Virtual Machine Device Key Driven Obfuscation Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing faces challenges in ensuring the confidentiality and privacy of data and applications due to observability by external adversaries and malicious insiders, particularly in sensitive domains like healthcare, where data and algorithm security are critical.
Innovation Solution
A virtual machine device and method that encrypts instructions and data, using code and input/output encodings to obscure the semantics of operations, ensuring that only specific virtual machines and applications can decrypt and process the data, thereby protecting intellectual property and maintaining confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data and applications are stored and executed in cloud infrastructure, then resource utilization and scalability are improved, but confidentiality and privacy of data and algorithms are compromised due to observability by external adversaries and malicious insiders
Solution Approach 1:
The patent introduces an intermediary encryption layer between the cloud infrastructure and the data/algorithms. By encrypting data and instructions before cloud storage and execution, and using a virtual machine with encrypted instruction sets, the system mediates the interaction between cloud resources and sensitive information, preventing direct observability while maintaining resource utilization benefits
Solution Approach 2:
The patent transforms data and instructions into encrypted forms with different parameters (encrypted data, encrypted instructions, permuted dispatch tables). This parameter transformation changes the observable characteristics of the data from readable plaintext to encrypted binary forms, maintaining functionality while preventing confidentiality breaches
2Ease of operation
If standardized virtual machines are used for cloud execution, then ease of deployment and management are improved, but security and privacy protection are worsened as data and execution can be disclosed and observed
Solution Approach 1:
The patent segments the virtual machine execution environment into multiple encrypted components: encrypted instruction sets, permuted dispatch tables, and encrypted data segments. This segmentation allows each component to be independently secured while maintaining the overall functionality of the standardized virtual machine, thus preserving ease of deployment while enhancing security
Solution Approach 2:
The patent creates a composite execution environment combining encrypted instructions, permuted dispatch tables, and encrypted data within a single virtual machine framework. This composite structure maintains the standardized VM interface for easy deployment while incorporating multiple layers of encryption and obfuscation for enhanced security protection
3Object-affected harmful factors
If encryption is applied to data stored in cloud, then confidentiality is improved, but key management complexity and potential vulnerabilities increase when keys must be stored on cloud for processing
Solution Approach 1:
The patent extracts the decryption functionality from the cloud infrastructure and embeds it within the virtual machine's encrypted instruction set. By taking out the key management complexity from the cloud environment and incorporating it into the encrypted VM execution environment, the system maintains confidentiality while reducing external key management vulnerabilities
4Productivity
If virtualization is used to share hardware resources among multiple applications, then cost efficiency and resource utilization are improved, but security isolation between applications is worsened as malicious insiders can observe and disclose data
Solution Approach 1:
The patent introduces encrypted data structures and permuted dispatch tables as intermediary layers between the shared hardware resources and multiple applications. This intermediary encryption layer maintains the resource sharing benefits of virtualization while preventing malicious insiders from observing or disclosing data, thus improving security isolation without sacrificing resource utilization
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
A virtual machine device 100 comprising multiple operation routines 122,124, 126 each configured to perform a particular instruction, and a selector 110 configured to receive an encoded instruction, the encoded instruction being obtained by encoding a plain instruction with a code encoding, the selector is configured to select and activate a corresponding operation routine of the multiple operation routines, the corresponding operation routine is configured to perform the plain instruction corresponding to the encoded instruction, the selector 100 comprises a look-up means for looking-up an encoded instruction to select the corresponding operation routine.