Formal Security Analysis of the AMD SEV-SNP Software Interface

Petar Paradžik,Ante Derek,Marko Horvat

2024-10-17

Abstract:AMD Secure Encrypted Virtualization technologies enable confidential computing by protecting virtual machines from highly privileged software such as hypervisors. In this work, we develop the first, comprehensive symbolic model of the software interface of the latest SEV iteration called SEV Secure Nested Paging (SEV-SNP). Our model covers remote attestation, key derivation, page swap and live migration. We analyze the security of the software interface of SEV-SNP and formally prove that most critical secrecy, authentication, attestation and freshness properties do indeed hold in the model. Furthermore, we find that the platform-agnostic nature of messages exchanged between SNP guests and the AMD Secure Processor firmware presents a potential weakness in the design. We show how this weakness leads to formal attacks on multiple security properties, including the partial compromise of attestation report integrity, and discuss possible impacts and mitigations.

Cryptography and Security

What problem does this paper attempt to address?

### What problem does this paper attempt to solve?

This paper aims to solve the problem of security analysis of the AMD SEV - SNP (Secure Encrypted Virtualization - Secure Nested Paging) software interface. Specifically, the main research question of the paper is:

**"Can an attacker use the software interface of AMD SEV - SNP to make the system enter an undesired state?"**

#### Background and Motivation

With the development of cloud computing, more and more cloud service providers rely on Trusted Execution Environments (TEEs) to ensure the security of user data when it is processed on remote platforms. AMD's SEV technology is one of the hardware - level TEE solutions. It protects the virtual machine memory by encryption and isolates the virtual machine from attacks by privileged software such as hypervisor.

However, although SEV and its subsequent versions (such as SEV - ES) provide a certain level of security, these technologies lack formal security analysis at the implementation level. In particular, the latest SEV - SNP technology, although it has introduced stronger memory integrity protection and other security enhancement features, the security of its software interface has not been fully verified.

#### Research Objectives

To fill this gap, the objective of this paper is to develop a comprehensive symbolic model for formal analysis of the SEV - SNP software interface and verify its key security properties. Specifically, the paper focuses on the following aspects:

1. **Formal Modeling**: Construct a symbolic model of the SEV - SNP software interface that covers functions such as remote authentication, key derivation, page swapping, and live migration.
2. **Security Verification**: Use the Tamarin Prover tool to analyze the model and verify key security properties such as confidentiality, authentication, remote authentication, and freshness.
3. **Discover Potential Weaknesses**: Identify and analyze security vulnerabilities caused by the platform - independent message exchange mechanism, including attacks that partially undermine the integrity of the authentication report.
4. **Propose Mitigation Measures**: Discuss how to mitigate the discovered security weaknesses while maintaining the seamless virtual machine migration feature.

#### Main Contributions

The main contributions of the paper include:

- Developed the first nearly comprehensive formal model that covers the key features of SEV - SNP.
- Provided formal definitions and automated proofs of key security properties, indicating that the SEV - SNP software interface does indeed meet the expected security goals in most cases.
- Discovered several formal attacks caused by the platform - independent message exchange mechanism, especially the impact on the authentication and remote authentication properties.
- Discussed the challenges of fully mitigating these weaknesses and proposed possible mitigation measures.

In summary, through in - depth formal analysis of the AMD SEV - SNP software interface, this paper reveals potential security risks and provides valuable insights for future improvements.