Virtual Hard Disk Sector Encryption via Host Plug-ins
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data encryption methods in virtual machine environments are inadequate for providing sector-level security, as they often rely on file-based encryption, leaving files vulnerable despite encrypted content, and require direct integration into the virtual machine or virtual machine monitor, which is not feasible in all scenarios.
Innovation Solution
Implementing sector-level encryption using plug-ins within a virtual machine environment, where encryption functionality resides in the host operating system and applications, interacting with virtual hard drives through a VM Encryption API, thereby providing encryption services transparently to the virtual machine without requiring direct integration into the VM or VMM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file-based encryption is used in virtual machine environments, then data can be encrypted, but the files remain vulnerable because specific information about the files is still unencrypted including file names, header information, metadata, and file characteristics
Solution Approach 1:
The encryption is applied at the sector level rather than file level, dividing the storage into smaller security units. Each sector is encrypted independently, providing granular security control and preventing vulnerability of file metadata while maintaining file-based encryption capabilities.
Solution Approach 2:
The encryption approach transitions from a single file-level dimension to multiple dimensions by operating at the sector level beneath the file system layer. This allows simultaneous encryption of file contents and protection of file metadata through different encryption mechanisms operating at different abstraction levels.
2Reliability
If encryption is integrated directly into the virtual machine or virtual machine monitor, then sector-level encryption can be achieved, but this integration is not feasible in all scenarios
Solution Approach 1:
An encryption driver is introduced as an intermediary component between the file system and the storage device. This driver layer provides sector-level encryption functionality without requiring direct integration into the virtual machine or virtual machine monitor, making the solution feasible across different virtualization scenarios while maintaining high security standards.
Solution Approach 2:
The encryption driver is designed to work with multiple virtual machine configurations and storage architectures without requiring modifications to the virtual machine or virtual machine monitor. This universal approach allows sector-level encryption to be deployed in diverse scenarios including different virtualization platforms and storage configurations.
3Reliability
If sector-level encryption is implemented through a driver layer, then data security is enhanced without modifying the virtual machine, but the system complexity increases
Solution Approach 1:
The encryption driver operates autonomously within the host operating system, managing its own encryption keys, cipher selection, and sector encryption/decryption operations without requiring modifications to the virtual machine or virtual machine monitor. This self-contained approach enhances security while limiting the propagation of complexity to other system components.
Data Source
AI summary
Several embodiments of the present invention provide a means for improving data access security in computer systems to support high-security applications, and certain of these embodiments are specifically directed to providing sector-level encryption of a virtual hard disk in a virtual machine environment. More specifically, certain embodiments are directed to providing sector-level encryption by using plug-ins in a virtual machine environment, thereby providing improved data access security in a computer system that supports high-security applications. Certain embodiments also use encryption plug-ins associated with standard encryption software for exchanging data between a virtual machine (VM) and its associated virtual hard drive(s) (VHDs). Moreover, several embodiments of the present invention are directed to the use of plug-in encryption services that interface with, and provide services for, a VM via a VM Encryption API (or its equivalent).