Hypervisor Storage Allocation with Encrypted Block Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hypervisor storage allocation methods involve time-consuming wiping of storage content, which compromises security and performance by potentially revealing encryption keys of one virtual machine to another, and introduces a risk of data leaks.
Innovation Solution
A hypervisor that tracks encryption status of storage blocks using flags or identifiers, allowing it to allocate encrypted storage blocks without clearing their content, thereby maintaining security and reducing processing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hypervisor wipes the storage content before allocating to a new virtual machine, then security is improved by preventing data leakage, but processing time increases due to the time-consuming clearing operation
Solution Approach 1:
The patent changes the state parameter of storage blocks by introducing encryption status flags. Instead of physically clearing storage content, the system marks storage blocks as encrypted, which fundamentally alters how they are handled during allocation. This parameter change allows the system to skip the time-consuming wiping operation while maintaining security through encryption status tracking.
Solution Approach 2:
The patent performs preliminary encryption of storage blocks before they are allocated to virtual machines. By encrypting the content in advance and setting encryption status flags, the system eliminates the need for post-use clearing operations. This preliminary action ensures security is maintained while avoiding the time penalty of clearing storage before reallocation.
2Productivity
If the hypervisor skips wiping storage content to reduce processing time, then productivity is improved, but security deteriorates by risking data leakage between virtual machines
Solution Approach 1:
The system introduces encryption status as a new parameter that fundamentally changes the security model. Instead of relying on physical clearing, the patent uses encryption flags to mark storage blocks, allowing rapid allocation while maintaining security through the encryption parameter rather than through time-consuming wiping operations.
Solution Approach 2:
The patent replaces the mechanical clearing operation with a logical flagging system. Instead of physically overwriting storage content with zeros or random data, the system uses software-based encryption status flags to track and protect data. This substitution eliminates the time-consuming mechanical clearing process while maintaining security through the flagging mechanism.
3Reliability
If the hypervisor clears storage content, then security against data leakage is improved, but device complexity increases due to additional processing steps
Solution Approach 1:
The patent extracts the security function from the storage clearing process. Instead of embedding security within the mechanical clearing operation, the system separates security into a distinct encryption status tracking mechanism. This extraction allows the clearing operation to be eliminated entirely while security is maintained through the separate flagging system, reducing overall processing complexity.
Solution Approach 2:
The encryption status flag acts as an intermediary between the storage content and the virtual machine allocation process. Rather than directly clearing storage content to ensure security, the patent uses the flag as a mediator that controls allocation decisions. This intermediary simplifies the system by replacing complex clearing operations with simple flag checks during allocation.
4Reliability
If the hypervisor implements encryption status tracking, then security is improved by preventing key leakage, but device complexity increases due to additional tracking mechanisms
Solution Approach 1:
The patent segments the storage management system by introducing separate encryption status flags for each storage block. This segmentation allows the system to track encryption status independently of the storage content itself, enabling efficient security management without requiring complex integrated solutions. The segmentation into discrete flagged units simplifies tracking while maintaining comprehensive security.
Data Source
AI summary
Systems and methods for fast storage allocation for encrypted storage are disclosed. An example method may include receiving, by a processing device executing an operating system, an identification of a first storage block that has been released by a first virtual machine; tracking, by the operating system, an encryption status corresponding to the first storage block to indicate whether the first storage block contains encrypted content; receiving a request to allocate storage to a second virtual machine; analyzing, by the operating system, the first storage block to determine that the first storage block contains encrypted content in view of the encryption status corresponding the first storage block; and allocating the first storage block containing the encrypted content to the second virtual machine without clearing the encrypted content of the first storage block.