In-Place Partition Encryption Using Encrypted Loopback Copy Space
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods for computer system partitions, particularly root/OS and user data partitions, are laborious, error-prone, and inefficient, requiring manual backup, restore, and system shutdown, and are not suitable for multi-user environments, especially when using filesystems like XFS.
Innovation Solution
An in-place encryption system that automatically identifies a suitable partition with enough free space to hold copy data, creates a loopback block device, encrypts it with a temporary key, copies data to an encrypted loopback filesystem, and then encrypts the target partition, all without manual intervention and filesystem shrinking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional manual backup and restore method is used to encrypt root partition, then encryption can be achieved, but the process is laborious, error-prone, and requires system shutdown
Solution Approach 1:
The system performs preliminary actions by automatically creating a loopback block device and copying partition data before encryption begins, eliminating the need for manual backup and restore operations. This preliminary setup ensures the partition can be encrypted while maintaining data accessibility.
Solution Approach 2:
The patent introduces a loopback block device as an intermediary layer between the physical partition and the filesystem. This intermediary allows encryption to occur at the block device level while the filesystem remains unaware, enabling automated encryption without requiring system shutdown or manual intervention.
2Extent of automation
If partition is shrunk to create space for encryption header, then in-place encryption becomes possible, but filesystem compatibility is limited
Solution Approach 1:
Instead of modifying the filesystem structure (shrinking partitions), the patent introduces encryption in a different dimension by creating a loopback block device layer. This approach works with any filesystem type including XFS, ext4, and others, as it operates at the block device level rather than requiring filesystem-specific modifications.
3Reliability
If Bitlocker encryption is performed on existing partition, then encryption can be achieved, but encryption takes hours or days and data remains vulnerable during process
Solution Approach 1:
The system performs preliminary data copying to a loopback block device before encryption begins. This allows the actual encryption process to work on a copy of the data while the original partition remains accessible and unchanged, significantly reducing encryption time and eliminating the security vulnerability window where plaintext data exists during encryption.
4Reliability
If manual backup and restore process is used, then encryption can be achieved, but significant time is required for the process
Solution Approach 1:
The loopback block device serves as an intermediary that enables automated encryption without manual backup and restore operations. The system automatically copies data to this intermediary layer, performs encryption, and restores data, completing the entire process in minutes rather than hours or days while ensuring encryption completeness.
5Extent of automation
If LuksIPC is used to encrypt partition in-place, then automated encryption is possible, but filesystem must be shrunk and system is slow
Solution Approach 1:
Instead of shrinking the filesystem as LuksIPC requires, the patent uses a loopback block device as an intermediary layer. This approach maintains the original filesystem structure and size, enabling automated in-place encryption while achieving much higher speeds (encrypting 1GB+ partitions in minutes) compared to LuksIPC.
Data Source
AI summary
Techniques are taught for encrypting one or more target partitions effectively “in-place”. This effectively in-place encryption is extremely desirable when a root/OS partition (such as /, /usr, /bin, etc.) needs to be encrypted without having to manually back up its contents to another location where they may be exposed in plaintext form, encrypting a new partition, and restoring the contents back to it. The techniques of the present disclosure are also applicable for encrypting effectively in-place user data partitions. To accomplish its objectives, the technology provides an install sequence/process and a modified boot sequence to automatically encrypt partitions effectively in-place. In various embodiments, the selection of copy partitions where copy data is temporarily stored in encrypted form, is performed manually or automatically. In other embodiments, a logical volume manager (LVM) is employed that greatly facilitates provisioning of free space in the system where copy data will be temporarily and securely held/stored.