Stop dm-crypt device when an encrypted instance is suspended/stopped

https://blueprints.launchpad.net/nova/+spec/stop-dmcrypt-on-suspend

Disconnect the dm-crypt device from encrypted LVM volume when an instance with encrypted LVM ephemeral storage is suspended or powered off.

Problem description

The recently introduced LVM ephemeral storage encryption features secures user data at rest. Current implementation makes user data unreadable after the instance has been terminated. While the instance is active (e.g., running, paused, suspended or powered off), on the compute host the data is readable only by the super-user. This protection against unauthorized access can be strengthened further by disconnecting the dm-crypt device when an instance is suspended or powered off and flushing the encryption key from memory. The dm-crypt device is what allows the encrypted data to be accessed in the clear so disconnecting it will render the data unreadable by anyone without the key.

Use Cases

An encrypted instance operating on sensitive data is stopped but not destroyed – the work to be resumed later.

Project Priority

None

Proposed change

The change will add code to stop the dm-crypt device and flush the key in libvirt.driver.power_off() and libvirt.driver.suspend() and code to retrieve instance ephemeral encryption key and restart the dm-crypt device in libvirt.driver.power_on() and libvirt.driver.resume().

Alternatives

There is no real alternative.

Data model impact

None

REST API impact

None

Security impact

User data will be inaccessible to anyone while the instance is powered off or suspended.

Notifications impact

None

Other end user impact

None

Performance Impact

The power on and resume operations will be marginally slower for encrypted instances.

Other deployer impact

None

Developer impact

None

Implementation

Assignee(s)

Primary assignee:

dgenin (Dan Genin)

Work Items

  • Add dm-crypt stop/restart functionality to suspend()/resume().

  • Add dm-crypt stop/restart functionality to power_off()/power_on().

Dependencies

None

Testing

Unit and Tempest tests will be written to verify correct operation of the proposed feature.

Documentation Impact

The extension of data-at-rest security to powered off and suspended instances should be mentioned in OpenStack Security Guide.

References

None