Cloud-Aware File System for Virtual Machine Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Server virtualization and cloud computing environments face challenges in storage utilization and security, with traditional storage solutions being ill-equipped to handle the mobility and security threats of virtual machine files, leading to increased costs and legal issues.
Innovation Solution
A cloud-aware file system (CAFS) that intercepts commands from the hypervisor to securely store and manage virtual machine files by encrypting them using encryption keys and policies managed on an external server, allowing flexible storage pooling and secure access while minimizing performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional storage solutions are used for virtual machine files, then storage capacity is provided, but security is compromised and storage utilization is poor
Solution Approach 1:
The patent introduces a file system driver as an intermediary layer between the hypervisor and physical storage. This driver intercepts file system calls, encrypts data before storage, and manages key distribution. The intermediary enables traditional storage infrastructure to provide both security and adaptability by transforming data on-the-fly without requiring specialized storage hardware.
Solution Approach 2:
The system dynamically changes the encryption state of data based on access patterns and sensitivity levels. Data is encrypted at rest using cryptographic transforms, and the encryption parameters (keys, algorithms) are changed based on policy rules. This allows the same storage infrastructure to handle both secure and non-secure data efficiently.
2Reliability
If encryption is applied to all virtual machine files, then security is improved, but performance deteriorates due to processing overhead
Solution Approach 1:
The patent applies encryption selectively rather than uniformly to all data. The file system driver analyzes file system calls and applies encryption only to sensitive data based on policy rules. Non-sensitive data can be stored and accessed without encryption overhead, while sensitive data receives cryptographic protection. This localized approach maintains security for critical data while preserving performance for non-critical operations.
3Adaptability or versatility
If cloud service providers store sensitive data, then storage capacity and accessibility are improved, but legal and compliance risks increase
Solution Approach 1:
The patent extracts the security-critical components (encryption keys and policy management) from the cloud service provider's control and places them in client-controlled environments. The file system driver on the client side manages key distribution and policy enforcement, while the cloud provider only stores encrypted data. This extraction allows cloud accessibility while eliminating compliance risks related to data sovereignty and regulatory requirements.
4Speed
If virtual machine files are stored on local disks or network storage, then access speed is maintained, but security vulnerabilities increase due to file mobility
Solution Approach 1:
The patent applies encryption to data before it is written to storage media, whether local or network-based. The file system driver encrypts data in transit to storage, so that even if files are moved or copied, they remain protected. This preliminary cryptographic action ensures that the inherent security vulnerabilities of file mobility are neutralized while maintaining access performance through efficient cryptographic operations.
Data Source
AI summary
A virtual file system is described that is implemented in a virtualization platform as a stackable file system layer that intercepts file operations between a hypervisor and a physical file system. The virtual file system encrypts (at least in part) VM files to be stored, organizes the encrypted VM files into VM sets, and then maps and stores the encrypted VM sets into storage pools. Storage and access to files within the VM sets is controlled through the use of administrator-determined policies governing storage, security, access control, authentication, and auditing. The system and method described herein allow a seamless integration between a data center (e.g., a private cloud) and computing resources served across the internet and supported by cloud service providers (e.g., public clouds) while ensuring that the security needs of customers and cloud service providers are met.