Virtualized Data Center Secret Key Management via Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized data centers, managing secret keys for authentication across multiple host systems is challenging due to security concerns when credentials are copied and stored on each host, leading to potential security breaches during VM migration and access management.
Innovation Solution
Implementing a key management service within the virtualization manager to securely register, transfer, and unregister secret keys using universally unique identifiers (UUIDs) stored in volatile memory, ensuring exclusive access and secure authentication for virtual machines accessing storage domains, while preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If secret keys are copied and stored on each host system for authentication, then authentication access is enabled across multiple hosts, but security risk increases due to potential breaches during VM migration and access management
Solution Approach 1:
The secret key is extracted from the host system's persistent storage and held exclusively in volatile memory during runtime. The key management service isolates the secret key from the host's file system and registry, ensuring it cannot be copied or accessed by unauthorized processes. This extraction resolves the contradiction by enabling authentication while removing the security risk of persistent storage.
Solution Approach 2:
A key management service acts as an intermediary between the host system and the secret key. This service manages the lifecycle of the secret key in volatile memory, controlling access through authenticated requests. The intermediary layer prevents direct access to the secret key while maintaining authentication functionality across multiple hosts.
2Reliability
If secret keys are stored in volatile memory only, then security is improved by preventing unauthorized access, but access management complexity increases during VM migration and host restarts
Solution Approach 1:
The key management service implements self-service mechanisms to automatically manage secret keys during VM migration and host restarts. When a VM migrates or a host restarts, the service automatically retrieves the necessary secret keys from secure storage, validates them, and loads them into volatile memory without manual intervention. This automation reduces access management complexity while maintaining security.
Solution Approach 2:
The system performs preliminary actions by pre-loading secret keys into volatile memory before VM startup or migration events. The key management service anticipates authentication needs and ensures keys are available in secure memory beforehand, simplifying the access management process during dynamic operations.
3Adaptability or versatility
If multiple hosts access the same secret key, then VM migration is enabled, but security risk increases due to potential credential exposure
Solution Approach 1:
The secret key management is segmented into isolated instances in volatile memory on each host system. Each host maintains its own copy of the secret key in secure memory, preventing cross-host credential exposure. This segmentation enables VM migration while maintaining security by ensuring that each host's memory space is isolated and cannot be accessed by other hosts.
Solution Approach 2:
The system changes the state parameter of the secret key from persistent storage to volatile memory residence. By transforming the key's existence state, the system enables multiple hosts to access the key through controlled memory access rather than file system access, preventing credential exposure while supporting VM migration.
Data Source
AI summary
Implementations of the disclosure provide for secret keys management in a virtualized data-center. In one implementation, a system is provided. The system comprises a memory to store secret key data and a processing device coupled to the memory. The processing device is to identify authentication information provided by a user, the authentication information comprising access information associated with a data storage domain, receive a secret key to access the data storage domain in view of the authentication information, wherein the secret key comprises a universally unique identifier (UUID), and register the secret key, wherein to register the secret key, the processing device to store a data structure in volatile memory indicating an association between the UUID of the secret key and the hypervisor.