Hypervisor-based Background Encryption

Transcription

1 -based Background Encryption Yushi OMOTE University of Tsukuba

2 Full-Disk Encryption (FDE) Recent study shows 10% of laptop computers are lost or stolen every year* To prevent data breach, many organizations deploy FDE FDE encrypts and protects entire contents in hard disks * Ponemon Institute LLC. Business risk of a lost laptop, April 2009.

3 -based FDE Commonly-used approach in practice Low initial deployment cost Instant installation Background encryption support Some drawbacks vulnerability dependency App Encrypt ex) BitLocker, Endpoint Encryption, Compusec, WinMagic,...

4 -based FDE Secure & -independent approach However, HIGH initial deployment cost Manual encryption No background encryption support P2V conversion Put on hypervisor installation Host with configuration App Encrypt ex) Xen-based FDE [Liang 10], TcVisor [Rezaei 10], BitVisor [Shinagawa 09]...

5 -based FDE requires so much time for deployment (hours) 9 Required time before user can start using PC 8 hours! Manual encryption P2V conversion installation based (Xen+dmcrypt) 5 mins. -based (BitLocker) Encryption for pre-installed (1TB partition)

6 Our Goal (hours) 9 Required time before user can start using PC Manual encryption P2V conversion installation based -based Encryption for pre-installed (1TB partition)

7 Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] based

8 Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] based

9 Para-pass-through-based (BitVisor VEE 09) Avoid P2V conversion Most I/Os pass-through from guest Make Virtual identical to Physical Pass-through! Simplify hypervisor installation Guest directly handles devices No host

10 Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] based Encryption for pre-installed (500GB partition)

11 Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing

12 Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing

13 Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing

14 Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing

15 Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing

16 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance intermixture Read/write timing

17 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing

18 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module

19 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module

20 Piggyback Module Transparently insert hypervisor requests between guest requests Not virtualize disk interface to avoid P2V Insert request Request Request Request Request

21 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module

22 Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data

23 Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data Data

24 Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data Data

25 Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write Check! If not the latest, read/ encrypt again Data Data

26 Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module

27 Moderation Module Observe guest activity for moderation Sleep encryption operation if guest is busy Encrypt

28 Implementation of Encryption Moderation Full Speed Encryption Enc Enc Enc Enc Enc t Disk freq. > 5 (s/sec) Mouse freq. > 100 (s/sec) Sleep Sleep Sleep Sleep Enc t Sleep Enc Sleep Enc Enc KBD freq. > 5 (s/sec) External Interrupt freq. > 1000 (ints/sec) Busy Idle t

29 Evaluation Guest disk access throughput Application benchmark Deployment cost of our system Experimental Environment CPU RAM HDD Intel Core 2 Quad Q GHz PC GB Seagate Barracuda TB Windows 7 Professional 32-bit

30 Guest Disk Access Throughput (Crystal Disk Mark) Enc/Dec overhead is 2%-24% (not so big) Moderation works fine 140 1M Seq K Rand. Throughput (MB/sec) Read Write 0 Read Write Baremetal Unencrypted Encrypted (Not yet)

31 Application Benchmark Moderation works fine % of bare-metal performance 100.0% 75.0% 50.0% 25.0% 0% (PCMark 7) Memory Management Overhead of impl. (BitVisor) Data compression App load startup Web page render Contacts search Unencrypted (Not yet)

32 Deployment cost of our system 5-10 minutes deployment Configuration (depends on people, 5-10 mins) One Reboot (1-2 mins) installation (within a min) Our System

33 Summary and Future Work Summary Design and implementation of hypervisorbased background encryption system Instant deployment on pre-install (5-10 mins) Future Work Auto optimization of moderation criteria

34 Thank you!