AMD SEV

AMD SEV integrates a dedicated AES-128 encryption engine directly into the on-die memory controller. This engine transparently encrypts and decrypts data as it moves between the DRAM and the processor. Each VM is assigned a unique VM Encryption Key (VEK) , generated from a fused hardware root key, ensuring that data belonging to one VM is cryptographically isolated from the hypervisor, host OS, and other VMs on the same physical socket.

SEV-Encrypted State (SEV-ES) adds protection for the VM's CPU register state during context switches. Without SEV-ES, register contents are exposed to the hypervisor when a VM exits (e.g., due to an interrupt). SEV-ES encrypts these registers and saves them to a protected memory area, preventing the hypervisor from inspecting or modifying the VM's execution state. This mitigates active attacks like control-flow hijacking via register manipulation.

A critical feature of SEV-SNP that allows a relying party (e.g., a data owner or a client) to verify that a VM is running genuine, untampered software on authentic AMD hardware. The AMD-SP generates a signed attestation report containing a cryptographic hash of the VM's initial memory state and the platform's identity. This report is rooted in a chain of trust that traces back to a fused AMD root key, enabling a zero-trust deployment model where workloads can be verified before secrets are provisioned.

AMD SEV supports the secure live migration of encrypted VMs between physical hosts. During migration, the VM's encryption key is securely transmitted from the source AMD-SP to the destination AMD-SP using a transport encryption key. The destination platform must be verified as a genuine AMD system. This ensures that the VM's memory remains encrypted throughout the entire migration process, maintaining the confidentiality and integrity of the workload without downtime.

A hardware-based security paradigm that protects data in use by performing computation within a hardware-enforced Trusted Execution Environment (TEE). Unlike encryption for data-at-rest or data-in-transit, confidential computing isolates workloads from the host OS, hypervisor, and cloud provider administrators.

• Eliminates the cloud provider from the trust boundary
• Protects sensitive workloads even on compromised infrastructure
• Foundational for Confidential AI and multi-party data collaboration

A secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. A TEE provides hardware-enforced isolation, meaning even a compromised operating system or hypervisor cannot access its contents.

• AMD SEV implements TEEs at the virtual machine level
• Intel SGX implements TEEs at the application enclave level
• Protects against privileged user attacks and physical memory snooping

The process by which a TEE generates a cryptographically signed report proving its identity, integrity, and that it is running specific code on genuine hardware. This allows a remote party to verify the environment before sending secrets.

• Remote attestation establishes a hardware-rooted chain of trust
• AMD SEV uses the AMD Secure Processor to sign attestation reports
• Essential for secure provisioning and zero-trust architectures

A hardware mechanism that transparently encrypts and decrypts data as it moves between the processor and main memory (DRAM). AMD SEV uses a dedicated AES-128 encryption engine embedded in the memory controller.

• Each VM receives a unique encryption key
• Prevents cold boot attacks and DRAM probing
• Operates at near-native speed with minimal performance overhead

A virtual machine instance whose entire memory space is encrypted with a hardware-generated key inaccessible to the hypervisor. AMD SEV-SNP extends this with integrity protection to prevent replay and data corruption attacks.

• Supported on AMD EPYC processors (Naples, Rome, Milan, Genoa)
• Available on major clouds: AWS, Azure, Google Cloud
• Enables lift-and-shift of existing workloads into confidential environments

A security exploit that infers sensitive information by observing physical side effects of computation—timing, power consumption, cache access patterns, or electromagnetic emissions—rather than breaking the algorithm directly.

• TEEs must defend against cache-timing attacks and page-fault attacks
• AMD SEV-SNP adds reverse map table protection
• Ongoing research area for all confidential computing platforms