Virtual Disk Encryption via Hypervisor Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems cannot independently encrypt and unlock virtual disks associated with a persistent storage device, requiring the unlocking of all virtual disks if one is unlocked, which can lead to security and management inefficiencies.
Innovation Solution
A system that uses a hypervisor to maintain a map of virtual machines to virtual disks, allowing each virtual disk to be encrypted and unlocked independently by using a key management server to generate and manage encryption keys specific to each virtual disk's address range, enabling parallel encryption and decryption across slices of a persistent storage device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all virtual disks on a persistent storage device are locked together, then security is simplified, but independence of encryption and unlocking is lost
Solution Approach 1:
The persistent storage device is divided into multiple virtual disks, each with its own encryption key and address range. The encryption system is segmented so that each virtual disk can be independently encrypted and unlocked without affecting others, while still maintaining overall security through the locked state mechanism
Solution Approach 2:
Each virtual disk is assigned unique local properties including its own encryption key, address range, and lock status. This allows different regions (virtual disks) of the storage device to have different security states, enabling selective encryption and unlocking of specific virtual disks while maintaining security simplification where applicable
2Ease of operation
If encryption keys are managed centrally for all virtual disks, then key management is simplified, but selective access control is reduced
Solution Approach 1:
The key management system is segmented to maintain separate encryption keys for each virtual disk. The key manager can operate centrally to simplify management operations, while the segmented key structure enables selective access control by allowing individual keys to be unlocked independently
Solution Approach 2:
Each virtual disk has its own local encryption key with unique properties. This local quality enables selective access control where specific virtual disks can be unlocked without others, while the central key manager provides simplified operations through unified management interfaces
3Ease of manufacture
If the entire persistent storage device is encrypted as one unit, then encryption process is simplified, but flexibility in accessing individual virtual disks is lost
Solution Approach 1:
The encryption process is segmented to operate at the virtual disk level rather than the entire storage device level. Each virtual disk within an address range can be independently encrypted and decrypted, providing both process simplicity through standardized operations and flexibility through selective application to different virtual disks
Solution Approach 2:
Encryption is applied with local quality to specific virtual disks based on their address ranges. This allows the encryption process to be simplified through consistent methodology while achieving flexibility by selectively applying encryption to individual virtual disks or groups of virtual disks as needed
Data Source
AI summary
A system includes a virtual machine to transmit an input/output request to a data storage system and a hypervisor configured to maintain a map of the virtual machine to a virtual disk, wherein the virtual disk is a slice of a persistent storage device. A virtual machine server is configured to maintain a map of the virtual disk to a start address and an end address and to update the input/output request with the start address, the end address, and a virtual disk identifier associated with the virtual machine. A processor determines whether the start address and the end address are valid, and if the start address and the end address are valid, then process the input/output request. The response is transmitted to the input/output request.