Abstract:The confidentiality of tenant's data is confronted with high risk when facing hardware attacks and privileged malicious software. Hardware-based memory encryption is one of the promising means to provide strong guarantees of data security. Recently AMD has proposed its new memory encryption hardware called SME and SEV, which can selectively encrypt memory regions in a fine-grained manner, e.g., by setting the C-bits in the page table entries. More importantly, SEV further supports encrypted virtual machines. This, intuitively, has provided a new opportunity to protect data confidentiality in guest VMs against an untrusted hypervisor in the cloud environment. In this paper, we first provide a security analysis on the (in)security of SEV and uncover a set of security issues of using SEV as a means to defend against an untrusted hypervisor. Based on the study, we then propose a software-based extension to the SEV feature, namely Fidelius, to address those issues while retaining performance efficiency. Fidelius separates the management of critical resources from service provisioning and revokes the permissions of accessing specific resources from the un-trusted hypervisor. By adopting a sibling-based protection mechanism with non-bypassable memory isolation, Fidelius embraces both security and efficiency, as it introduces no new layer of abstraction. Meanwhile, Fidelius reuses the SEV API to provide a full VM life-cycle protection, including two sets of para-virtualized I/O interfaces to encode the I/O data, which is not considered in the SEV hardware design. A detailed and quantitative security analysis shows its effectiveness in protecting tenant's data from a variety of attack surfaces, and the performance evaluation confirms the performance efficiency of Fidelius.

FendOff encryption software to secure personal information on computers and mobile devices

Android File And Message Encrypted Application Using Advanced Encryption Standard-Vigenere and Electronic Codebook/ Public Key Cryptography Standards/Padding a Hybrid Encryption Algorithm

AppShell: Making Data Protection Practical for Lost or Stolen Android Devices

SoK: Untangling File-based Encryption on Mobile Devices

Protecting mobile devices from physical memory attacks with targeted encryption

Practical Solutions For Format-Preserving Encryption

AES-Based Android Video Encryption and Decryption App

Research on User Privacy Data Protection Mechanism Under Android System

Taming Information-Stealing Smartphone Applications (On Android)

Comprehensive VM Protection Against Untrusted Hypervisor Through Retrofitted AMD Memory Encryption

FauxCrypt - A Method of Text Obfuscation

Security Memory System for Mobile Device or Computer Against Memory Attacks

Cryptographic Key Protection Against Frost for Mobile Devices

Design and Implementation of Waycryptic, a Versatile Cryptographic File System for Linux

IDCrypt: A Multi-User Searchable Symmetric Encryption Scheme for Cloud Applications.

Encryption System for SMS Based on ARM

A fusion data security protection scheme for sensitive E-documents in the open network environment

Implementation of Encrypted File System under Windows

Vacuum: An Efficient and Assured Deletion Scheme for User Sensitive Data on Mobile Devices

Secure Cloud Storage with Client-Side Encryption Using a Trusted Execution Environment

Responsive Zwitterionic Polymers with Humidity and Voltage Dual-Switching for Multilevel Date Encryption and Anticounterfeiting