PrivateCore
| Company type | Startup (defunct) |
|---|---|
| Industry | Computer security, Cryptography, Software |
| Founded | 2011 |
| Fate | Acquired by Facebook (Meta Platforms) |
| Headquarters | Palo Alto , United States |
| Parent | Meta Platforms |
PrivateCore is a startup funded by venture capital and headquartered in Palo Alto, California. It specializes in software that secures server data through server attestation combined with memory encryption. The company's solution fills the security gap between encryption methods for “data in motion” (such as TLS and email encryption) and “data at rest” (including disk encryption), by safeguarding “data in use” residing in random access memory. PrivateCore’s memory encryption technology protects servers from various threats like cold boot attacks, hardware-based advanced persistent threats, rootkits/bootkits, supply chain compromises, and insider physical attacks. On August 7, 2014, Facebook (now known as Meta Platforms) acquired the company.
History
Established in 2011 by security specialists formerly associated with VMware and Google, PrivateCore secured initial funding from Foundation Capital. The firm provides a form of virtualized physical security, allowing organizations and service providers to deploy servers handling sensitive information securely within outsourced environments while maintaining protection over data actively in use.
The development of PrivateCore’s memory encryption was driven by escalating hacker capabilities, the trend toward outsourcing server infrastructure, growing amounts of sensitive data stored in persistent memory, and broader attack vectors introduced through x86 virtualization.
Facebook publicly announced its acquisition of PrivateCore on August 7, 2014.
Technology
PrivateCore enhances protection for data actively processed on x86 servers by utilizing advancements in microprocessor design such as expanded cache sizes and hardware cryptographic acceleration. This enables effective memory encryption with minimal impact on system performance, outperforming prior academic projects like TRESOR.
The security model relies exclusively on trusting the Central Processing Unit (CPU) while integrating Trusted Platform Module (TPM) devices along with Intel’s Trusted Execution Technology (Intel TXT) to perform remote attestation of servers. Cryptographic operations benefit from Intel’s hardware-accelerated AES instructions (AES-NI).
The technology is specifically designed for environments where computing infrastructure is outsourced or hosted externally, and full trust in the underlying hardware cannot be assumed.
Products
The product suite known as PrivateCore vCage comprises two main components: vCage Manager and vCage Host. vCage Manager is responsible for verifying the integrity of Linux-based x86 servers running the vCage Host software. Meanwhile, vCage Host operates directly on bare-metal servers, providing a fortified hypervisor based on KVM that encrypts server RAM using AES encryption. It achieves this by loading a secure hypervisor into the CPU cache to protect memory paging between cache and RAM. Although built upon the KVM platform, vCage shows potential compatibility with alternative hypervisors and supports existing KVM management tools.
Use cases for vCage include establishing trusted OpenStack compute clusters and securing x86 servers deployed in co-location or bare-metal cloud infrastructures.
Both vCage Manager and vCage Host were introduced to the market on February 11, 2014.
External links
- Physical Privilege Escalation and Mitigation in the x86 World, presentation delivered by the founders at CanSecWest 2013