Virtualised Data Volume Encryption via Segmented Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data volume encryption techniques are inadequate for virtualized environments as they rely on hardware-based mechanisms that are not applicable due to the abstracted and shared nature of virtualized hardware, and are susceptible to brute force attacks and 'cold boot' vulnerabilities.
Innovation Solution
A multi-part key approach is used for encrypting virtualized data volumes, where one parameter is specific to the data volume and the other is based on the target virtualized computing environment, requiring both parameters and a key derivation system to generate the cryptographic key, enhancing security by making it difficult to access the encrypted data without the correct environment information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based encryption mechanisms are used, then data volume encryption integrity is improved, but the solution becomes inapplicable to virtualized environments where hardware is abstracted and shared
Solution Approach 1:
The cryptographic key is segmented into multiple parts: a first key part generated by the virtual machine and stored in encrypted form in the virtualized data volume, and a second key part generated by the target virtualized computing environment. Both parts are required to decrypt the data, eliminating reliance on a single hardware-based key while maintaining security integrity.
Solution Approach 2:
A key derivation system acts as an intermediary between the virtual machine package and the target virtualized computing environment. This mediator combines the first key part from the virtual machine with the second key part from the target environment to generate the cryptographic key, enabling secure operation without direct hardware dependency.
2Productivity
If cryptographic keys are stored in accessible locations for decryption operations, then decryption performance is improved, but security is worsened due to susceptibility to brute force attacks and cold boot vulnerabilities
Solution Approach 1:
The cryptographic key is divided into two separate parts stored in different locations: the first key part is stored encrypted within the virtualized data volume, while the second key part is generated dynamically by the target virtualized computing environment. This segmentation prevents attackers from accessing the complete key through cold boot attacks or brute force methods, as both parts are required for decryption.
3Productivity
If symmetric keys are used for encryption, then cryptographic performance is improved, but key security is worsened due to potential compromise of the single key
Solution Approach 1:
The symmetric cryptographic key is segmented into two parts that must be combined through a key derivation system. The first key part is generated by the virtual machine and stored encrypted in the data volume, while the second key part is generated by the target environment. This segmentation maintains the performance benefits of symmetric encryption while significantly improving key security, as compromise of one part does not compromise the entire key.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method of securing a virtual data volume storing data in a first virtualised computing environment comprising: deriving a cryptographic key for encrypting the data, the key being derived from first and second parameters; and encrypting the data, wherein the first parameter is generated for association with the virtualised data volume, and the second parameter is generated based on at least one characteristic of a second virtualised computing environment.