Encrypted Virtual Machine Storage Block Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer systems face security vulnerabilities when moving encrypted data for virtual machines, as existing encryption methods make data inaccessible if decrypted, posing challenges for hypervisors to manage and optimize data storage.
Innovation Solution
The technology enables hypervisors to migrate encrypted storage blocks without decrypting them, using location-dependent encryption keys, allowing virtual machines to move data securely between storage blocks while keeping the data inaccessible to the hypervisor, thereby enhancing security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted at the hardware level with location-dependent keys, then security against unauthorized access is improved, but data accessibility and migrability are worsened
Solution Approach 1:
The patent changes the encryption parameter from location-dependent keys to key-independent encryption. The encryption key is derived from a secret value stored in the virtual machine rather than from the storage block's physical location. This allows the same encrypted data to be accessed from any location without requiring decryption and re-encryption, thus resolving the contradiction between security and migrability
Solution Approach 2:
The patent segments the encryption key derivation process by separating the secret value (stored in the virtual machine) from the encryption operation. This segmentation allows the encrypted data to remain secure while enabling flexible access through the virtual machine's control, resolving the conflict between hardware-level security and software-controlled migrability
2Adaptability or versatility
If the hypervisor is provided with decryption capability to migrate data, then data migrability is improved, but security vulnerability is worsened
Solution Approach 1:
The patent extracts the decryption capability from the hypervisor and places it exclusively within the virtual machine environment. The secret value required for decryption is stored only in the virtual machine, not in the hypervisor. This extraction eliminates the security vulnerability while preserving migrability, as the virtual machine can decrypt and migrate its own data without hypervisor involvement
Solution Approach 2:
The patent introduces the virtual machine as an intermediary between the encrypted data and the hypervisor. The virtual machine acts as the sole entity that can decrypt the data using its secret value, mediating all access requests. This intermediary role prevents the hypervisor from having direct decryption capability, thus eliminating security vulnerabilities while enabling controlled migrability
3Ease of operation
If data remains unencrypted in main memory for system operation, then ease of operation is improved, but vulnerability to snooping is worsened
Solution Approach 1:
The patent implements dynamic encryption where data is encrypted at rest (on storage devices) but decrypted only when actively used by the virtual machine in main memory. The encryption state dynamically transitions to a decrypted state only within the controlled environment of the virtual machine, maintaining both operability and security. This dynamic approach resolves the contradiction between unencrypted memory access and protection from snooping
Data Source
AI summary
Systems and methods for migrating encrypted storage blocks in a security enhanced manner. An example method may comprise: selecting, by the hypervisor, a first storage block and a second storage block, the first storage block being associated with a virtual machine; associating the second storage block with the virtual machine; and providing, by the hypervisor, an instruction for the virtual machine to copy content of the first storage block to the second storage block.