openstack havana块存储Cinder磁盘加密方法研究

在openstack havana的release note中有如下介绍“Attached Cinder volumes can now be encrypted. Data is decrypted as needed at read and write time while presenting instances with a normal block storage device”。

众所周知，在以前版本的openstack中，块存储创建出volume后，将其挂载给虚拟机，就可以启动虚拟机。但这种实现方式也存在一些安全隐患：若存在不怀好意的系统管理员或者黑客在攻陷nova节点时，就可以从宿主系统中，查看guest os中用户存放的数据。如果用户在其磁盘中存在敏感私人数据时，则存在数据泄密的风险。

关于磁盘加密的BluePrint链接：https://wiki.openstack.org/wiki/VolumeEncryption ，通过分析其实现方式可以发现，cinder中的卷在挂载到HyperVisor主机上时，对其进行加密，再讲加密后的块设备提供给虚拟机使用，最终虚拟机使用的加密后的磁盘。如果此时黑客攻陷主机的话，他看到的将是加密后的volume，如果不知道磁盘的加密密码，他看到将是没有任何意义的一堆数据。

通过分析nova中代码实现，可以发现磁盘加密的实现细节，openstack中的磁盘加密使用了Linux中的一个加密组件：cryptsetup！

    def _open_volume(self, passphrase, **kwargs):
        """Opens the LUKS partition on the volume using the specified
        passphrase.

        :param passphrase: the passphrase used to access the volume
        """
        LOG.debug(_("opening encrypted volume %s"), self.dev_path)

        # NOTE(joel-coffman): cryptsetup will strip trailing newlines from
        # input specified on stdin unless --key-file=- is specified.
        cmd = ["cryptsetup", "create", "--key-file=-"]

        cipher = kwargs.get("cipher", None)
        if cipher is not None:
            cmd.extend(["--cipher", cipher])

        key_size = kwargs.get("key_size", None)
        if key_size is not None:
            cmd.extend(["--key-size", key_size])

        cmd.extend([self.dev_name, self.dev_path])

        utils.execute(*cmd, process_input=passphrase,
                      check_exit_code=True, run_as_root=True)

    def attach_volume(self, context, **kwargs):
        """Shadows the device and passes an unencrypted version to the
        instance.

        Transparent disk encryption is achieved by mounting the volume via
        dm-crypt and passing the resulting device to the instance. The
        instance is unaware of the underlying encryption due to modifying the
        original symbolic link to refer to the device mounted by dm-crypt.
        """

        key = self._get_key(context).get_encoded()
        passphrase = self._get_passphrase(key)

        self._open_volume(passphrase, **kwargs)

        # modify the original symb