AMD SEV-SNP: A Confidential Computing Primer

• URL: http://arxiv.org/abs/2608.04039v1
• Date: Mon, 03 Aug 2026 20:59:25 GMT
• Title: AMD SEV-SNP: A Confidential Computing Primer
• Abstract summary: AMD Secure Encrypted with Secure Nested Paging (SEV-SNP) provides Trusted Execution Environments (TEEs) for virtual machines.<n>It encrypts guest memory and register state with keys the hypervisor never possesses, detects any tampering with guest memory at the point of access, and lets a guest prove to a remote verifier exactly what code it is running.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: This paper is a technical primer on AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), a hardware confidential computing implementation that provides Trusted Execution Environments (TEEs) for virtual machines. SEV-SNP treats the hypervisor as adversarial. It encrypts guest memory and register state with keys the hypervisor never possesses, detects any tampering with guest memory at the point of access, and lets a guest prove to a remote verifier exactly what code it is running. The paper constructs each of these guarantees from the hardware up. It opens with the threat model that drives the design and the hardware that enforces it, the AMD Secure Processor and the encryption engine in the memory controller. It then develops the mechanisms that make a confidential guest practical. The Reverse Map Table provides memory integrity against an adversary who controls the page tables. The privilege and communication machinery (VM Privilege Levels, the encrypted VM Save Area, and the GHCB protocol) lets the guest cooperate with a hypervisor it does not trust. The attestation pipeline binds a hardware-signed measurement of the guest's initial state to AMD's certificate chain, so a remote verifier can confirm independently what is running.

Related papers

• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack [4.709588811674974]
  AMD emphasizes the capability to prevent Trusted Computing Base rollback attacks.<n>In this architecture, safeguarding the hardware root seed is the ultimate line of defense.<n>We introduce MilanLaunchy attack, an exploit that achieves code execution on the AMD secure processor.<n>We develop BadFuse attack, which extracts the hardware root seed by exploiting a lack of write restrictions in the fuse controller.
  arXiv  Detail & Related papers  (2026-05-13T04:40:23Z)
• Proof of Cloud: Data Center Execution Assurance for Confidential VMs [3.3382699707745522]
  Data Center Execution Assurance (DCEA) is a design generating "Proofs of Cloud"<n>DCEA binds a CVM to its underlying platform using vTPM-anchored measurements, ensuring CVM launch evidence and TPM quotes refer to the same physical chassis.<n>Our approach applies to CVMs accessing vTPMs and running on top of software stacks fully controlled by the cloud provider.
  arXiv  Detail & Related papers  (2025-10-14T13:01:48Z)
• Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules [49.1574468325115]
  Hardware Trojans (HTs) enable attackers to execute unauthorized software or gain illicit access to privileged operations.<n>This manuscript introduces a hardware-based methodology for detecting runtime HT activations using Error Correction Codes (ECCs) on a RISC-V microprocessor.
  arXiv  Detail & Related papers  (2025-06-18T12:37:14Z)
• Trusted Compute Units: A Framework for Chained Verifiable Computations [41.94295877935867]
  This paper introduces the Trusted Compute Unit (TCU), a unifying framework that enables composable and interoperable computations across heterogeneous technologies.<n>By enabling secure off-chain interactions without incurring on-chain confirmation delays or gas fees, TCUs significantly improve system performance and scalability.
  arXiv  Detail & Related papers  (2025-04-22T09:01:55Z)
• WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP [2.8436446946726557]
  AMD SEV-SNP offers VM-level trusted execution environments (TEEs) to protect sensitive cloud workloads. WeSee attack injects malicious #VC into a victim VM's CPU to compromise the security guarantees of AMD SEV-SNP. Case-studies demonstrate that WeSee can leak sensitive VM information (kTLS keys for NGINX), corrupt kernel data (firewall rules), and inject arbitrary code.
  arXiv  Detail & Related papers  (2024-04-04T15:30:13Z)
• Heckler: Breaking Confidential VMs with Malicious Interrupts [2.650561978417805]
  Heckler is a new attack wherein the hypervisor injects malicious non-timer interrupts to break the confidentiality and integrity of CVMs. With AMD SEV-SNP and Intel TDX, we demonstrate Heckler on OpenSSH and to bypass authentication.
  arXiv  Detail & Related papers  (2024-04-04T11:37:59Z)
• Formal Security Analysis of the AMD SEV-SNP Software Interface [0.0]
  AMD Secure Encrypted technologies enable confidential computing by protecting virtual machines from highly privileged software such as hypervisors.<n>We develop the first, comprehensive symbolic model of the software interface of the latest SEV iteration called SEV Secure Nested Paging (SEV-SNP)
  arXiv  Detail & Related papers  (2024-03-15T13:39:55Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• Putting a Padlock on Lambda -- Integrating vTPMs into AWS Firecracker [49.1574468325115]
  Software services place implicit trust in the cloud provider, without an explicit trust relationship. There is currently no cloud provider that exposes Trusted Platform Module capabilities. We improve trust by integrating a virtual TPM device into the Firecracker, originally developed by Amazon Web Services.
  arXiv  Detail & Related papers  (2023-10-05T13:13:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.