Confidential Computing for OpenPOWER

, , , , , , , , , , , , , , , , , , , , , and
ACM EuroSys
Abstract. This paper presents Protected Execution Facility (PEF), a virtual machine-based Trusted Execution Environment (TEE) for confidential computing on Power ISA. PEF enables protected secure virtual machines (SVMs). Like other TEEs, PEF verifies the SVM prior to execution. PEF utilizes a Trusted Platform Module (TPM), secure boot, and trusted boot as well as newly introduced architectural changes for Power ISA systems. Exploiting these architectural changes requires new firmware, the Protected Execution Ultravisor. PEF is supported in the latest version of the POWER9 chip. PEF demonstrates that access control for isolation and cryptography for confidentiality is an effective approach to confidential computing. We particularly focus on how our design (i) balances between access control and cryptography, (ii) maximizes the use of existing security components, and (iii) simplifies the management of the SVM life cycle. Finally, we evaluate the performance of SVMs in comparison to normal virtual machines on OpenPOWER systems.
author = {Guerney D. H. and Hunt and Ramachandra and Pai and Michael V. and Le and Hani and Jamjoom and Sukadev and Bhattiprolu and Rick and Boivie and Laurent and Dufour and Brad and Frey and Mohit and Kapur and Kenneth A. and Goldman and Ryan and Grimm and Janani and Janakirman and John M. and Ludden and Paul and Mackerras and Cathy and May and Elaine R. and Palmer and  and Bharata and Bhasker and Rao and Lawrence and Roy and William A. and Starke and Jeff and Stuecheli and Enriquillo and Valdez and Wendel and Voigt},
title = {{Confidential Computing for OpenPOWER}},
booktitle = {ACM EuroSys},
address = {Virtual},
month = {Apr},
year = {2021}