Privacy-Aware Virtual Machine Checkpointing for Confidential Data Exclusion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machine (VM) checkpointing technologies fail to effectively minimize the lifetime of sensitive information, as they often persist in checkpoints, exposing confidential data to unauthorized access and leakage, despite efforts to clear memory and encrypt data.
Innovation Solution
The implementation of two approaches: an application-transparent method that excludes memory pages containing confidential data from checkpoints without modifying applications and an application-visible method that allows programmers to manage the visibility of confidential data during checkpointing and restoration using a privacy-aware checkpointing API.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VM checkpointing is performed to save VM state, then VM recovery and distribution capabilities are improved, but sensitive information lifetime is prolonged and security is worsened
Solution Approach 1:
The patent extracts sensitive information from the checkpointing process by identifying and excluding specific memory pages containing confidential data from being saved in checkpoint files. This is achieved through tracking which memory pages contain sensitive information and preventing their inclusion in the checkpoint, thus maintaining VM recovery capability while eliminating the security vulnerability of prolonged sensitive information lifetime.
Solution Approach 2:
The patent applies local quality by treating different memory pages differently during checkpointing. Instead of uniformly checkpointing all memory, the system identifies pages containing sensitive information and applies a different quality (exclusion from checkpoint) to those specific pages while allowing non-sensitive pages to be checkpointed normally. This selective approach resolves the contradiction by protecting only the vulnerable portions.
2Object-affected harmful factors
If memory is cleared to remove sensitive information, then security is improved, but VM functionality and data accessibility are worsened
Solution Approach 1:
The patent applies preliminary action by proactively identifying and marking memory pages containing sensitive information before the checkpointing process begins. This allows the system to prevent these pages from being checkpointed without needing to clear them from memory, thus maintaining both security (sensitive information doesn't persist in checkpoints) and productivity (memory is not cleared and VM execution continues normally).
3Object-affected harmful factors
If encryption is applied to protect checkpoint data, then security is improved, but system complexity and performance overhead are worsened
Solution Approach 1:
Instead of applying encryption to all checkpoint data, the patent extracts and excludes only the sensitive portions (specific memory pages) from the checkpointing process entirely. This avoids the complexity of implementing encryption mechanisms while achieving the same security goal of protecting confidential information. The system complexity remains low because it uses existing memory tracking and management capabilities rather than adding cryptographic layers.
4Object-affected harmful factors
If selective memory exclusion is implemented, then sensitive information protection is improved, but checkpointing overhead is worsened
Solution Approach 1:
The patent performs preliminary identification and tracking of sensitive memory pages before checkpointing occurs. By maintaining continuous tracking of which pages contain sensitive information, the system avoids the time cost of analyzing memory contents during the checkpointing process itself. The overhead is minimized because the exclusion decisions are already made based on pre-established tracking information rather than requiring real-time analysis during checkpoint creation.
Data Source
AI summary
A checkpointing method for creating a file representing a restorable state of a virtual machine in a computing system, comprising identifying processes executing within the virtual machine that may store confidential data, and marking memory pages and files that potentially contain data stored by the identified processes; or providing an application programming interface for marking memory regions and files within the virtual machine that contain confidential data stored by processes; and creating a checkpoint file, by capturing memory pages and files representing a current state of the computing system, which excludes information from all of the marked memory pages and files.