Presentation
Towards Practical Live Migration for Heterogeneous Confidential Virtual Machines
DescriptionThe security properties and practical efficiency of Trusted Execution Environments (TEEs) have made them play an increasingly critical role in cloud computing, e.g., Confidential Virtual Machines (CVMs). However, TEE implementations, closely tied to specific hardware, introduce compatibility challenges for upper cloud services. In this paper, we focus on Live Migration, which is widely used in Normal Virtual Machines (NVMs) by Cloud Service Providers (CSPs) to manage computing resources, e.g., upgrading the host system with out taking services into downtime. Currently, TEE vendor solutions support CVM migration only within homogeneous TEE stacks, without consideration of heterogeneous environments, rendering heterogeneous migration difficult even impossible. To narrow the gap, we propose a generic framework applicable to various x86 TEEs, providing insights into achieving heterogeneous migration. In addition, we implement a migration system based on this frame work that manages to achieve migration between AMD SEV and Hygon CSV by introducing a trusted migration agent with a specific design. The key idea is to emulate the required migration commands of the TEE firmware and resolve compatibility issues through a helper agent. Our prototype offers security guarantees comparable to homogeneous CVM migration, with experiments demonstrating acceptable performance overhead.
Event Type
Research Manuscript
TimeWednesday, July 293:54pm - 4:06pm PDT
LocationMtg Room 202C