Hypervisor-based background encryption

To prevent data breaches, many organizations deploy full disk encryption to their computers. While OS-based encryption is widely accepted in practical situations, hypervisor-based encryption offers significant advantages such as OS independence and providing more secure environments. Unfortunately, the initial deployment cost of hypervisor-based encryption systems is rarely discussed. In this paper, we present a hypervisor-based encryption scheme that allows instant deployment of full disk encryption into existing systems without disturbing user's activities. To avoid waiting for encryption to be completed, hypervisors perform background encryption that does not incur significant performance penalty on guest OSs by carefully watching guest OS activities and moderating the degree of encryption speed. Our scheme does not require conversion of disk images or modification of OS configurations to install hypervisors by exploiting BitVisor, a thin hypervisor for enforcing security, that can be easily injected to existing systems. Our experimental results on Windows 7 show that application benchmark scores are not significantly affected by the background encryption and the overhead on sequential disk access throughput is at most 24%. The throughput of our background encryption is comparable to that of existing OS-based background encryption systems.