Encrypting Memory at Scale
summary
Cloudflare enables AMD’s page-granular and transparent SME on gen x servers (EPYC 7642, 8×32 GB DIMMs, Debian 9, kernel 5.4.12) using the BIOS mem_encrypt=on flag and verifies encryption with a custom kernel module that allocates pages, clears them, toggles the C-bit and dumps the buffer. Hardware uses an on-die secure processor (Cortex‑A5) and AES‑128 memory engine. Benchmarks: STREAM shows 2.6–4.2% bandwidth loss, crypto and web tests ~1% hit, production measured ~4–5% fewer requests/sec — overall 0.699% average overhead and the feature works at scale.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:41SECURITY
- 9:49Secure Memory Encryption (SME)
- 10:31SME Components
- 11:27How It Works
- 13:43Transparent SME
- 14:38Does it work? Let's test!
- 17:35Performance benchmarking: STREAM
- 18:24Performance benchmarking: cryptsetup
- 18:59Performance benchmarking: synthetic web traffic
- 20:01Performance benchmarking: Production
- 20:27Future Work
- 21:30Summary
related talks
44mAMD x86 Memory Encryption Technologies
44mAdvancements in Confidential Computing
46mAMD + Azure: Outstanding performance and the latest security features
13mVM Security with Confidential Computing
36mEverybody is talking about Confidential Computing - the minimum Devs should know
31mScaling & Optimizing Performance on AMD EPYC Systems
01h 11mAMD x86 Memory Encryption Technologies
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves