Why container encryption is good for NFV and Edge computing

With the advancement of next-generation networks and the growth of cloud computing, Network Function Virtualization (NFV) and Edge Computing have become integral components of modern infrastructure. However, as the significance of these technologies increases, new security challenges emerge. To ensure data confidentiality and integrity in such environments, AMD has developed the AMD Secure Encrypted Virtualization (SEV) technology, which effectively enhances the security of NFV, Edge Computing (including Multi-Access Edge Computing or MEC), built on a microservices architecture.

AMD SEV

AMD SEV is an advanced technology developed by AMD to enhance the security of virtualized environments. It provides a robust level of protection for virtual machines and containers by encrypting their memory and isolating them from each other and the host system. Each VM or container is assigned a unique encryption key, ensuring the security and confidentiality of data, even in shared computing environments. Learn more

Microservices Architecture

Microservices architecture is an approach where applications are broken down into small, independent, and interacting services. Also known as Cloud Native, this architecture offers flexibility and scalability in application development and deployment.

AMD SEV for Microservices Architecture:

• Security in Use: AMD SEV ensures isolation and security between individual microservices, even in the event of physical access to the server. Data encryption and access management mechanisms prevent unauthorized access and protect against attacks on integrity and confidentiality.
• Security in Motion: Microservices can move across infrastructures, between different servers and data centers. With memory encryption, the container housing the microservice (or one of its replicas) remains encrypted, similar to securely transporting goods in a sealed container.
• Security at Rest: Instant container snapshots are commonly used to save states and enable rollbacks. With memory encryption, the container snapshots are also encrypted using the same key, ensuring data security.

Network Function Virtualization

Network Function Virtualization involves separating the software used in network functions from the physical infrastructure, providing flexibility and scalability in deploying network services. However, the dynamic nature of NFV introduces vulnerabilities that require effective security measures. As network functions typically exist as virtual machines or containers, the same considerations for microservices apply to NFV.

AMD SEV for NFV Security:

• Isolation between microservices: AMD SEV ensures isolation and encryption between virtual machines in the NFV environment, preventing unauthorized access and data interception between different network functions.
• Protection of data at rest and in transit: SEV provides encryption of data in the memory of virtual machines, safeguarding against information leaks during storage and transmission over the network.

Edge Computing

Edge Computing is an architecture that enables data processing closer to the source or endpoints. Multi-Access Edge Computing (MEC) is the approach that places computing resources and services closer to users at network base stations. The deployment of containers with network functions on edge devices enables MEC capabilities.

AMD SEV for Edge Computing and MEC Security:

• Security in edge deployment: AMD SEV ensures security when deploying computations at the edge, protecting data from physical attacks and malicious software that may occur in unreliable edge environments, as edge devices may not be owned by the cloud or network provider.
• Protection between services in MEC: SEV guarantees protection between different services in Multi-Access Edge Computing, preventing unauthorized access and ensuring data confidentiality during transmission and processing at the network edge, especially in scenarios where the edge device executes microservices belonging to different owners.

Conclusion

AMD SEV is a reliable technology for enhancing the security of Network Function Virtualization (NFV), Edge Computing (including MEC) based on a microservices architecture. Implementing AMD SEV in these domains ensures protection against security threats such as unauthorized access, attacks on inter-domain communication, and data leakage. Data encryption at all stages of the microservice lifecycle allows for trusted computations on untrusted hardware and transmission over untrusted communication channels, while leveraging the flexibility of Cloud Native architectures.