AMD Secure Encrypted Virtualization (SEV)

SEV is a virtual machine-based confidential computing solution; it protects data-in-use by creating a Trusted Execution Environment, that is defined by the boundaries of the confidential VM. SEV uses one key per virtual machine to isolate guests and the hypervisor from one another. The keys are managed by the AMD Secure Processor. SEV requires enablement in the guest operating system and hypervisor. The guest changes allow the VM to indicate which pages in memory should be encrypted. The hypervisor changes use hardware virtualization instructions and communication with the AMD Secure processor to manage the appropriate keys in the memory controller. AMD has evolved SEV to add new features and new capabilities with each generation of AMD EPYC server CPUs to help address the evolving security landscape.  These enhancements are described below. 

Encrypted State (ES) – formerly known as SEV-ES

SEV-ES encrypts all CPU register contents when a VM stops running. This prevents the leakage of information in CPU registers to components like the hypervisor and can even detect malicious modifications to a CPU register state.

Secure Nested Paging (SNP) – formerly known as SEV-SNP

SEV-SNP adds strong memory integrity protection to help prevent malicious hypervisor-based attacks like data replay, memory re-mapping, and more to create an isolated execution environment. Also, SEV-SNP introduces several additional optional security enhancements designed to support additional VM use models, offer stronger protection around interrupt behavior, and offer increased protection against recently disclosed side channel attacks. 

Trusted I/O (TIO) – formerly known as SEV-TIO

SEV-TIO extends the Trusted Execution Environment (TEE) created by SEV to include PCIe devices (NICs, accelerators, storage) using the PCI-SIG defined TEE Device Interface Security Protocol (TDISP). TDISP defines new protocols and functions of devices that enable them to authenticate themselves, prevent traffic interception or masquerading on the PCIe fabric, attest to their configuration, and isolate guest workloads from device controls available to host drivers.

AMD Transparent Secure Memory Encryption (TSME)

TSME uses a single key to encrypt system memory. The key is generated by the AMD Secure Processor at boot. SME requires enablement in the system BIOS or operating system. When enabled in the BIOS, memory encryption is transparent and can be run with any operating system.