AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)은 SEV를 확장하여 데이터 리플레이 및 메모리 재매핑과 같은 악의적인 하이퍼바이저 기반 공격을 방지하는 데 도움이 되는 하드웨어 기반 보안을 추가합니다. 증명 보고서는 언제든지 AMD 보안 프로세서에서 직접 요청할 수 있습니다.
Intel Trust Domain Extensions (TDX)는 하드웨어 기반 TEE입니다. TDX는 VM 내에 격리된 신뢰 도메인 (TD)을 만들고 메모리를 관리하고 암호화하기 위해 하드웨어 확장 프로그램을 사용합니다.
Intel TDX는 오프라인, 동적 랜덤 액세스 메모리 (DRAM) 분석, DRAM 인터페이스의 활성 공격과 같이 플랫폼 메모리에 대한 물리적 액세스를 사용하는 제한된 형태의 공격에 대한 TD의 방어를 강화합니다. 이러한 공격에는 메모리 콘텐츠 캡처, 수정, 재배치, 스플라이싱, 별칭 지정이 포함됩니다.
NVIDIA 컨피덴셜 컴퓨팅 GPU가 있는 컨피덴셜 VM 인스턴스는 보안 인공지능 (AI) 및 머신러닝 (ML) 워크로드를 실행하는 데 적합합니다.
NVIDIA 컨피덴셜 컴퓨팅은 가속화된 워크로드의 보안을 강화합니다. 이 기능을 사용하면 컨피덴셜 VM 인스턴스가 사용 중인 데이터와 코드의 기밀성과 무결성을 보호할 수 있습니다. NVIDIA H100 Tensor Core GPU는 CPU에서 GPU로 TEE를 확장하여 가속화된 워크로드에 컨피덴셜 컴퓨팅을 지원합니다.
이 구현은 단일 H100 GPU 또는 개별 보안 관리형 인스턴스 그룹 (MIG) 인스턴스에서 실행되는 워크로드를 보호하고 격리하는 하드웨어 기반 TEE를 만듭니다. TEE는 컨피덴셜 컴퓨팅 모드에서 컨피덴셜 VM 인스턴스와 연결된 GPU 간에 보안 채널을 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eConfidential VM instances use hardware-based memory encryption to protect data and applications from being read or modified while in use.\u003c/p\u003e\n"],["\u003cp\u003eConfidential VMs provide isolation through encryption keys that are generated and stored in dedicated hardware inaccessible to the hypervisor and attestation to verify the VM's identity and state.\u003c/p\u003e\n"],["\u003cp\u003eThe type of Confidential Computing technology used by a Confidential VM instance, such as AMD SEV, AMD SEV-SNP, or Intel TDX, depends on the chosen machine type and CPU platform.\u003c/p\u003e\n"],["\u003cp\u003eAMD SEV offers high performance with minimal impact compared to standard VMs, while AMD SEV-SNP provides enhanced security but may result in lower network bandwidth and higher latency.\u003c/p\u003e\n"],["\u003cp\u003eSeveral Google Cloud services, including Confidential Google Kubernetes Engine Nodes, Confidential Space, Dataproc Confidential Compute, and Dataflow Confidential VM, utilize Confidential VM technology.\u003c/p\u003e\n"]]],[],null,["# Confidential VM overview\n\nConfidential VM instances are a type of [Compute Engine](/compute/docs)\nvirtual machine. They use hardware-based memory encryption to help ensure that\nyour data and applications can't be read or modified while in use.\n\nConfidential VM instances offer the following benefits:\n\n- **Isolation**: Encryption keys are generated by---and reside solely\n in---dedicated hardware, inaccessible to the hypervisor.\n\n- **Attestation**: You can verify the identity and the state of the VM, to\n make sure that key components haven't been tampered with.\n\nThis type of hardware isolation and attestation is known as a\n*Trusted Execution Environment* (TEE).\n\nYou can\n[enable the Confidential VM service](/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance)\nwhenever you create a new VM instance.\n\nConfidential Computing technologies\n-----------------------------------\n\nWhen setting up a Confidential VM instance, the type of Confidential Computing\ntechnology that's used is based on the\n[machine type and CPU platform you choose](/confidential-computing/confidential-vm/docs/supported-configurations).\nWhen choosing a Confidential Computing technology, make sure it fits your\nperformance and [cost](/confidential-computing/confidential-vm/pricing) needs.\n\n### AMD SEV\n\nAMD Secure Encrypted Virtualization (SEV) on Confidential VM offers hardware-based\nmemory encryption through the AMD Secure Processor, and boot-time attestation\nthrough Google's vTPM.