Linux Security Summit North America 2017

As enterprise server workloads move from physical hardware to virtual machines, the data they contain is at greater risk of being misused or stolen. Sysadmins, or outside attackers who gain access to the hypervisor, can easily copy virtual disks for offline cracking or glean secrets from the memory allocated to the VM, even if they have no access to the VM itself. To provide greater protection for the data in VMs, Microsoft’s Hyper-V hypervisor introduces “shielded VMs”. Shielded VMs have a range of protections that make it much harder for attackers or insiders to access data inside the VM. In this presentation, Michael Kelley will describe shielded VMs and work Microsoft has done with Linux to make it run in a shielded VM. This work includes the changes made to the Linux boot path, the use of dm-crypt, and the creation of templates from which multiple Linux shielded VMs can be deployed.