TeenodeTeenode

AMD SEV-SNP

AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) is the hardware technology that powers Teenode’s confidential computing platform.

What is SEV-SNP?

SEV-SNP is a hardware-based security technology that provides:

  • Memory Encryption - All VM memory is encrypted with a unique key
  • Integrity Protection - Prevents unauthorized modification of VM memory
  • Attestation - Cryptographic proof that your VM is running in a genuine TEE
  • Hypervisor Isolation - Protection against malicious hypervisor attacks

How It Works

Memory Encryption

Each VM is assigned a unique encryption key by the AMD Secure Processor. All memory pages are encrypted using this key, making it impossible for the hypervisor or other VMs to read your data.

Secure Boot

SEV-SNP provides a secure boot process that measures and validates:

  • Firmware (OVMF/UEFI)
  • Kernel and initrd
  • Virtual machine configuration

These measurements are included in the attestation report.

Attestation

The AMD Secure Processor generates a signed attestation report containing:

  • Launch measurement (hash of VM initial state)
  • Platform firmware version
  • VM policy settings
  • Current VM state

You can verify this report to ensure your VM hasn’t been tampered with:

teenode vm attest vm_xyz789

Security Guarantees

Confidentiality

Your data is encrypted in memory and only accessible to code running inside your VM. Even Teenode administrators cannot access your VM memory.

Integrity

SEV-SNP’s Reverse Map Table (RMP) ensures that memory pages cannot be remapped or modified by the hypervisor without detection.

Authenticity

Attestation reports are signed by AMD’s key, providing cryptographic proof that your VM is running on genuine AMD SEV-SNP hardware.

SEV-SNP vs Previous Generations

FeatureSEVSEV-ESSEV-SNP
Memory Encryption✓✓✓
Register Encryption✗✓✓
Integrity Protection✗✗✓
VM Privilege Levels✗✗✓
Teenode exclusively uses SEV-SNP, the latest and most secure version of AMD’s confidential computing technology.

Hardware Requirements

SEV-SNP requires:

  • AMD EPYC 7003 series (Milan) processors or newer
  • BIOS with SEV-SNP support enabled
  • Linux kernel 5.19+ with SEV-SNP patches
  • QEMU 7.0+ with SEV support
  • OVMF firmware with SEV support

Trust Model

With SEV-SNP, you trust:

  • AMD hardware and firmware
  • Your VM’s software stack

You do NOT need to trust:

  • The cloud provider (Teenode)
  • The hypervisor
  • Other VMs on the same physical host
  • Physical access to the server

Limitations

  • Slight performance overhead (typically 1-5%)
  • Maximum 509 concurrent SEV-SNP VMs per host
  • Some debugging features are restricted for security
  • Live migration requires additional setup

Use Cases

SEV-SNP is ideal for:

  • Processing sensitive data in the cloud
  • Multi-party computation
  • Confidential AI/ML workloads
  • Regulatory compliance (GDPR, HIPAA, etc.)
  • Blockchain validator nodes
  • Secure enclaves for key management

Learn More

PreviousTEE VMs
NextAttestation
    AMD SEV-SNP - Teenode Documentation