Virtualized Cryptographic Service TPM Key Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual computing environments lack robust security measures to protect sensitive data from unauthorized access and copying, as they cannot detect differences in underlying hardware and existing protection methods like encryption and access control can be bypassed or impractical for server farms.
Innovation Solution
A virtualized cryptographic service integrated with the hypervisor utilizes a Trusted Platform Module (TPM) to provide hardware-based security, managing encryption keys and protecting them with TPM-specific keys, ensuring secure data protection within the virtual environment without requiring user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to the virtual storage device file, then data security is improved, but user operation complexity increases due to password requirements
Solution Approach 1:
The system performs automatic encryption and decryption operations without requiring user intervention. The virtualization layer automatically manages the encryption/decryption process when the virtual machine starts and stops, eliminating the need for users to manually enter passwords or manage cryptographic keys.
Solution Approach 2:
The virtualization layer acts as an intermediary between the user and the encrypted storage file. It automatically handles the cryptographic operations and key management, shielding users from the complexity of encryption while maintaining security. The virtual machine perceives the encrypted file as a normal storage device through this intermediary layer.
2Ease of operation
If access control methodologies are used to restrict access to the virtual storage device file, then ease of operation is improved, but security is worsened because administrative users can bypass restrictions
Solution Approach 1:
The patent replaces software-based access control mechanisms with hardware-based cryptographic protection. Instead of relying on operating system access control lists and user permissions that can be bypassed by administrative users, the system uses cryptographic encryption at the file level, which provides mathematical security guarantees that cannot be circumvented through standard system access mechanisms.
3Reliability
If encryption is implemented for each virtual machine, then data security is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent merges the key management functionality into the virtualization layer, consolidating what would otherwise be separate key management systems for each virtual machine. The virtualization layer centrally manages all encryption keys and cryptographic operations, simplifying the overall system architecture while maintaining individual security for each virtual machine's storage.
Data Source
AI summary
A Trusted Platform Module (TPM) can be utilized to provide hardware-based protection of cryptographic information utilized within a virtual computing environment. A virtualized cryptographic service can interface with the virtual environment and enumerate a set of keys that encryption mechanisms within the virtual environment can utilize to protect their keys. The keys provided by the virtualized cryptographic service can be further protected by the TPM-specific keys of the TPM on the computing device hosting the virtual environment. Access to the protected data within the virtual environment can, thereby, only be granted if the virtualized cryptographic service's keys have been protected by the TPM-specific keys of the TPM on the computing device that is currently hosting the virtual environment. The virtualized cryptographic service's keys can be protected by TPM-specific keys of TPMs on selected computing devices to enable the virtual environment to be hosted by other computing devices.