Get started Bring yourself up to speed with our introductory content.

How Host Guardian secures Windows Server 2016 Hyper-V VMs

In an effort to get more workloads into the Azure cloud, Microsoft has developed a new system to protect data in Hyper-V VMs from unauthorized users in Windows Server 2016.

One perennial problem for IT is keeping data safe from prying eyes. How can an organization keep sensitive data...

confidential if the IT department has access to the data? Over the years, enterprise IT has tried to solve this problem, including compartmentalized access and variations of role-based access control. Concerns over these types of privacy issues are getting more attention as organizations contemplate cloud usage; how can they guarantee data privacy when that data resides in a public cloud?

To that end, Microsoft developed a new feature for Windows Server 2016 Hyper-V called Host Guardian. Host Guardian is a server role that is designed to provide virtual machine (VM) privacy at the hypervisor level. Host Guardian uses a combination of three different features to provide this privacy.

Host Guardian uses layers for Hyper-V security

The first of these features is virtual hard disk encryption. For quite some time Microsoft provided the ability to encrypt physical hard disks through BitLocker. Host Guardian encrypts virtual hard disks associated with Hyper-V VMs by enabling BitLocker within the guest operating system. Just as BitLocker uses a physical server's trusted platform module (TPM) chip, a BitLocker encrypted VM will be able to use a virtual TPM chip.

A second Host Guardian capability is something that Microsoft has referred to as encryption in flight. VMs are not static. A Hyper-V VM can be live-migrated from one host server to another. The Host Guardian service can be used to encrypt the VM during the migration.

The third capability is that Host Guardian blocks access to a VM's memory. This should prevent attacks that use host level memory extractions to access VM data.

Microsoft hopes Host Guardian will spur use of cloud VMs

Although these mechanisms can protect a Hyper-V VM from an administrator's prying eyes, it would be short-sighted to think of Host Guardian as just a hypervisor-level privacy mechanism. Microsoft has stated it has designed Windows Server 2016 to be a cloud-first operating system. Even though Host Guardian is able to ensure privacy for VMs running in an organization's own data center, it is also designed to provide privacy for VMs running in public clouds.

When you consider Microsoft's goal of providing privacy for cloud-based VMs, it becomes apparent why Microsoft chose to design Host Guardian to include all these security capabilities. Microsoft needed a way to guarantee VM-level privacy without interfering with cloud level or data center level operations. Regardless of where a VM physically runs, there are certain tasks an administrator needs to do to keep the environment healthy. For instance, the administrator needs the ability to live migrate the VM on an as needed basis. The administrator also needs to be able to create backups of the VM. Microsoft designed Host Guardian with such tasks in mind, ensuring VM privacy, without being intrusive.

Protection comes at a price

Host Guardian can be used in one of two ways. When an administrator sets up Host Guardian, she must choose an attestation mode. The attestation mode can be hardware based or administrator based; it cannot be both.

Hardware-based attestation is geared toward public hosting environments. Hardware-based attestation is the more complex type of attestation to configure but also provides the greatest privacy assurance because the trust is rooted in hardware. Hardware-based attestation requires the hardware to be equipped with TPM 2.0 chips and Unified Extensible Firmware Interface 2.3.1 or higher.

Admin-based attestation is more suitable for enterprise IT. It is less complex to configure than hardware-based attestation, but it depends on a trusted Active Directory environment.

The Host Guardian role can be used to ensure privacy for VM owners. However, this privacy comes at a cost. The encryption process will undoubtedly add a degree of overhead to Hyper-V hosts. The shielding of VMs may also make certain types of upgrades or disaster recovery operations more difficult. It is also worth noting that not every VM can be shielded by Host Guardian. If a VM is to be shielded, it must be running Windows Server 2012 or Windows 8 or higher. Likewise, some of the Microsoft documentation indicates that only generation 2 VMs are supported.

Next Steps

Defend your VMs with advanced networking features in Hyper-V

Enterprise security changes coming in Windows Server 2016

How to ensure Hyper-V containers are locked down

This was last published in March 2016

PRO+

Content

Find more PRO+ content and other member only offers, here.

Join the conversation

2 comments

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

How will increased Hyper-V security in Windows Server 2016 encourage your organization to try Azure?
Cancel
Know more about windows 2016 for HPC for engineering applications with Hyper V
Cancel

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchEnterpriseDesktop

SearchVirtualDesktop

Close