BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.3 VM Isolation

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 5 Data Protection and Confidential Computing part of 5

Title

VM Isolation

Control

As new memory and execution isolation technologies become available, it is more feasible to isolate entire VMs. VMs already enjoy a degree of isolation due to technologies like hardware- assisted virtualization, but the memory of each VM remains unencrypted. Some existing memory isolation technologies require implicit trust of the virtual machine manager (VMM). Isolation technologies in future platform generations will remove the VMM from the trust boundary and allow full encryption of VM memory with per-VM unique keys, protecting the VMs from not only malicious software running on the hypervisor host but also rogue firmware.

VM isolation can be used to help protect workloads in multi-tenant environments like public and hybrid clouds. Isolating entire VMs translates to protection against malicious insiders at the cloud provider, or malware exposure and data leakage to other tenants with workloads running on the same platform. Many modern cloud deployments use VMs as container worker nodes. This provides a highly consistent and scalable way to deploy containers regardless of the underlying physical platforms. With full VM isolation, the virtual workers hosting container workloads can be effectively isolated without impacting the benefits of abstracting the container from the underlying platform.

Please refer to the following technology examples in the appendices for more information:

• Intel Trust Domain Extensions (Intel TDX)

• AMD Secure Encrypted Virtualization (SEV)

• Arm Confidential Compute Architecture (CCA)

• IBM VM Isolation Technology