Per-VM Key Management for Encrypted Storage Data Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in providing end-to-end encryption for virtual storage volumes while allowing data services like compression and deduplication, as they lack access to encryption keys and struggle with managing multiple encryption keys across virtual machines.
Innovation Solution
Implementing per-VM key management within a storage environment, where a key management server provides unique keys to each virtual machine, enabling the storage system to process IO operations securely and perform data services like compression and deduplication by decrypting encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional VM-level encryption is used, then data security is improved, but the storage system cannot access encryption keys to perform data services like compression and deduplication
Solution Approach 1:
The encryption key management is segmented into per-VM keys stored in the storage system, allowing the storage system to decrypt data for data services while maintaining encryption for security. Each virtual machine has its own encryption key that the storage system can access to perform compression and deduplication on decrypted data.
Solution Approach 2:
The storage system acts as an intermediary that receives encrypted data, decrypts it using per-VM keys to perform data services like compression and deduplication, then re-encrypts the processed data. This intermediary role enables both security and data service functionality.
2Reliability
If multiple encryption keys are managed across virtual machines, then data security is improved, but key management complexity increases
Solution Approach 1:
Multiple per-VM encryption keys are merged into a unified key management structure within the storage system. The storage system maintains a key management database that consolidates all per-VM keys, allowing centralized management and retrieval without requiring separate key management systems for each virtual machine.
Solution Approach 2:
The storage system's key management mechanism is designed to be universal, handling multiple per-VM encryption keys through a single integrated system. The same key management infrastructure supports all virtual machines, providing multi-functionality that reduces overall complexity compared to individual key management systems.
3Productivity
If the storage system decrypts encrypted data to perform data services, then data service performance is improved, but security exposure increases
Solution Approach 1:
Data is decrypted in advance only when needed for data services like compression and deduplication, then immediately re-encrypted after processing. This preliminary decryption action is time-bound and purpose-specific, minimizing the window of security exposure while enabling necessary data services.
Solution Approach 2:
The encryption and decryption process is continuous and automated throughout the data service workflow. Data remains encrypted during storage and transmission, is temporarily decrypted only for processing operations, and is continuously re-encrypted after processing, ensuring security is maintained throughout the entire data lifecycle without manual intervention.
Data Source
AI summary
An apparatus in an illustrative embodiment comprises at least one processing device comprising a processor and a memory, with the processor coupled to the memory. The at least one processing device is configured to receive in a storage system, from a host device, information that identifies (i) a particular virtual machine implemented by the host device and (ii) a key specific to the virtual machine, to utilize at least a portion of the received information to obtain in the storage system the key specific to the virtual machine from a key management server external to the storage system, to store the obtained key in the storage system in association with one or more parts of the received information, and to utilize the obtained key to process input-output operations that are received in the storage system from the host device and that are identified as being associated with the virtual machine.