Live Migration of Confidential VMs

The memory pages of the source CVM are encrypted using a transport-specific session key before transmission over the network. This ensures that the hypervisor or any network observer cannot inspect the plaintext data-in-use during the migration window.

• Utilizes hardware-generated keys bound to the TEE for wrapping
• Prevents man-in-the-middle attacks on live memory state
• Maintains the data-in-use encryption invariant throughout the process

The destination platform must undergo a fresh hardware attestation process before receiving the VM state. The source CVM verifies the destination's attestation report to confirm it is a genuine, untampered TEE with the correct security properties.

• Destination TCB measurement is cryptographically verified
• Prevents migration to a compromised or downgraded host
• Extends the chain of trust across physical boundaries

During iterative pre-copy migration, the hypervisor tracks memory pages modified by the running VM. These dirty pages are re-transmitted in successive rounds until the rate of modification converges, at which point a brief stop-and-copy phase finalizes the transfer.

• Minimizes VM downtime during migration
• Works in conjunction with memory encryption engines
• Balances total migration time against service interruption

The CVM's identity and sealed secrets are cryptographically bound to the firmware and hardware configuration of the TEE. Migration protocols must re-establish this binding on the destination without exposing sealed keys to the intermediate network or management stack.

• Requires secure key migration or re-wrapping mechanisms
• Prevents sealed data from being usable on unauthorized platforms
• Maintains the integrity of the Trusted Computing Base (TCB)

A core guarantee of Confidential Computing is that the hypervisor is removed from the TCB. Live migration must not reintroduce hypervisor visibility into VM state. The migration protocol is designed so the hypervisor facilitates the transfer but cannot decrypt or modify the encapsulated VM context.

• Hypervisor acts as an untrusted transport layer
• All sensitive state remains opaque to the VMM
• Preserves the security model of technologies like AMD SEV-SNP and Intel TDX

After the VM resumes on the destination host, a new attestation report is generated to provide a fresh proof of execution environment. Downstream services and clients can verify this report to ensure the CVM remains in a trusted state before re-establishing secure channels.

• Enables continuous verification for zero-trust architectures
• Critical for long-running, sensitive AI inference workloads
• Integrates with SPIRE and attestation-aware service meshes

The cryptographic process of verifying the identity and integrity of a TEE before migration or secret release. The source platform generates a signed report containing hardware measurements, which the destination platform validates. Successful attestation proves the target environment is a genuine, untampered TEE capable of receiving the confidential VM.

• Verifies firmware, hardware, and software measurements
• Prevents VM relocation to compromised or impersonated hosts
• Often relies on a Hardware Root of Trust for signature validation

The protection of data while it is actively being processed in CPU registers and memory. Unlike data-at-rest or data-in-transit encryption, this guards against memory scraping, cold boot attacks, and hypervisor introspection. During live migration, the VM's memory pages are encrypted with a transport key negotiated between attested TEEs, ensuring no plaintext data traverses the network.

• Protects against privileged insider threats at the cloud provider
• Maintains encryption continuity across physical host boundaries
• Implemented via total memory encryption engines in modern CPUs

A virtual machine instance backed by hardware-based memory encryption, isolating it from the hypervisor and cloud provider. CVMs are the unit of migration in this process. The migration protocol must preserve the encrypted state of the CVM, including CPU registers, memory pages, and virtual device states, without ever exposing plaintext to the migration infrastructure.

• Combines virtualization with TEE hardware capabilities
• Supported by Intel TDX, AMD SEV-SNP, and AWS Nitro Enclaves
• Requires specialized migration agents that operate within the trust boundary

A mechanism that binds encrypted data to a specific enclave identity, ensuring it can only be decrypted by the same application on the same platform. During migration, sealing keys must be securely transferred or re-derived on the destination host. This prevents a migrated VM from being decrypted by an unauthorized party, even if the storage medium is physically stolen.

• Ties persistent state to the enclave's cryptographic measurement
• Enables secure suspend-to-disk and resume operations
• Critical for maintaining state consistency across migration events

Defensive techniques that prevent attackers from extracting secrets by observing physical side effects of computation, such as timing variations, power consumption, or electromagnetic leaks. Live migration introduces new attack surfaces where an adversary could observe migration traffic patterns or timing to infer confidential data. Resistant protocols use constant-time operations and traffic padding.

• Mitigates cache-timing, power analysis, and EM leakage attacks
• Essential for maintaining security during the migration handshake
• Implemented in hardware and reinforced by migration protocol design