Remote Attestation in AMD SEV-SNP Confidential VMs

on YouTube ↗15m

" summary

Runs a vTPM inside the SVSM of AMD SEV‑SNP Confidential VMs so hypervisor cannot read TPM state, with a modified kernel TPM driver and reuse of userland TPM tools, IMA and OVMF PCR population. Demonstrates remote attestation with a Keylime proof‑of‑concept, currently executing in SVSM at VMPL0 (CPL3 not yet implemented). Explores ephemeral vTPM (per‑boot manufactured keys), encrypted state persistence and GCM‑protected communications that invalidate keys on tamper.

AI-written summary · about

" chapters (7)

1. 0:00Introduction to remote attestation
2. 0:20Need for virtual TPM in confidential VMs
3. 1:25Running vTPM inside SEV-SNP VMs
4. 3:39Persisting vTPM state securely
5. 5:49Ephemeral vTPM approach
6. 6:33Remote attestation with Keylime
7. 8:21Discussion and Q&A

" related talks

• 41mUnifying Confidential AttestationDov Murik, Tobin Feldman-Fitzthum · KVM Forum 2022
• 26mVirtual TPM based attestation for Intel Trust Domain ExtensionsJiewen Yao · OC3 2023
• 28mProviding Confidential Guest Services with a Secure VM Service Module on AMDThomas Lendacky · KVM Forum 2022
• 25mProtecting from MaliciousHypervisor Using AMD SEV-SNPBrijesh Singh · KVM Forum 2021
• 49mBreaking Hardware-Enforced Security With HypervisorsJoseph Sharkey · Black Hat USA 2016
• 29mA Simple Protocol for Remote Attestation of System IntegrityRoberto Sassu · Linux Security Summit Europe 2018
• 43mHardware-backed Per-process SecretsMatthew Garrett · Linux Security Summit Europe 2023
• 42mTPM based attestation - how can we use it for good?Matthew Garrett · linux.conf.au 2020