Full-Path VM Encryption with Host-Side Compression and Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization environments face security and performance issues due to the inefficiencies of conventional encryption methods, which hinder network/storage data optimizations and increase computational overhead.
Innovation Solution
Implementing a two-key encryption scheme using IPsec protocols, where user VMs send a key encryption key (KEK) to a controller VM for authentication and data encryption/decryption, allowing the controller VM to perform optimizations like compression and deduplication on decrypted data before encrypting it for storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption driver is installed on virtualized computers to encrypt all communications, then network security is improved, but network/storage data optimizations are hampered and computational overhead increases
Solution Approach 1:
The encryption system is segmented into two key layers: a key encryption key (KEK) for authentication and key management, and a data encryption key (DEK) for actual data encryption. This segmentation allows the VM to handle only authentication while the host manages data encryption, reducing VM computational overhead and improving performance while maintaining security.
Solution Approach 2:
The host system acts as an intermediary that receives plaintext data from the VM, performs encryption using the DEK, and manages key operations. This intermediary approach offloads the computationally intensive encryption tasks from the VM to the host, improving VM performance while maintaining strong encryption security.
2Reliability
If encryption driver is installed on virtualized computers to encrypt all communications, then network security is improved, but compression algorithms yield low-compression results since encrypted data is not readily compressible
Solution Approach 1:
The encryption process is performed as a preliminary action on the host before data is transmitted or stored. By encrypting data at the host level using the DEK before it leaves the host system, the invention ensures security while allowing the VM to receive already-encrypted data that doesn't require further compression, as encryption is applied to the final data form.
Solution Approach 2:
The invention changes the encryption parameter from VM-level application encryption to host-level data encryption. This parameter change allows encryption to be applied to data in its final form rather than requiring compression of encrypted data, thereby maintaining both security and storage efficiency.
3Reliability
If encryption driver is installed in every virtualized computer, then network security is improved, but computational overhead for VMs increases resulting in low system performance
Solution Approach 1:
The host system serves as an intermediary that handles all computationally intensive encryption operations using the DEK, while the VM only participates in authentication using the KEK. This intermediary architecture dramatically reduces the computational overhead on VMs, improving their performance while maintaining strong encryption security through host-managed data encryption.
Solution Approach 2:
The encryption computational load is segmented between two key operations: KEK-based authentication handled by the VM and DEK-based data encryption handled by the host. This segmentation of encryption responsibilities reduces the computational burden on VMs to only authentication tasks, significantly improving their performance while the host handles the heavier data encryption workload.
Data Source
AI summary
An approach for full-path data encryption, where user virtualized computers (e.g., user VMs) are configured to communicate with other virtualized computers or VMs using IPsec protocol encryption standards. The user VMs may send a first encryption or authorization key to the other VMs, which the other VMs may use to authenticate the user VMs and encrypt and decrypt data stored to storage devices using a second encryption key. In some approaches, the other VMs may interpret or decrypt the data sent via IPsec and then perform data optimizations (e.g., compression, deduplication) on the data before decrypting/encrypting with the second key.