Hypervisor Secure VM Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized environments, the security of access to memory allocated to virtual machines (VMs) is compromised due to the ease of creating VMs without adequate consideration for disk space, leading to potential security threats from storing sensitive information on disk.
Innovation Solution
Implementing encrypted memory locations managed by a hypervisor, where access is secured by allocating and decrypting memory spaces specifically for authorized applications, using a single hypervisor for encryption and decryption, and preventing unauthorized access through operating system controls and APIs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VMs store sensitive information in main memory during execution, then operational performance is improved, but security is compromised when memory is stored on disk
Solution Approach 1:
The patent segments memory access into two types: normal unencrypted memory access for operational performance and encrypted memory access for security-critical data. The hypervisor creates separate encrypted memory regions that are only accessible to authorized applications, allowing the system to maintain both performance and security by using the appropriate memory type for different workloads.
Solution Approach 2:
The hypervisor acts as an intermediary between the VM and the disk storage. It intercepts memory write operations, encrypts sensitive data before storing it on disk, and decrypts it during read operations. This intermediary layer ensures that sensitive information is never stored in plaintext on disk while maintaining operational performance through efficient encryption/decryption mechanisms.
2Adaptability or versatility
If hypervisor provides snapshot and clone capabilities, then versatility is improved, but security of stored memory is compromised
Solution Approach 1:
The system performs preliminary encryption of memory data before creating snapshots or clones. The hypervisor encrypts sensitive information in advance and stores only the encrypted versions in snapshot files. When restoring from snapshots, the data is automatically decrypted. This preliminary action ensures that even if snapshot files are accessed unauthorizedly, the sensitive information remains protected.
3Ease of operation
If disk space is allocated without careful consideration, then ease of operation is improved, but security of memory access is compromised
Solution Approach 1:
The hypervisor provides self-service security features that automatically encrypt memory data without requiring manual configuration from administrators. When a VM is created or restarted, the hypervisor automatically identifies sensitive memory regions, encrypts them using keys stored in secure locations, and manages the encryption lifecycle. This self-service approach maintains ease of operation while implementing robust security.
Data Source
AI summary
Apparatus, systems, and methods may operate to restore an operational state of an associated virtual machine (VM) using encrypted information stored in encrypted memory locations. A single hypervisor may be used to encrypt and decrypt the information. Access may be permitted to a designated number of the encrypted memory locations only to a single application executed by the associated VM subject to the hypervisor. Access may be denied to any other application executed by the associated VM, or any other VM.