Захист віртуальних машин на основі інструкцій нового покоління процесорів AMD Zen

Abstract

It is demonstrated the development of a virtualization environment security subsystem with the help of hardware-accelerated AMD Zen CPU cryptography API and its instruction set for security tasks, including but not limited to: protection against unauthorized memory access, data leaks, hypervisor breach, external attacks and malware spread via the Internet. The method in question utilizes real-time memory encryption and decryption, with the memory bandwidth and computing power sufficient for seamless hypervisor and server operation, virtual machine live migration and secure export, and demonstrates capabilities of ARM Cortex A5 on-board cryptography processor core for mentioned tasks, as well as providing secure asymmetric key exchange invisible and inaccessible to any software beside internal Trusted Platform Module and its inner DRAM memory controller, to guarantee high level of virtual environment security and sufficient resistance to most active attacks with minimum computation overhead, suitable for most real-life virtualization-based workload scenarios. The example subsystem specifically targets Microsoft Windows 10 operating system, however software support for different operating systems (including UNIX-based) may already be provided by appropriate vendors, including enterprise-ready solutions, such as Cisco, Dell, HP, etc.