Virtual Machine Encryption Key Management in Server Clusters

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Server clusters face security risks due to the storage of authentication data like encryption keys in unencrypted regions of persistent storage, allowing unauthorized access if a user with access to the storage gains elevated privileges.

Innovation Solution

A mechanism where a virtual machine is instantiated with access to encrypted persistent storage but without the encryption key, receiving the key from a management server for decryption and operation, ensuring that encryption keys are never stored in unencrypted form.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If encryption keys are stored in unencrypted regions of persistent storage for easy access, then ease of operation is improved, but security is worsened due to unauthorized access risks

Engineering Contradiction:

Improveaccess to encryption keysVSAvoidunauthorized access to authentication data

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The persistent storage is segmented into encrypted and unencrypted regions. Encryption keys are stored only in encrypted regions, while unencrypted regions store only decrypted data when needed. This segmentation allows easy access to decrypted data while protecting the keys themselves.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A virtual machine acts as an intermediary between the unencrypted data and the encrypted key storage. The VM decrypts data in memory and provides access without exposing keys to the unencrypted region, mediating between security requirements and access needs.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption keys are kept encrypted in persistent storage for security, then security is improved, but ease of operation deteriorates due to decryption requirements

Engineering Contradiction:

Improveprotection of authentication dataVSAvoidaccess to encrypted data

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

Data is pre-encrypted and stored in encrypted regions before being needed. When access is required, the virtual machine performs decryption in memory as a preliminary step before providing access to the unencrypted region, ensuring security is maintained while enabling operation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The virtual machine autonomously manages the decryption process by loading encryption keys from encrypted storage, decrypting data in its memory space, and managing the lifecycle of decrypted data without external intervention, balancing security and accessibility.

Inventive Principle:

Principle #25Self-service

3Object-affected harmful factors

If encryption keys are stored in non-persistent storage for security, then security is improved by preventing persistent access, but reliability worsens due to loss of access after restart

Engineering Contradiction:

Improverestricted access to encryption keysVSAvoidaccess to authentication data after restart

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The system dynamically transitions encryption keys between non-persistent storage (for security during operation) and encrypted persistent storage (for reliability across restarts). The virtual machine loads keys from encrypted persistent storage when needed, uses them in non-persistent storage during operation, and eliminates them after use, adapting storage persistence to operational needs.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11611540B2Protection of authentication data of a server cluster

Publication Date: 2023.03.21 VMWARE INC

AI summary

This disclosure describes a process for securely instantiating a virtual machine on a server cluster. The virtual machine just after instantiation has access to persistent storage that includes an encrypted region and lacks access to an encryption key configured to provide access to data stored within the encrypted region. The virtual machine receives a communication from a management server associated with the server cluster that includes the encryption key configured to provide access to the data stored within the encrypted region. After the virtual machine receives the encryption key, the server cluster runs services that depend upon the data stored within the encrypted region to operate after receiving the communication from the management server.