Demystifying AMD SEV Performance Penalty for NFV Deployment
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2024
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866916346280804352 |
|---|---|
| author | Atiiq, Syafiq Al Risdianto, Aris Cahyadi |
| author_facet | Atiiq, Syafiq Al Risdianto, Aris Cahyadi |
| contents | Network Function Virtualization (NFV) has shifted communication networks towards more adaptable software solutions, but this transition raises new security concerns, particularly in public cloud deployments. While Intel's Software Guard Extensions (SGX) offers a potential remedy, it requires complex application adaptations. This paper investigates AMD's Secure Encrypted Virtualization (SEV) as an alternative approach for securing NFV. SEV encrypts virtual machine (VM) memory, protecting it from threats, including those at the hypervisor level, without requiring application modifications. We explore the practicality and performance implications of executing native network function (NF) implementations in AMD SEV-SNP, the latest iteration of SEV. Our study focuses on running an unmodified Snort NF within SEV. Results show an average performance penalty of approximately 20% across various traffic and packet configurations, demonstrating a trade-off between security and performance that may be acceptable for many NFV deployments. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_02212 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Demystifying AMD SEV Performance Penalty for NFV Deployment Atiiq, Syafiq Al Risdianto, Aris Cahyadi Networking and Internet Architecture Network Function Virtualization (NFV) has shifted communication networks towards more adaptable software solutions, but this transition raises new security concerns, particularly in public cloud deployments. While Intel's Software Guard Extensions (SGX) offers a potential remedy, it requires complex application adaptations. This paper investigates AMD's Secure Encrypted Virtualization (SEV) as an alternative approach for securing NFV. SEV encrypts virtual machine (VM) memory, protecting it from threats, including those at the hypervisor level, without requiring application modifications. We explore the practicality and performance implications of executing native network function (NF) implementations in AMD SEV-SNP, the latest iteration of SEV. Our study focuses on running an unmodified Snort NF within SEV. Results show an average performance penalty of approximately 20% across various traffic and packet configurations, demonstrating a trade-off between security and performance that may be acceptable for many NFV deployments. |
| title | Demystifying AMD SEV Performance Penalty for NFV Deployment |
| topic | Networking and Internet Architecture |
| url | https://arxiv.org/abs/2408.02212 |