Removing our Hyper-V host OS from the TCB
summary
Azure confidential VMs remove the Hyper‑V host OS and hypervisor from the TCB by moving emulated devices and attestation into the VM via a guest paravizer, protecting CPU state and encrypting private pages with hardware (AMD SEV‑SNP today, Intel TDX soon). Memory visibility switches use dynamic shared pools and bounce buffers; device drivers validate host messages; VM firmware and secrets live in a VMGS encrypted file (a vhd) and attestation releases the secure key required to boot the guest.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:37What is the Azure Cloud
- 5:40What is a confidential VM
- 7:40How did we do this
- 13:10Microsofts confidential VM design
- 18:09Emulated devices
- 19:46Execution State Integrity
- 20:53Guest Firmware
- 22:33Conclusion
- 23:37Outro
related talks
36mConfidential VMs in the cloud
49mBreaking Hardware-Enforced Security With Hypervisors
13mVM Security with Confidential Computing
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
23mAMD SEV & Azure Local: When Confidential VMs Go Local
07mLightning Talk: Confidential VMs in Kubevirt: Securing VMs With Kube...
32mLVBS and Advanced Kernel Integrity
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs