Shielded networks for virtual machines

A host computer comprising:

• a network interface card (NIC)
• processing hardware;
• storage hardware storing instructions configured to cause the processing hardware to perform a process, the process comprising:
• executing a virtualization layer comprising a hypervisor kernel that manages use of the processing hardware by virtual machines (VMs) configured to execute on the host computer, the virtualization layer comprising a network stack that directs network communications received by the NIC of the host computer to the VMs and that directs network communications originating from the VMs to the NIC to be transmitted to the network;
• executing a secure module, the secure module configured to communicate via the network with a guardian service to obtain, via the network, a key of the VM based on an attestation of a health state of the host computer and based on an identifier of the VM, wherein the identifier uniquely identifies the VM, and wherein the guardian service provides the key based further on the identifier;
• and
• configuring the host computer to use the VM key to (i) encrypt outbound network communications transmitted from the VM and (ii) decrypt inbound network communications before they are delivered to the VM, wherein the outbound network communications remain encrypted by the VM key when they are transmitted by the NIC of the host computer, wherein the configuring, the encrypting, and the obtaining the VM key are not performed by the VM.

Computer storage hardware storing information configured to cause a computer to perform a process, the process comprising:

• executing a virtualization layer that manages virtual machines (VMs) executing on the computer;
• capturing an attestation of a security state of the host computer and sending the attestation via a network to a guardian service, the host computer comprising a network interface card (NIC) that sends the attestation to the network;
• obtaining, via the NIC and the network, a key corresponding to one of the VMs, the key obtained based on the attestation and based on the computer sending an identifier of the VM via the network, the identifier of the VM uniquely identifying the VM;
• and
• using the key to (i) encrypt outbound network communications of the VM after they are emitted by the VM, and (ii) decrypt inbound network communications before they are delivered to the VM, wherein the outbound network communications remain encrypted by the VM key when they are transmitted by the NIC of the host”.