Encrypted Storage Copy-on-Write via Guest Program Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computer systems, hypervisors face challenges in performing copy-on-write operations on encrypted storage blocks without accessing decrypted data, which can compromise security and make encrypted storage inaccessible when copied.
Innovation Solution
A guest program executed by a virtual machine, controlled by the hypervisor, copies data between encrypted storage blocks using different cryptographic inputs, ensuring that the hypervisor remains unaware of the decrypted content, and a lean virtual machine is used to facilitate these operations without exposing the data to the hypervisor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the hypervisor performs copy-on-write operations on encrypted storage blocks by accessing decrypted data, then the copy operation can be completed, but security is compromised and decrypted data is exposed to the hypervisor
Solution Approach 1:
The patent introduces a specialized copy operation mechanism that acts as an intermediary between the hypervisor and encrypted storage blocks. This mechanism enables the hypervisor to perform copy-on-write operations without directly accessing decrypted data, using cryptographic protocols and trusted execution environments to mediate the copying process while maintaining security boundaries.
Solution Approach 2:
The system segments the copy operation into distinct phases: identification of storage blocks requiring copying, initiation of copy through hypervisor, execution of copy by virtual machine using encrypted pathways, and completion notification. This segmentation allows the hypervisor to control the operation without needing to access or decrypt the actual data during the copying process.
2Productivity
If encrypted storage blocks are copied using traditional methods, then data can be moved between storage locations, but the encryption becomes inaccessible or compromised
Solution Approach 1:
The patent implements a specialized copying mechanism for encrypted storage blocks that creates cryptographic copies rather than traditional bit-by-bit copies. The virtual machine performs the copy operation on encrypted data using secure pathways, ensuring that the cryptographic integrity is maintained while enabling data movement between storage locations.
Solution Approach 2:
The system changes the operational parameters of the copy operation by shifting from hypervisor-controlled decryption and copying to virtual machine-controlled encrypted copying. This parameter change includes using different cryptographic keys, encrypted data pathways, and trust boundaries that preserve encryption integrity during data movement.
3Ease of operation
If the hypervisor has access to decrypted storage data for management operations, then storage management is simplified, but security vulnerabilities increase
Solution Approach 1:
The patent introduces encrypted storage block copying and verification mechanisms as intermediaries between the hypervisor and storage data. These intermediaries enable the hypervisor to perform storage management operations such as snapshots, cloning, and migration without directly accessing decrypted data, thereby maintaining security boundaries while preserving management functionality.
Solution Approach 2:
The virtual machine performs self-service by executing copy operations on encrypted storage blocks independently without requiring hypervisor intervention for decryption. The virtual machine uses its own cryptographic context and trusted execution environment to manage encrypted storage operations, reducing the hypervisor's security footprint.
Data Source
AI summary
Technology for enabling a hypervisor to perform copy on write features on encrypted storage of a virtual machine. An example method may involve: receiving, by a guest program from a hypervisor, an indication that identifies a first storage block of a first virtual machine, wherein the first storage block is write protected by the hypervisor; identifying, by the guest program, a second storage block of a second virtual machine; and copying, by the guest program, data of the first storage block to the second storage block, wherein the data of the first storage block and data of the second storage block are encrypted using different cryptographic inputs.