Encrypted VM Memory Deduplication with Checksum Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization environments face challenges in deduplicating memory resources for encrypted virtual machines due to data privacy concerns, as hosts cannot identify duplicated data in private, encrypted guest memories, leading to inefficient resource utilization and security risks.
Innovation Solution
A framework is provided where encrypted virtual machines calculate checksums for data to be transferred to public memory, allowing hosts to deduplicate data while maintaining guest control and security, using checksum verification to ensure data authenticity before use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hosts attempt to deduplicate data in encrypted guest memories, then resource utilization efficiency improves, but data security and guest privacy are compromised
Solution Approach 1:
The system performs preliminary actions by having guests calculate and store checksums of their data before encryption and transfer to public memory. This preliminary checksum calculation enables the host to later verify data integrity and identify duplicates without needing to decrypt or examine the actual encrypted data, thus resolving the contradiction between security and deduplication efficiency
Solution Approach 2:
The invention introduces checksums as an intermediary mechanism that mediates between the host's need to identify duplicates and the guest's need to maintain data security. The checksums serve as proxies that allow the host to perform deduplication operations on encrypted data without compromising guest privacy or data security
2Loss of energy
If guests transfer data to public memory for deduplication, then computing resources are conserved, but control and security over data are reduced
Solution Approach 1:
The system implements feedback mechanisms where guests verify received data from public memory by comparing checksums. This feedback loop ensures that guests maintain control over their data even after transferring it to public memory, as they can detect and reject unauthorized or corrupted data, thus resolving the contradiction between resource conservation and guest control
Solution Approach 2:
Guests perform preliminary verification by comparing checksums of received data against their original checksums before using the data from public memory. This preliminary verification action ensures data integrity and maintains guest control while still allowing the benefits of deduplication to be realized
3Reliability
If checksum verification is implemented for all pages, then data authenticity is ensured, but operational overhead increases
Solution Approach 1:
The system applies checksum verification selectively rather than universally - verification is performed primarily at the transfer boundary when data moves from private to public memory and when retrieved. This partial verification approach ensures data authenticity for critical operations while minimizing operational overhead by avoiding redundant verification of already-verified data
Data Source
AI summary
Memory deduplication for encrypted virtual machines is provided by identifying a page in a private memory of an encrypted virtual machine to place into a public memory in a virtualization environment; calculating a checksum for the page and storing the checksum in the private memory of the encrypted virtual machine; passing the page to a hypervisor of the virtualization environment to place into the public memory; calling the page via an application running in the encrypted virtual machine; and in response to verifying the page received from the public memory against the checksum stored in the private memory, proceeding with operation of the application using the page.