Encryption of attached local volumes

NOTE: this blueprint is obselete. The referenced local volumes code has not been accepted into OpenStack master.

 This blueprint is an incremental feature to [https://blueprints.launchpad.net/nova/+spec/encrypt-cinder-volumes].

Through an extension in the Nova API [1], local volumes can be created and attached to a virtual machine (VM). However, these volumes are currently not being encrypted. This makes the platforms hosting VMs with local volumes high value targets because an attacker can break into the platform and read the data for many different VMs. This type of data breach could be addressed with encryption.

The aim of this blueprint is to provide encryption of the VM's data before it is written to disk. The idea is similar to how self-encrypting drives work. Our goal is to present the VM a normal block storage device, but we will encrypt the bytes in the virtualization host before writing them to the disk. For more information, see the referenced specification: [http://wiki.openstack.org/VolumeEncryption]

[1] http://openstackgd.wordpress.com/2012/03/15/add-support-for-local-volumes-in-openstack/