Virtual Machine Disk Encryption via Segmented Bootloader
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Whole disk encryption (WDE) in virtualized computer systems faces challenges as the bootstrap or bootloader portion of the disk must remain unencrypted, making it vulnerable to attacks like 'bootkit' infections, as encrypting this portion prevents bootstrapping.
Innovation Solution
A software component executing in a first virtual machine instantiates a second virtual machine and installs a software agent to encrypt and decrypt data within the disk image, allowing for live migration to provide a wholly encrypted disk image, thereby addressing the vulnerability of unencrypted portions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the bootstrap or bootloader portion of the disk is kept unencrypted, then the system can bootstrapping, but the unencrypted portion becomes vulnerable to attacks like bootkit infections
Solution Approach 1:
The system separates the bootloader functionality from the main disk storage by placing the bootloader in a separate virtual machine environment. This segmentation allows the main disk to be fully encrypted while the bootloader resides in an isolated, controlled environment that can verify and decrypt only the necessary portions during bootstrapping.
Solution Approach 2:
A trusted intermediary component (such as a virtual machine monitor or secure boot agent) is introduced to mediate between the encrypted disk and the bootloader. This intermediary holds the decryption keys in a secure manner and selectively decrypts only the boot sector, preventing direct access to the encrypted portion while enabling bootstrapping.
2Object-affected harmful factors
If the entire disk is encrypted including boot partitions, then security is improved, but the system cannot bootstrap since the bootloader will be encrypted
Solution Approach 1:
The system performs preliminary decryption of only the boot sector by a trusted intermediary before the main operating system loads. This preliminary action allows the bootloader to be decrypted and executed temporarily, after which the system transitions to using the encrypted storage system, thus maintaining both security and bootstrapping capability.
Solution Approach 2:
The solution moves the bootloader from the traditional disk-based storage dimension to a separate virtual machine or memory-based dimension. This dimensional change allows the bootloader to exist in an unencrypted environment while the main disk remains fully encrypted, resolving the contradiction between full encryption and bootstrapping.
3Reliability
If a dedicated partition is created for encryption software, then the encryption can be implemented, but storage space is consumed and the partition remains unencrypted creating a vulnerability
Solution Approach 1:
The system uses the existing bootloader partition or a minimal system partition for multiple purposes: storing the bootloader, holding encryption software, and serving as the boot medium. This multi-functionality eliminates the need for separate dedicated partitions, saving storage space while maintaining encryption functionality.
Solution Approach 2:
The encryption software is designed to be self-contained within the bootloader environment, using the same partition for both booting and encryption operations. The system serves itself by using the minimal required space efficiently, without needing additional dedicated partitions, thus avoiding the creation of unencrypted vulnerable areas.
Data Source
AI summary
A computer implemented method of providing whole disk encryption for a virtualized computer system including providing a software component executing in a first virtual machine for instantiation in a first hypervisor, the software component invoking a second hypervisor within the first virtual machine for instantiating a disk image of the virtualized computer system as a second virtual machine, and the software component being configured to install a software agent in the second virtual machine, the software agent being adapted to: a) encrypt the instantiated disk image; b) encrypt data written, by the second virtual machine, to the instantiated disk image at a runtime of the second virtual machine; and c) decrypt data read, by the second virtual machine, from the instantiated disk image at a runtime of the second virtual machine, wherein the software component is configured to migrate the second virtual machine at a runtime of the second virtual machine to the first hypervisor so as to provide a wholly encrypted disk image for the second virtual machine executing in the first hypervisor.