Whole Disk Encryption in Virtualized Systems

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Whole disk encryption in virtualized computer systems faces challenges as existing methods cannot encrypt the bootstrap or bootloader portion of the disk, leaving it unencrypted and vulnerable to attacks, such as 'bootkit' attacks, due to the need for decryption to boot the system.

Innovation Solution

A software component executing in a first virtual machine invokes a second hypervisor to instantiate a disk image as a second virtual machine, where a software agent encrypts and decrypts data at runtime, and migrates the second virtual machine to provide a wholly encrypted disk image, accessing cryptographic keys from a key management server to ensure secure storage without unencrypted partitions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the bootloader portion of the disk is left unencrypted to enable system booting, then the system can boot and operate, but the disk becomes vulnerable to bootkit attacks and unauthorized access

Engineering Contradiction:

Improvesystem bootabilityVSAvoidvulnerability to bootkit attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system separates the bootloader functionality from the encrypted data storage by using a virtual machine architecture. The bootloader runs in a first virtual machine, while the encrypted disk image is instantiated as a second virtual machine. This segmentation allows the bootloader to remain accessible while the data remains encrypted, resolving the contradiction between bootability and security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A software agent acts as an intermediary between the bootloader and the encrypted disk image. The software agent, installed in the second virtual machine, handles the encryption and decryption operations, allowing the system to boot from an encrypted disk without exposing the cryptographic keys to the bootloader or unencrypted storage.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If encryption software is installed in a dedicated partition or MBR, then the encryption can be applied to selected partitions, but the disk cannot be fully encrypted as the encryption software itself requires unencrypted storage

Engineering Contradiction:

Improveencryption coverageVSAvoidunencrypted vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements nested virtualization where a first virtual machine contains a second virtual machine that hosts the encrypted disk image. The encryption software runs within the nested virtual machine structure, allowing the entire disk image to be encrypted while the virtualization layer provides the necessary unencrypted environment for the encryption software to operate.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The system moves the encryption software from the traditional disk partition dimension to a virtual machine dimension. By instantiating the encrypted disk as a virtual machine rather than a partition, the system achieves full disk encryption while the virtual machine infrastructure provides the execution environment for the encryption software.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Object-affected harmful factors

If the disk is fully encrypted including boot partitions, then security is improved, but the system cannot boot because the bootloader cannot be decrypted

Engineering Contradiction:

Improvesecurity against unauthorized accessVSAvoidsystem bootability

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The system performs preliminary decryption actions through the software agent before the actual boot process. The software agent, running in the second virtual machine, decrypts the necessary portions of the disk image at runtime to enable the bootloader to access and execute the operating system, while maintaining encryption for the rest of the disk.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the traditional mechanical/boot-based decryption system with a software-based solution. Instead of relying on hardware-based boot processes that require unencrypted boot sectors, the system uses software agents running in virtual machines to perform decryption operations, enabling full disk encryption while maintaining bootability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3408780B1Disk encryption

Publication Date: 2020.08.12 BRITISH TELECOM PLC

Figure 1~6
Figure 2a~2c
Figure 3

AI summary

A computer implemented method of providing whole disk encryption for a virtualised computer system comprising: providing a software component executing in a first virtual machine for instantiation in a first hypervisor, the software component invoking a second hypervisor within the first virtual machine for instantiating a disk image of the virtualised computer system as a second virtual machine, and the software component being configured to install a software agent in the second virtual machine, the software agent being adapted to: a) encrypt the instantiated disk image; b) encrypt data written, by the second virtual machine, to the instantiated disk image at a runtime of the second virtual machine; and c) decrypt data read, by the second virtual machine, from the instantiated disk image at a runtime of the second virtual machine, wherein the software component is configured to migrate the second virtual machine at a runtime of the second virtual machine to the first hypervisor so as to provide a wholly encrypted disk image for the second virtual machine executing in the first hypervisor.