SEVered：颠覆AMD的虚拟机加密
SEVered: Subverting AMD's Virtual Machine Encryption
摘要：
AMD SEV是专为虚拟机安全加密而设计的硬件功能。SEV旨在保护虚拟机内存不仅免受其他恶意客户机和物理攻击者的攻击，而且还免受可能的恶意虚拟机管理程序的攻击。这使云和虚拟服务器客户不再完全信任他们的服务器提供商和他们正在使用的虚拟机管理程序。我们提出了SEVered的设计和实现，从一个恶意的虚拟机管理程序能够提取明文从SEV加密的虚拟机的主内存的全部内容的攻击。SEVered既不需要物理访问，也不需要串通虚拟机，而只依赖于在目标虚拟机中运行的远程通信服务，如Web服务器。我们在一个支持SEV的最新AMD服务器平台上验证了SEVered的有效性，该平台在加密的虚拟机中运行不同的服务，如Web或SSH服务器。通过这些示例，我们证明了SEVered即使在目标虚拟机处于高负载的情况下也能可靠有效地提取所有内存内容。
英文摘要：
AMD SEV is a hardware feature designed for the secure encryption of virtual machines. SEV aims to protect virtual machine memory not only from other malicious guests and physical attackers, but also from a possibly malicious hypervisor. This relieves cloud and virtual server customers from fully trusting their server providers and the hypervisors they are using. We present the design and implementation of SEVered, an attack from a malicious hypervisor capable of extracting the full contents of main memory in plaintext from SEV-encrypted virtual machines. SEVered neither requires physical access nor colluding virtual machines, but only relies on a remote communication service, such as a web server, running in the targeted virtual machine. We verify the effectiveness of SEVered on a recent AMD SEV-enabled server platform running different services, such as web or SSH servers, in encrypted virtual machines. With these examples, we demonstrate that SEVered reliably and efficiently extracts all memory contents even in scenarios where the targeted virtual machine is under high load.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
