Host key attestation (based on asymmetric key pairs).TPM-trusted attestation (hardware-based).The HGS supports different attestation modes for a guarded fabric: Video: Introduction to shielded virtual machinesĪttestation modes in the Guarded Fabric solution The Attestation service ensures only trusted Hyper-V hosts can run shielded VMs while the Key Protection Service provides the keys necessary to power them on and to live migrate them to other guarded hosts. The HGS provides two distinct services: attestation and key protection. When a tenant creates shielded VMs that run on a guarded fabric, the Hyper-V hosts and the shielded VMs themselves are protected by the HGS. The diagram below shows how the Host Guardian Service uses attestation to ensure that only known, valid hosts can start the shielded VMs, and key protection to securely release the keys for shielded VMs. 1 Host Guardian Service (HGS) (typically, a cluster of 3 nodes).Shielded VMs and guarded fabric enable cloud service providers or enterprise private cloud administrators to provide a more secure environment for tenant VMs. A shielded VM is a generation 2 VM (supported on Windows Server 2012 and later) that has a virtual TPM, is encrypted using BitLocker, and can run only on healthy and approved hosts in the fabric. To help protect against compromised virtualization fabric, Windows Server 2016 Hyper-V introduced shielded VMs. Protecting high value assets in your organization, such as domain controllers, sensitive file servers, and HR systems, is a top priority. Quite simply, if a virtual machine gets out of an organization (either maliciously or accidentally), that virtual machine can be run on any other system. This is a fundamental danger for every virtualization platform today, whether it's Hyper-V, VMware or any other. In addition to protecting hosts or other virtual machines from a virtual machine running malicious software, we also need to protect virtual machines from a compromised host.

Virtualization security is a major investment area in Hyper-V. Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016 Overview of the guarded fabric

Data exchange host windows 10