB) Standardization Standardizes the Guest-Hypervisor Communication Block (GHCB) format and specifies the required exit support and associated guest state to be provided in the GHCB to allow interoperability between hypervisors and SEV-ES guests. 0.70 October
2018

Scripts & Source

Link Description
https://github.com/AMDESE/AMDSEV Setup scripts useful for running SEV guests. Site also hosts Linux open source code under development (note SEV support has been accepted in upstream projects)

Technical Presentations

Forum Presentation Date
Linux Security Summit (2018) AMD Encrypted Virtualization Update November 2018
KVM Forum (2018) Extending Secure Encrypted Virtualization with SEV-ES October 2018
Linux Security Summit (2017) Protecting VM Register State with AMD SEV-ES September 2017
Linux Security Summit (2016) AMD x86 Memory Encryption Technologies December 2016
KVM Forum (2016) AMD’s Virtualization Memory Encryption Technology September 2016
Xen Summit AMD’s Virtualization Memory Encryption Technology September 2016
Usenix Security Symposium AMD x86 Memory Encryption Technologies August 2016

Support

AMD Server Gurus Community

Videos and Demos