Securing AMD SEV: Protecting Private Data in the Cloud

C
Security
Linux
Cloud
Research
Computer Architecture
Operating Systems

Nowadays, it is common for companies to use hardware from cloud computing providers like Google to host their computing services. Using standard hardware, the cloud computing provider has full access to the data that is stored by the user as well as the ability to modify it. As a result, the cloud computing provider could potentially access user information. This property is undesirable for those who wish to do computing with sensitive data. AMD’s Secure Encrypted Virtualization (SEV) is a technology that enables secure cloud computing by scrambling the data that is stored by the user. However, their work has recently been shown to be insecure, meaning the protections promised by AMD are breakable. The technology can be abused to read any secret data stored on the system. We propose adding an additional layer of protection to prevent this attack. Without our improvement, cloud computing providers would be able to steal their clients sensitive data. This project will break the tools used for the attack and secure SEV without the introduction of new hardware. This project will have a positive impact on society by restoring the security guarantees of AMD SEV. Cloud computing providers will no longer be able to see the private data of their clients, improving integrity and incentivising users to use cloud computing. Additionally, bad actors who are able to compromise the cloud computing provider will be unable to abuse their privileges to access the private data, preventing them from reaching their desired outcome. The negative outcomes of this project will be minimal. While this technology may be used to hide malicious work being done in the cloud, this scenario is unlikely. In the case that this does occur, cloud computing providers will still have the ability to identify this behavior through other channels such as network traffic. Overall, the societal and ethical impacts will be overwhelmingly positive. This work was performed in the Systems, Security, and Hacking Lab at Oregon State University under the guidance of Dr. Yeongjin Jang. It will be used as part of my master's thesis.

0 Lifts 

Artifacts

Name Description
Project Presentation Presentation explaining the technical details of the project, and showing an early example build in action.   Link
Design Document The design document explaining the technical details of the attack, the proposed defense, and previous related work.   Download
Poster A poster that would have been presented at the 2020 Engineering Expo   Download