On-the-fly Virtual Machine Memory Encryption via Hardware Security Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for secure execution of programs in cloud computing environments, particularly in Infrastructure-as-a-Service (IaaS), face challenges such as vulnerability to malicious hypervisor attacks and performance degradation due to software-based encryption methods.
Innovation Solution
A system that employs on-the-fly encryption and decryption of virtual machine memory using a hardware and software combination, where a security module, coupled with a Hardware Security Module (HSM), manages encryption keys specific to each virtual machine, ensuring that code is not visible to the hypervisor and protecting against attacks by using a unique encryption key and format that prevents plaintext exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption methods are used for secure program execution, then data security is improved, but infrastructure performance deteriorates due to additional processing load
Solution Approach 1:
The encryption system is segmented into multiple independent components: a security module for key management, an encryption module for data encryption, and a decryption module for data decryption. This segmentation allows each component to operate independently, reducing the processing overhead on the main infrastructure and improving overall performance while maintaining security.
Solution Approach 2:
A security module acts as an intermediary between the hypervisor and the encryption/decryption operations. This intermediary manages authentication and key distribution, offloading security-critical functions from the main processing infrastructure, thereby improving both security and performance by separating concerns.
2Ease of operation
If the hypervisor manages encryption keys and memory access, then ease of operation is improved, but security deteriorates because the hypervisor becomes a single point of failure and potential attack target
Solution Approach 1:
The security-critical functions of key management and authentication are extracted from the hypervisor and placed in a dedicated security module. This extraction removes the single point of failure, as the hypervisor no longer holds sensitive keys or performs security-critical operations, thereby improving security while the security module handles key management operations.
Solution Approach 2:
The security module serves as an intermediary that handles all authentication and key management operations. It verifies authentication information and distributes decryption keys to the decryption module without exposing these sensitive elements to the hypervisor, thus maintaining security while enabling easy operation through automated key distribution.
3Object-affected harmful factors
If program code is stored in encrypted form, then security against malicious attacks is improved, but device complexity increases due to additional encryption and decryption modules
Solution Approach 1:
Encryption and decryption capabilities are implemented locally within the virtual machine environment through dedicated modules that operate only when needed. The encryption module encrypts program code before execution, and the decryption module decrypts it during execution, providing localized security without requiring system-wide architectural changes, thus limiting complexity to specific functional areas.
Solution Approach 2:
The encryption and decryption modules are self-contained and autonomous, managing their own operations without requiring complex external coordination. The decryption module automatically receives encrypted code from the security module and processes it independently, reducing the need for complex integration and lowering overall system complexity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention relates to a device and method for encrypting a virtual machine by means of on-the-fly encryption and decryption of the memory. The device comprises hardware and software elements, including a hardware security module which, in response to data read/write requests, executes operations for the on-the-fly encryption and decryption of the data stream associated with an encrypted memory image. The device and method are particularly suited to allowing the secure authentication and execution of programs within the context of the infrastructure layer as a service of the cloud computing model.