VM-Aware Storage Encryption in SoC Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing demand for virtualization-based security services in mobile environments necessitates a technology to safely store data used by virtual machines while isolating data storage areas and ensuring data confidentiality.
Innovation Solution
A system-on-chip (SoC) with a storage host controller and encryption controller is employed to manage and encrypt data for each virtual machine using unique storage keys, ensuring data isolation and confidentiality through a virtual machine identifier register and buffer, along with a method to generate and manage storage keys and encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data storage areas are isolated for each virtual machine using separate encryption keys, then data confidentiality is improved, but device complexity increases due to multiple key management components
Solution Approach 1:
The patent divides the encryption key management into segmented components: storage KEKs (Key Encryption Keys) are stored in a secure element, while encrypted storage keys are stored in a key value store. The virtual machine identifier register segments the key selection process by storing VM-specific identifiers that map to specific encrypted storage keys. This segmentation allows multiple virtual machines to have isolated encryption keys without requiring a completely separate key management system for each VM.
Solution Approach 2:
The patent introduces an intermediary mechanism - the virtual machine identifier register and buffer system - that mediates between the virtual machine commands and the encrypted storage keys. When a virtual machine issues a command, the VM identifier is stored in the register, and the buffer manages the retrieval of the corresponding encrypted storage key. This intermediary layer simplifies the key management complexity by providing a standardized interface for key selection without exposing the underlying complexity of multiple encrypted keys.
2Reliability
If multiple encrypted storage keys are stored and managed for different virtual machines, then data isolation is improved, but storage space consumption increases
Solution Approach 1:
The patent applies nesting by storing encrypted storage keys within a key value store that is itself nested within the storage controller architecture. The storage KEKs are nested in a secure element, which is a specialized security module. This nested structure allows efficient storage of multiple encrypted keys without linearly increasing the overall storage footprint, as the key value store can be implemented using existing storage infrastructure within the controller.
Solution Approach 2:
The patent uses copying by storing encrypted versions of storage keys rather than the actual plaintext keys. The storage KEKs are used to encrypt the storage keys, creating encrypted copies that can be safely stored in the key value store. This copying approach allows multiple virtual machines to have their own encrypted key copies without requiring proportional increases in secure storage capacity, as the encrypted copies can be stored in less secure, more capacity-efficient locations.
3Measurement precision
If a virtual machine identifier register and buffer are added to manage key selection, then key selection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-storing virtual machine identifiers in the virtual machine identifier register before key selection is needed. When a virtual machine is activated or selected, its identifier is immediately stored in the register, preparing the system for rapid key selection. The buffer is also pre-configured to hold the corresponding encrypted storage key once the VM identifier is registered. This preliminary action eliminates the need for complex real-time computation or search operations during key selection, improving accuracy while keeping the control structure relatively simple.
Data Source
AI summary
A system-on-chip is provided. The system-on-chip includes: a storage host controller including a virtual machine identifier register and a buffer, wherein the virtual machine identifier register is configured to store an operating virtual machine identifier of an operating virtual machine that is currently running among a plurality of virtual machines and the buffer is configured to store a message queue including a command generated by the operating virtual machine; and a storage encryption controller configured to store a plurality of encrypted storage keys respectively assigned to a plurality of virtual machine identifiers of the plurality of virtual machines, select a first encrypted storage key from among the plurality of encrypted storage keys based on the operating virtual machine identifier stored in the virtual machine identifier register according to the command in the message queue, and encrypt or decrypt data corresponding to the command based on the first encrypted storage key.