Secure Encrypted Virtualization (SEV)

Each virtual machine is assigned a unique AES-128 encryption key managed by the AMD Secure Processor. This key encrypts the VM's entire memory space, making data unintelligible to the hypervisor, other VMs, or any unauthorized entity on the physical host.

• Key Isolation: The hypervisor never has access to the plaintext encryption key.
• Hardware Root of Trust: Key generation and management occur within the dedicated AMD Secure Processor, a separate ARM core on the CPU die.
• Transparent Operation: Encryption and decryption happen in-line at the memory controller with minimal performance overhead.

SEV fundamentally changes the trust model of virtualization by removing the hypervisor from the Trusted Computing Base (TCB). Even a compromised or malicious hypervisor cannot read the plaintext memory of a protected guest VM.

• Privilege De-escalation: The hypervisor retains control over scheduling and resource allocation but loses visibility into VM memory contents.
• Mitigation of Insider Threats: Protects against rogue cloud administrators with physical or administrative access to the host.
• Register State Protection: Guest VM CPU registers are also encrypted during context switches to prevent information leakage.

SEV-ES extends the base SEV protection by encrypting the guest VM's CPU register state on each hypervisor transition. This prevents the hypervisor from inspecting register values during VM exits caused by interrupts or I/O operations.

• Control Flow Integrity: Prevents the hypervisor from manipulating the guest's instruction pointer or stack pointer.
• Automatic State Encryption: The hardware automatically encrypts and decrypts register state during VMRUN and VMEXIT operations.
• Exception Handling: Even during guest-triggered exceptions, the register state presented to the hypervisor is encrypted.

SEV-SNP adds memory integrity protection to prevent malicious hypervisor attacks like data replay, memory remapping, and page table tampering. It introduces a Reverse Map Table (RMP) managed by the Secure Processor.

• Reverse Map Table (RMP): Tracks ownership and permissions for every physical page assigned to a guest, enforcing that a page can only be mapped into one guest at a time.
• Page Validation: The guest VM can cryptographically validate the contents and permissions of a page before accepting it into its address space.
• Replay Attack Prevention: Prevents the hypervisor from substituting a stale, previously valid page to trick the guest.

SEV-SNP provides a hardware-rooted attestation mechanism that allows a guest VM owner to cryptographically verify the integrity of the firmware, hypervisor, and initial VM state before provisioning secrets.

• Remote Attestation Flow: The AMD Secure Processor signs a measurement report containing the SHA-384 hash of the initial guest memory and firmware.
• Identity Key (IDK): A unique, chip-specific key used to sign attestation reports, verifiable against AMD's Certificate Authority chain.
• Guest-Requested Attestation: The guest VM can request an attestation report at any time to prove its ongoing integrity to external services.

SEV-SNP supports the live migration of confidential VMs between physical hosts without exposing plaintext memory. The migration process maintains encryption and integrity throughout the transfer.

• Migration Agent (MA): A privileged helper within the guest that orchestrates the secure transfer of encrypted pages.
• Page Re-encryption: Memory pages are re-encrypted with a transport key before leaving the source host and re-encrypted with the destination VM's key upon arrival.
• Attested Destination: The source VM can attest the destination platform before initiating the migration to ensure it is a genuine, trusted AMD SEV-SNP host.

The cryptographic process that proves a VM is running on genuine AMD hardware with SEV enabled. The AMD Platform Security Processor (PSP) signs an attestation report containing:

• The VM's measurement (hash of initial memory and firmware)
• The Platform Diffie-Hellman key for secure session establishment
• The chip's endorsement key chain rooted in AMD's certificate authority A remote party verifies this report before provisioning secrets or sensitive data to the VM.

The set of all hardware, firmware, and software components critical to a system's security. SEV dramatically shrinks the TCB by removing the hypervisor, host OS, and cloud provider administrators from the trust boundary. The remaining TCB includes:

• The AMD System-on-Chip (SoC) and PSP
• The guest VM's kernel and application
• The SEV firmware running on the PSP A smaller TCB reduces the attack surface and simplifies formal verification.