English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Customers of cloud services have to trust the cloud providers, as theycontrol the building blocks that form the cloud. This includes the hypervisorenabling the sharing of a single hardware platform among multiple tenants. AMDSecure Encrypted Virtualization (SEV) claims a new level of protection in cloudscenarios. AMD SEV encrypts the main memory of virtual machines withVM-specific keys, thereby denying the higher-privileged hypervisor access to aguest's memory. To enable the cloud customer to verify the correct deploymentof his virtual machine, SEV additionally introduces a remote attestationprotocol.This paper analyzes the firmware components that implement the SEVremote attestation protocol on the current AMD Epyc Naples CPU series. Wedemonstrate that it is possible to extract critical CPU-specific keys that arefundamental for the security of the remote attestation protocol.Building on theextracted keys, we propose attacks that allow a malicious cloud provider acomplete circumvention of the SEV protection mechanisms. Although theunderlying firmware issues were already fixed by AMD, we show that the currentseries of AMD Epyc CPUs, i.e., the Naples series, does not prevent theinstallation of previous firmware versions. We show that the severity of ourproposed attacks is very high as no purely software-based mitigations arepossible. This effectively renders the SEV technology on current AMD Epyc CPUsuseless when confronted with an untrusted cloud provider. To overcome theseissues, we also propose robust changes to the SEV design that allow futuregenerations of the SEV technology to mitigate the proposed attacks.

Insecure Until Proven Updated: Analyzing AMD SEV's Remote Attestation