Cloud Hard Disk Encryption via Hardware Encryptor Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud hard disk encryption and decryption methods, such as those using qemu-kvm, significantly reduce server performance due to the encryption/decryption process being conducted at the hypervisor layer, resulting in substantial data reading and writing losses, particularly when using libraries like nettle, which can incur losses of over 50% compared to non-encrypted operations.
Innovation Solution
A method and system that utilize an encryptor adaptation library to manage encryption and decryption operations by calling a pre-established encrypted disk, determining the target encryptor, and transmitting operation data via specific operation interfaces, thereby offloading encryption/decryption from the server to a hardware encryptor, improving performance and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption/decryption is conducted at the hypervisor layer using software libraries, then data security is achieved, but server performance deteriorates significantly with data reading and writing losses exceeding 50%
Solution Approach 1:
The patent introduces a hardware encryptor as an intermediary device between the hypervisor and storage devices. The encryptor contains dedicated encryption/decryption circuits that operate independently from the server's CPU, mediating data security operations without burdening the host system. This resolves the contradiction by achieving data security through hardware-based encryption while maintaining server performance through architectural separation of security functions from compute functions.
Solution Approach 2:
The patent replaces software-based encryption libraries (mechanical/computational system) with hardware-based encryption circuits (physical system). By substituting software encryption routines that consume CPU cycles with dedicated hardware encryption modules that operate in parallel, the system achieves data security without the performance penalty associated with software-based approaches. The hardware encryptor processes encryption/decryption operations through dedicated circuits rather than general-purpose processors.
2Reliability
If multiple encryptors are supported to maintain system availability, then reliability improves, but device complexity increases
Solution Approach 1:
The patent designs the hardware encryptor with universal interfaces and standardized protocols that allow multiple encryptors to be managed through a common framework. The encryptor adaptation library provides unified access methods for different encryptor types, enabling the system to support multiple encryptors without proportionally increasing management complexity. This resolves the contradiction by achieving system availability through redundancy while controlling complexity through standardized, multi-functional design patterns.
Data Source
AI summary
A method, apparatus and system for encrypting and decrypting a cloud hard disk encryption, and a computer-readable storage medium. The method comprises: calling a pre-established encrypted disk according to an operation request (S110); sending acquired operation data to a target encryptor via a corresponding operation interface in an encryptor adaptation library, so that the target encryptor performs a corresponding operation on the operation data (S120); and receiving, via the operation interface, an operation result that is returned by the target encryptor to a server (S130).