Deploying virtual machines in an unsecured environment might expose a cloud tenant to risk of losing confidentiality and integrity of its sensitive data and IP, e.g. via attacks from privileged software, offline memory analysis, and active memory attacks at system interfaces. This talk will present an upcoming Intel technology to isolate VMs from many hardware and most software-based threats, by providing capabilities for confidentiality and integrity of memory, address translation, and cpu state, as well as secure interrupt and exception delivery, and remote attestation. Sean will provide an overview of the technology and its unique, novel features, and briefly cover the state of enabling in KVM and Qemu.
