This content is part of the Essential Guide: A guide to Microsoft Windows Server 2016

Essential Guide

Browse Sections

How Host Guardian secures Windows Server 2016 Hyper-V VMs

In an effort to get more workloads into the Azure cloud, Microsoft has developed a new system to protect data in Hyper-V VMs from unauthorized users in Windows Server 2016.

One perennial problem for IT is keeping data safe from prying eyes. How can an organization keep sensitive data confidential if the IT department has access to the data? Over the years, enterprise IT has tried to solve this problem, including compartmentalized access and variations of role-based access control. Concerns over these types of privacy issues are getting more attention as organizations contemplate cloud usage; how can they guarantee data privacy when that data resides in a public cloud?

To that end, Microsoft developed a new feature for Windows Server 2016 Hyper-V called Host Guardian. Host Guardian is a server role that is designed to provide virtual machine (VM) privacy at the hypervisor level. Host Guardian uses a combination of three different features to provide this privacy.

Host Guardian uses layers for Hyper-V security

The first of these features is virtual hard disk encryption. For quite some time Microsoft provided the ability to encrypt physical hard disks through BitLocker. Host Guardian encrypts virtual hard disks associated with Hyper-V VMs by enabling BitLocker within the guest operating system. Just as BitLocker uses a physical server's trusted platform module (TPM) chip, a BitLocker encrypted VM will be able to use a virtual TPM chip.

A second Host Guardian capability is something that Microsoft has referred to as encryption in flight. VMs are not static. A Hyper-V VM can be live-migrated from one host server to another. The Host Guardian service can be used to encrypt the VM during the migration.

The third capability is that Host Guardian blocks access to a VM's memory. This should prevent attacks that use host level memory extractions to access VM data.

Microsoft hopes Host Guardian will spur use of cloud VMs

Although these mechanisms can protect a Hyper-V VM from an administrator's prying eyes, it would be short-sighted to think of Host Guardian as just a hypervisor-level privacy mechanism. Microsoft has stated it has designed Windows Server 2016 to be a cloud-first operating system. Even though Host Guardian is able to ensure privacy for VMs running in an organization's own data center, it is also designed to provide privacy for VMs running in public clouds.

When you consider Microsoft's goal of providing privacy for cloud-based VMs, it becomes apparent why Microsoft chose to design Host Guardian to include all these security capabilities. Microsoft needed a way to guarantee VM-level privacy without interfering with cloud level or data center level operations. Regardless of where a VM physically runs, there are certain tasks an administrator needs to do to keep the environment healthy. For instance, the administrator needs the ability to live migrate the VM on an as needed basis. The administrator also needs to be able to create backups of the VM. Microsoft designed Host Guardian with such tasks in mind, ensuring VM privacy, without being intrusive.

Protection comes at a price

Host Guardian can be used in one of two ways. When an administrator sets up Host Guardian, she must choose an attestation mode. The attestation mode can be hardware based or administrator based; it cannot be both.

Hardware-based attestation is geared toward public hosting environments. Hardware-based attestation is the more complex type of attestation to configure but also provides the greatest privacy assurance because the trust is rooted in hardware. Hardware-based attestation requires the hardware to be equipped with TPM 2.0 chips and Unified Extensible Firmware Interface 2.3.1 or higher.

Admin-based attestation is more suitable for enterprise IT. It is less complex to configure than hardware-based attestation, but it depends on a trusted Active Directory environment.

The Host Guardian role can be used to ensure privacy for VM owners. However, this privacy comes at a cost. The encryption process will undoubtedly add a degree of overhead to Hyper-V hosts. The shielding of VMs may also make certain types of upgrades or disaster recovery operations more difficult. It is also worth noting that not every VM can be shielded by Host Guardian. If a VM is to be shielded, it must be running Windows Server 2012 or Windows 8 or higher. Likewise, some of the Microsoft documentation indicates that only generation 2 VMs are supported.

Next Steps

Defend your VMs with advanced networking features in Hyper-V

Enterprise security changes coming in Windows Server 2016

How to ensure Hyper-V containers are locked down

Dig Deeper on Microsoft Windows Server 2016