Encryption Virtual Machine Offloading VMM Complexity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing encryption and decryption methods in virtualization systems, particularly in cloud computing platforms, face complexity and instability due to the device mapping and encrypting module's need to separately identify and process hundreds of hard disk images, leading to resource conflicts and system instability.
Innovation Solution
A virtualization system with a control module in the VMM that determines whether data needs to be encrypted and forwards it to a dedicated encryption and decryption virtual machine, which performs encryption or decryption processing without occupying VMM resources, allowing for efficient key allocation and access rights control across user virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the device mapping and encrypting module in VMM separately identifies and processes each hard disk image, then encryption security is improved, but system complexity and implementation difficulty increase significantly
Solution Approach 1:
The patent introduces a dedicated encryption virtual machine as an intermediary component between the VMM and hard disk images. This encryption virtual machine specializes in encryption operations, allowing the VMM to offload encryption tasks without directly managing each hard disk image individually. The intermediary handles the complexity of identifying and processing encrypted images, thereby maintaining security while reducing VMM complexity.
Solution Approach 2:
The system separates encryption functionality from the VMM by creating a dedicated encryption virtual machine. This segmentation divides the system into distinct functional components: the VMM manages virtualization resources while the encryption virtual machine handles cryptographic operations. This modular approach reduces the complexity of the device mapping and encrypting module in the VMM.
2Reliability
If the device mapping and encrypting module processes hundreds of hard disk images individually, then encryption coverage is improved, but system stability deteriorates due to resource conflicts
Solution Approach 1:
The encryption virtual machine serves as a mediator that manages encryption operations for multiple hard disk images without causing resource conflicts in the VMM. By offloading encryption tasks to a separate virtual machine, the system maintains stability while achieving comprehensive encryption coverage across hundreds of images.
Solution Approach 2:
The encryption virtual machine provides universal encryption services to multiple hard disk images simultaneously. Rather than requiring separate processing logic in the VMM for each image, the encryption virtual machine handles encryption requests from any number of images, improving both coverage and stability.
3Reliability
If encryption processing is performed within the VMM, then security control is improved, but resource conflicts and system performance deteriorate
Solution Approach 1:
The patent segments security control functions into a separate encryption virtual machine, allowing the VMM to maintain security policies while avoiding the performance penalty of direct encryption processing. The encryption virtual machine handles cryptographic operations independently, preventing resource conflicts that would degrade system performance.
Solution Approach 2:
The encryption virtual machine acts as an intermediary that implements security control without burdening the VMM with encryption processing overhead. This mediator handles the computationally intensive encryption operations, allowing the VMM to maintain security control while preserving system performance.
Data Source
Figure 1~2
Figure 3
Figure 4A
AI summary
Embodiments of the present invention provide an encryption and decryption method and an apparatus in a virtualization system, and a system. The virtualization system includes a virtual machine monitor VMM and an encryption and decryption virtual machine, the VMM includes a control module, the encryption and decryption virtual machine records a first association relationship between a hard disk image identifier and a key, the key includes an encryption key, and the virtualization system records a second association relationship between the hard disk image identifier and a hard disk image attribute. The control module in the VMM is configured to determine whether to-be-written data needs to be encrypted and forward the to-be-written data, which makes it easy to implement a function and reduces system complexity of the VMM. In addition, because a dedicated encryption and decryption virtual machine implements encryption or decryption processing in the embodiments of the present invention without occupying a resource in the VMM, which avoids a resource conflict and improves system stability.