Encrypted VM Migration via Active Page Copying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encrypted virtualization systems lack support for live migration of virtual machines, resulting in degraded performance and increased downtime due to the inability to access memory pages during the migration process.
Innovation Solution
The implementation of active page copying, where the hypervisor creates two copies of a VM memory page, allowing the source VM to access one copy while the other is sent to the destination host, ensuring continuous VM availability during migration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encrypted virtualization is used for VM migration, then security is maintained, but downtime increases and performance degrades due to inability to access memory pages during migration
Solution Approach 1:
The patent creates a copy of the encrypted memory page and sends it to the destination host before the source page is deallocated. This copying approach allows the destination host to have the encrypted page ready, enabling seamless migration without requiring decryption/ re-encryption operations that would cause downtime.
Solution Approach 2:
The patent performs preliminary actions by copying the encrypted memory page to the destination host before the actual migration occurs. This advance preparation ensures that when migration is needed, the page is already available at the destination, eliminating wait time and maintaining continuous VM operation.
2Reliability
If memory pages are encrypted during migration, then security is maintained, but access to pages is blocked resulting in performance degradation
Solution Approach 1:
Instead of modifying or decrypting the encrypted memory page during migration, the patent copies the page in its encrypted state to the destination host. This approach maintains security while allowing the VM to continue accessing the original page, avoiding performance degradation from decryption operations.
3Device complexity
If conventional migration processes are used, then simplicity is maintained, but migration efficiency is reduced due to decryption and re-encryption operations
Solution Approach 1:
The patent simplifies the migration process by copying encrypted pages directly without requiring complex decryption and re-encryption operations. This approach maintains process simplicity while dramatically improving migration efficiency by eliminating cryptographic overhead during the migration window.
Data Source
AI summary
Systems and methods for efficient migration for encrypted virtual machines (VMs) by active page copying are disclosed. An example method may include receiving a request to migrate a VM, identifying a first page of memory of the VM on the source host machine for migration, the first page of memory encrypted with a VM-specific encryption key, protecting the first page from access by the VM, executing a send command to modify the first page from encrypted with the guest-specific encryption key to encrypted with a migration key while the first page remains in place in the memory, allocating a second page in a buffer, copying contents of the first page to the second page, executing a receive command to modify the first page from encrypted with the migration key to encrypted with the guest-specific encryption key while the first page remains in place in the memory, and transmitting contents of the second page.