-based Background Encryption Yushi OMOTE University of Tsukuba
Full-Disk Encryption (FDE) Recent study shows 10% of laptop computers are lost or stolen every year* To prevent data breach, many organizations deploy FDE FDE encrypts and protects entire contents in hard disks * Ponemon Institute LLC. Business risk of a lost laptop, April 2009.
-based FDE Commonly-used approach in practice Low initial deployment cost Instant installation Background encryption support Some drawbacks vulnerability dependency App Encrypt ex) BitLocker, Endpoint Encryption, Compusec, WinMagic,...
-based FDE Secure & -independent approach However, HIGH initial deployment cost Manual encryption No background encryption support P2V conversion Put on hypervisor installation Host with configuration App Encrypt ex) Xen-based FDE [Liang 10], TcVisor [Rezaei 10], BitVisor [Shinagawa 09]...
-based FDE requires so much time for deployment (hours) 9 Required time before user can start using PC 8 hours! Manual encryption P2V conversion installation 7 5 2 0 -based (Xen+dmcrypt) 5 mins. -based (BitLocker) Encryption for pre-installed (1TB partition)
Our Goal (hours) 9 Required time before user can start using PC Manual encryption P2V conversion installation 7 5 2 0 -based -based Encryption for pre-installed (1TB partition)
Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] 0 5 2 -based
Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] 0 5 2 -based
Para-pass-through-based (BitVisor VEE 09) Avoid P2V conversion Most I/Os pass-through from guest Make Virtual identical to Physical Pass-through! Simplify hypervisor installation Guest directly handles devices No host
Approach To remove Manual encryption Implement background encryption in hypervisor (hours) Required time for deployment 9 7 To remove P2V conversion & simplify hypervisor installation Leverage Para-pass-throughbased hypervisor [Shinagawa 09] 0 5 2 -based Encryption for pre-installed (500GB partition)
Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module
Piggyback Module Transparently insert hypervisor requests between guest requests Not virtualize disk interface to avoid P2V Insert request Request Request Request Request
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module
Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data
Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data Data
Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write If not the latest, read/ encrypt again Data Data
Scheduling Module Just before write, check if data to be written is the latest Read/encrypt/ CHECK&write Check! If not the latest, read/ encrypt again Data Data
Background Encryption in reads/encrypts/writes disk in parallel with guest Moderation Module Guest performance Piggyback Module intermixture Read/write timing Scheduling Module
Moderation Module Observe guest activity for moderation Sleep encryption operation if guest is busy Encrypt
Implementation of Encryption Moderation Full Speed Encryption Enc Enc Enc Enc Enc t Disk freq. > 5 (s/sec) Mouse freq. > 100 (s/sec) Sleep Sleep Sleep Sleep Enc t Sleep Enc Sleep Enc Enc KBD freq. > 5 (s/sec) External Interrupt freq. > 1000 (ints/sec) Busy Idle t
Evaluation Guest disk access throughput Application benchmark Deployment cost of our system Experimental Environment CPU RAM HDD Intel Core 2 Quad Q9550 2.83GHz PC2-6400 4GB Seagate Barracuda 7200.12 1TB Windows 7 Professional 32-bit
Guest Disk Access Throughput (Crystal Disk Mark) Enc/Dec overhead is 2%-24% (not so big) Moderation works fine 140 1M Seq. 0.70 4K Rand. Throughput (MB/sec) 105 70 35 0.53 0.35 0.18 0 Read Write 0 Read Write Baremetal Unencrypted Encrypted (Not yet)
Application Benchmark Moderation works fine % of bare-metal performance 100.0% 75.0% 50.0% 25.0% 0% (PCMark 7) Memory Management Overhead of impl. (BitVisor) Data compression App load startup Web page render Contacts search Unencrypted (Not yet)
Deployment cost of our system 5-10 minutes deployment Configuration (depends on people, 5-10 mins) One Reboot (1-2 mins) installation (within a min) Our System
Summary and Future Work Summary Design and implementation of hypervisorbased background encryption system Instant deployment on pre-install (5-10 mins) Future Work Auto optimization of moderation criteria
Thank you!