Hypervisor-Level Data Masking for Virtual Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual storage systems lack effective mechanisms to protect data from unauthorized access, particularly from malware that can bypass encryption and ownership schemes by operating at kernel or root privilege levels.
Innovation Solution
Implementing a system and method to selectively mask data on virtual storage devices by intercepting unauthorized access attempts from outside virtual machines, determining authorization, and masking data through reporting errors or providing modified data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption and ownership schemes are implemented, then data protection is improved, but malware can still circumvent these protections by accessing data at kernel or root privilege levels
Solution Approach 1:
The patent introduces a hypervisor-level intermediary layer between the virtual machine and the storage device. This intermediary intercepts read requests before they reach the storage device, allowing the system to enforce access control policies at a higher privilege level that malware cannot circumvent. The intermediary acts as a mediator that validates authorization before data is accessed.
Solution Approach 2:
The patent moves data protection from the traditional file system level to the storage device level through virtualization. By implementing masking at the virtual storage device level rather than at the file system level, the system adds an additional dimension of protection that operates independently of traditional encryption and ownership schemes, making it harder for malware to bypass.
2Adaptability or versatility
If virtual storage systems are used, then storage flexibility and virtualization benefits are improved, but data protection mechanisms are weakened compared to physical storage systems
Solution Approach 1:
The patent makes the virtual storage device universally protectable by implementing a generic masking mechanism that can apply to any data on any virtual storage device. The system provides both the flexibility of virtual storage and the protection of physical storage by implementing a universal access control layer that works across all virtualized storage scenarios.
Solution Approach 2:
The patent segments the storage access path into distinct components: the virtual machine, the hypervisor intermediary, and the physical storage device. This segmentation allows the system to maintain the flexibility of virtual storage while inserting protection mechanisms at specific points in the access path, particularly at the hypervisor level where unauthorized access can be blocked.
3Ease of operation
If access control is enforced at the virtual machine level, then ease of operation is maintained, but security is weakened because malware can bypass these controls
Solution Approach 1:
The patent adds another dimension to access control by implementing it at the hypervisor level rather than solely at the virtual machine level. This higher-level access control operates independently of the virtual machine's operating system, providing security that cannot be bypassed by malware running within the virtual machine while maintaining ease of operation through automated privilege-based authorization.
Data Source
AI summary
A computer-implemented method for selectively masking data on virtual storage devices may include (1) identifying data stored on a virtual storage device that can be accessed by a virtual machine, (2) intercepting, from a process executing outside the virtual machine, an attempt by a process of the virtual machine to read the data, (3) determining that the virtual machine process is not authorized to read the data, and (4) in response to determining that the virtual machine process is not authorized to read the data, masking the data from the virtual machine process. Various other methods, systems, and computer-readable media are also disclosed.