\n\nAMD SEV offers high performance for demanding computational tasks. The\nperformance difference between an SEV Confidential VM and a standard\nCompute Engine VM can range from nothing to minimal, depending on the\nworkload.\n\nUnlike other Confidential Computing technologies on Confidential VM, AMD SEV\nmachines that use the N2D machine type support live migration.\n\nRead the\n[AMD SEV whitepaper](https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/memory-encryption-white-paper.pdf).\n\n### AMD SEV-SNP\n\nAMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) expands on\nSEV, adding hardware-based security to help prevent malicious hypervisor-based\nattacks like data replay and memory remapping. Attestation reports can be\nrequested at any time directly from the AMD Secure Processor.\n\nRead the\n[AMD SEV-SNP whitepaper](https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf).\n\n### Intel TDX\n\nIntel Trust Domain Extensions (TDX) is a hardware-based TEE. TDX creates an\nisolated trust domain (TD) within a VM, and uses hardware extensions for\nmanaging and encrypting memory.\n\nIntel TDX augments defense of the TD against limited forms of attacks that use\nphysical access to the platform memory, such as offline, dynamic random access\nmemory (DRAM) analysis and active attacks of DRAM interfaces. These attacks\ninclude capturing, modifying, relocating, splicing, and aliasing memory\ncontents.\n\nRead the\n[Intel TDX whitepaper](https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/documentation.html).\n\n### NVIDIA Confidential Computing\n\nConfidential VM instances with NVIDIA Confidential Computing GPUs are ideal for running secure\nartificial intelligence (AI) and machine learning (ML) workloads.\n\nNVIDIA Confidential Computing provides enhanced security for accelerated workloads. This feature\nenables Confidential VM instances to protect the confidentiality and integrity of\ndata and code in use. The\n[NVIDIA H100 Tensor Core GPUs](https://www.nvidia.com/en-us/data-center/h100/)\nextend the TEE from the CPU to the GPU, enabling confidential computing for\naccelerated workloads.\n\nThis implementation creates a hardware-based TEE that secures and isolates\nworkloads running on a single H100 GPU, or on the individual secured\n[managed instance group (MIG)](/compute/docs/instance-groups#managed_instance_groups)\ninstances. The TEE establishes a secure channel between a Confidential VM instance\nand the attached GPU in confidential computing mode.\n\nRead the\n[NVIDIA H100 Tensor Core GPU Architecture whitepaper](https://resources.nvidia.com/en-us-tensor-core).\n\nConfidential VM services\n------------------------\n\nIn addition to Compute Engine, the following Google Cloud services make\nuse of Confidential VM:\n\n- [Confidential Google Kubernetes Engine Nodes](/kubernetes-engine/docs/how-to/confidential-gke-nodes)\n enforce the use of Confidential VM for all your GKE nodes.\n\n- [Confidential Space](/confidential-computing/confidential-space/docs/confidential-space-overview) uses\n Confidential VM to let parties share sensitive data with a mutually agreed upon\n workload, while they retain confidentiality and ownership of that data.\n\n- [Dataproc Confidential Compute](/dataproc/docs/concepts/configuring-clusters/confidential-compute)\n features Dataproc clusters that use Confidential VM.\n\n- [Dataflow Confidential VM](/dataflow/docs/reference/service-options)\n features Dataflow worker Confidential VM instances.\n\nWhat's next\n-----------\n\nRead about Confidential VM\n[supported configurations](/confidential-computing/confidential-vm/docs/supported-configurations)."]]
