Mirror Driver Online Virtual Disk Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypting virtual disks of virtual machines (VMs) require the VM to be powered off, leading to prolonged downtime, especially for large disks, as ongoing I/O operations can cause errors during the encryption process.
Innovation Solution
Implementing a mirror driver that creates a new encrypted virtual disk while the VM is online, mirroring and encrypting data block by block, allowing the VM to continue operating with minimal downtime by switching to the encrypted disk once the process is complete.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the VM is powered off to encrypt the virtual disk, then the encryption process can proceed without I/O errors, but the VM downtime increases significantly
Solution Approach 1:
The patent creates a mirror copy of the virtual disk before encryption begins, and sets up the mirror driver in advance. This preliminary preparation allows the encryption process to proceed on the mirror copy while the original disk continues to serve I/O requests, enabling the VM to remain online throughout the encryption process and eliminating the need to power off the VM.
Solution Approach 2:
The mirror driver acts as an intermediary component that intercepts I/O requests destined for the virtual disk. It redirects these requests to the mirror copy, allowing the encryption process to operate on the original disk without causing I/O errors, while the VM continues to function normally through the mirror driver's mediation.
2Productivity
If the VM remains online during encryption, then VM availability is maintained, but I/O operations may cause errors in the encryption process
Solution Approach 1:
The patent segments the disk access path by introducing a mirror driver layer that separates I/O requests from the encryption process. This segmentation allows the VM to continue issuing I/O requests while the encryption process operates independently on the mirror copy, eliminating conflicts between concurrent I/O and encryption operations.
Solution Approach 2:
The patent creates a mirror copy of the virtual disk that serves as an intermediate storage target. The mirror driver copies I/O requests to this mirror copy, allowing the encryption process to work on the original disk without interference from ongoing I/O operations, thereby maintaining both VM availability and encryption reliability.
Data Source
AI summary
Provided are techniques for encrypting a virtual disk of a virtual computing instance (VCI) while the VCI is online and still running using a mirror driver. In certain aspects a mirror driver is a filter running in an I/O stack used for accessing a virtual disk, such that the mirror driver receives I/Os destined to the virtual disk and mirrors those I/Os to the virtual disk and one or more additional virtual disks. The mirror driver begins copying data from an unencrypted source virtual disk to a destination virtual disk, and the data is encrypted as it is stored in the destination virtual disk, while the VCI is still online. During the copying, as new writes are issued to the unencrypted source virtual disk from the VCI, the mirror driver mirrors the writes to both the unencrypted source virtual disk and the destination virtual disk.