1

I have a cloud VM. It's Centos 7 and I used full disk encryption during install. I also installed dropbear SSH to remotely unlock said server in case of a reboot. No one but me have administrative access to the machine. Is there a way to prevent ISP to sniff on my data? I think when I decrypt the server so it can run it stores decryption keys in memory. If my ISP will "snapshot" this machine it will get an image of the memory and can extract the keys, can it? Is there a way to prevent this? Can you encrypt memory?

Improve this question

1 Answer 1

Reset to default
1

There are some technologies that encrypt memory accesses in hardware, like AMD's Secure Memory Encryption (white paper, article on LWN), but it's mostly targeted against cold-boot attacks.

The general problem here is, that you'd need to save the encryption key somewhere to be able to use it, and then it can be stolen etc. (The same LWN article describes Intel's "Software Guard Extensions", which seems a bit closer to what you'd like but has a hint of DRM smell on it, and apparently requires signatures from Intel...)

If you're running VMs on other people's machines, then you don't own and can't control the hardware, so not putting sensitive data (at least not sensitive keys) there is about the only option you have.

Improve this answer
2
  • Ok, thanks, I wont keep anything sensitive there. Will probably do dedicated hosting but the price is way above single VM.
    – deleteme
    Commented Aug 29, 2016 at 9:55
  • Homomorphic Crypto-Processor? Its not here yet, but wont this have potential to make cloud computing secure?
    – Dog eat cat world
    Commented Aug 29, 2016 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .