Effectively in-place encryption system for encrypting system/root/operating system (OS) partitions and user data partitions
Techniques are taught for encrypting one or more target partitions effectively “in-place”. This effectively in-place encryption is extremely desirable when a root/OS partition (such as /, /usr, /bin, etc.) needs to be encrypted without having to manually back up its contents to another location where they may be exposed in plaintext form, encrypting a new partition, and restoring the contents back to it. The techniques of the present disclosure are also applicable for encrypting effectively in-place user data partitions. To accomplish its objectives, the technology provides an install sequence/process and a modified boot sequence to automatically encrypt partitions effectively in-place. In various embodiments, the selection of copy partitions where copy data is temporarily stored in encrypted form, is performed manually or automatically. In other embodiments, a logical volume manager (LVM) is employed that greatly facilitates provisioning of free space in the system where copy data will be temporarily and securely held/stored.
1 . An effectively in-place encryption system comprising computer-readable instructions stored in a non-transitory storage medium and at least one microprocessor coupled to said non-transitory storage medium for executing said computer-readable instructions, said effectively in-place encryption system comprising:
(a) a plurality of data partitions on one or more storage devices;
(b) a target partition and a copy partition belonging to said plurality of data partitions, said copy partition having free storage space large enough to store copy data of said target partition;
(c) a backing file created on said copy partition; and
(d) an encrypted loopback filesystem created using said backing file, wherein said encrypted loopback filesystem utilizes a symmetric key for encryption;
wherein said encrypted loopback filesystem temporarily stores said copy data while said target partition is being encrypted, and wherein said copy data is restored back onto said target partition after said target partition has been encrypted.
2 . The effectively in-place encryption system of claim 1 , wherein said copy data comprises one or both of operating system (OS)-related and user-related data.
3 . The effectively in-place encryption system of claim 1 , wherein said encrypted loopback filesystem is created on an encrypted loopback block device created using said backing file.
4 . The effectively in-place encryption system of claim 1 , wherein said copy partition is automatically identified by an analysis module that analyzes disk usage of said data partitions.
5 . The effectively in-place encryption system of claim 1 , wherein said copy partition is already encrypted and wherein said encrypted loopback filesystem in (d) re-encrypts said copy data.
6 . An effectively in-place encryption computer system comprising computer-readable instructions stored in a non-transitory storage medium and at least one microprocessor coupled to said storage medium for executing said computer-readable instructions, said effectively in-place encryption computer system comprising:
(a) a plurality of data partitions on one or more storage devices;
(b) a first target partition and one or more copy partitions belonging to said plurality of data partitions, said one or more copy partitions having a collective free storage space large enough to store copy data of said first target partition;
(c) one or more backing files created on corresponding said one or more copy partitions;
(d) one or more encrypted loopback block devices created with corresponding said one or more backing files, wherein said one or more encrypted loopback block devices utilize corresponding one or more symmetric keys for encryption;
(e) one or more physical volumes initialized from corresponding said one or more encrypted loopback block devices;
(f) a volume group created on said one or more physical volumes;
(g) a logical volume created on said volume group; and
(h) an encrypted filesystem created on said logical volume;
wherein said encrypted filesystem temporarily stores said copy data while said copy data is being deleted from said first target partition and while said target partition is being encrypted, and wherein said copy data is restored back onto said first target partition after said first target partition has been encrypted.
7 . The effectively in-place encryption computer system of claim 6 , wherein said first target partition is included in a volume group created while encrypting a second target partition belonging to said plurality of said data partitions.
8 . The effectively in-place encryption computer system of claim 6 , wherein said copy data comprises one or both of root data and user data.
9 . The effectively in-place encryption computer system of claim 6 , wherein said one or more copy partitions are automatically identified by an analysis code that analyzes free disk space of said plurality of said data partitions.
10 . A computer-implemented method executing by at least one microprocessor, computer-readable instructions stored in a non-transitory storage medium coupled to said at least one microprocessor, said method comprising the steps of:
(a) configuring a plurality of data partitions on one or more storage devices, said plurality of data partitions including a target partition that is to be encrypted;
(b) identifying a copy partition from amongst said plurality of data partitions excluding said target partition, said copy partition having a free storage space large enough to store copy data of said target partition;
(c) creating a backing file on said copy partition;
(d) creating an encrypted loopback filesystem with said backing file, said encrypted loopback filesystem utilizing a first symmetric key for encryption;
(e) temporarily storing said copy data onto said encrypted loopback filesystem while deleting said copy data from said target partition and encrypting said target partition with a second symmetric key; and
(f) restoring said copy data from said encrypted loopback filesystem onto said target partition after said target partition has been encrypted.
11 . The computer-implemented method of claim 10 wherein said copy data comprises one or both of operating system (OS)-related and user-related data.
12 . The computer-implemented method of claim 10 storing configuration data related to said target partition in an installation configuration file.
13 . The computer-implemented method of claim 10 automatically identifying said copy partition by analyzing disk usage on said plurality of said data partitions.
14 . The computer-implemented method of claim 10 compressing said copy data before performing said step (e).
15 . The computer-implemented method of claim 10 manually designating said copy partition by an administrator.
16 . A computer-implemented method executing by at least one microprocessor, computer-readable instructions stored in a non-transitory storage medium coupled to said at least one microprocessor, said method comprising the steps of:
(a) configuring a plurality of data partitions on one or more storage devices, said plurality of data partitions comprising a first target partition that is to be encrypted;
(b) identifying one or more copy partitions from amongst said plurality of data partitions excluding said first target partition, said one or more copy partitions having a combined free storage space large enough to store copy data of said first target partition;
(c) creating one or more backing files on corresponding said one or more copy partitions;
(d) creating one or more loopback devices using corresponding said one or more backing files;
(e) initializing each of said one or more loopback devices into respective one or more physical volumes;
(f) creating a volume group containing each of said one or more physical volumes;
(g) creating a logical volume over said volume group;
(h) encrypting said logical volume with a first symmetric encryption key to obtain an encrypted logical volume;
(i) creating a filesystem on said encrypted logical volume to obtain an encrypted filesystem;
(j) temporarily copying said copy data from said first target partition to said encrypted filesystem while encrypting said first target partition with a second symmetric key; and
(k) restoring said copy data from said encrypted filesystem onto said first target partition after said first target partition has been encrypted.
17 . The computer-implemented method of claim 16 deleting said encrypted filesystem along with underlying encrypted logical volume, volume group, said one or more physical volumes, said one or more loopback devices and said one or more backing files, and forgetting said first encryption key after said step (k).
18 . The computer-implemented method of claim 17 including said first target partition after it has been encrypted in said step (k) in a volume group for encrypting a second target partition from amongst said plurality of data partitions, in a subsequent iteration of said computer-implemented method.
19 . The computer-implemented method of claim 16 authenticating to a key manager and requesting it to create said second symmetric key.
20 . The computer-implemented method of claim 16 generating said first symmetric encryption key locally.
21 . The computer-implemented method of claim 16 compressing said copy data before performing said step (j).