Virtual Machine Disk Encryption via Hypervisor Replication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Whole disk encryption (WDE) in virtualized computer systems faces challenges as the bootstrap or bootloader portion of the disk must remain unencrypted, creating a vulnerability to attacks like 'bootkit' infections, as encrypting it prevents bootstrapping.
Innovation Solution
A method involving a hypervisor with a shared data store, where a software component instantiates a first virtual machine, replicates its disk, and installs an encryption agent to encrypt the duplicate disk, allowing for secure boot from an encrypted state without unencrypted portions, using privileged credentials and cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the bootloader portion of the disk is kept unencrypted, then the system can boot successfully, but security is compromised due to vulnerability to bootkit attacks
Solution Approach 1:
The encryption software is installed in a separate location (network storage or removable media) before the boot process begins. This preliminary arrangement allows the system to boot from encrypted storage without requiring an unencrypted bootloader section, as the encryption/decryption functionality is already in place from external sources.
Solution Approach 2:
An intermediary decryption process is introduced between the encrypted bootloader and the CPU. The intermediary component (encryption software from external storage) decrypts the bootloader in memory during boot, allowing the encrypted disk to be fully secured while maintaining boot functionality through this intermediate decryption step.
2Object-affected harmful factors
If the entire disk including bootloader is encrypted, then security is improved, but the system cannot bootstrap since the bootloader will be encrypted
Solution Approach 1:
The encryption software is extracted from the disk being encrypted and placed in an external location (network storage or removable media). This separation allows the disk to be fully encrypted while the encryption functionality resides outside the encrypted volume, resolving the contradiction between full encryption and boot capability.
Solution Approach 2:
The encryption/decryption software is prepared and positioned in external storage before the boot process. This preliminary setup enables the system to decrypt the bootloader during boot without requiring the encryption software to be stored on the encrypted disk itself.
3Reliability
If a separate partition is created for encryption software, then the disk can boot, but storage space is consumed and the unencrypted partition remains a security vulnerability
Solution Approach 1:
The encryption software is extracted from the local disk entirely and relocated to external storage media (network storage or removable drives). This eliminates the need for a separate unencrypted partition on the local disk, preserving both storage space and security by removing the vulnerable unencrypted section.
4Ease of operation
If encryption software is installed in MBR, then boot is enabled, but the MBR remains unencrypted creating a security weakness
Solution Approach 1:
The encryption software is extracted from the MBR and relocated to external storage. This allows the MBR to be fully encrypted while the system still boots by loading the encryption software from the external location, thereby eliminating the security weakness of an unencrypted MBR while maintaining boot functionality.
Data Source
Figure 1~6
Figure 2a~2c
Figure 3
AI summary
A computer implemented method of providing whole disk encryption for a virtualised computer system comprising: providing a hypervisor having a data store and instantiating a disk image of the virtualised computer system as a first virtual machine (VM) having a virtual disk from which an operating system of the first VM can be booted; instantiating a second VM in the hypervisor including a software component executing therein, wherein the data store is a shared data store accessible by both the first and second VMs, the method further comprising: the software component accessing the first VM using privileged credentials to install a software agent in the first VM and to replicate the virtual disk of the first VM in the hypervisor data store as a duplicate disk, wherein the software agent is adapted to encrypt data written to, and decrypt data read from, the disk of the first VM at a runtime of the first VM; and the software component encrypting the duplicate disk and unmounting the copied disk and mounting the encrypted duplicate disk in the first VM so as to provide an encrypted disk for the first VM.