Data-at-rest protection for virtual machines

A computer system, comprising:

• a processor;
• a system memory;
• and
• a computer-readable storage medium storing instructions that are executable by the processor to a least:
• create, by a hypervisor, a first guest privilege context of a guest partition operating as a virtual machine and a second guest privilege context of the guest partition, wherein:
• the second guest privilege context is restricted from accessing memory associated with the first guest privilege context;
• and
• a guest operating system (OS) operating in the second guest privilege context is unaware of the first guest privilege context, and a data protection component executing in the first guest privilege context;
• operate the data protection component within the first guest privilege context, wherein the data protection component intercepts data input/output operations of the guest OS;
• intercept, by the data protection component within the first guest privilege context, a data output operation of the guest OS for writing data to the computer-readable storage medium;
• apply, by the data protection component within the first guest privilege context, a data protection operation to the data, the data protection operation comprising an encryption operation or an integrity token generation operation;
• and
• initiate, by the data protection component within the first guest privilege context, storage of a result of the data protection operation to the computer-readable storage medium.

A computer system, comprising:

• a processor;
• a system memory;
• and
• a computer-readable storage medium storing instructions that are executable by the processor to a least:
• create, by a hypervisor, a first guest privilege context of a guest partition operating as a virtual machine and a second guest privilege context of the guest partition, wherein:
• the second guest privilege context is restricted from accessing memory associated with the first guest privilege context;
• and
• a guest operating system (OS) operating in the second guest privilege context is unaware of the first guest privilege context, and a data protection component executing in the first guest privilege context;
• operate the data protection component within the first guest privilege context, wherein the data protection component intercepts data input/output operations of the guest OS;
• intercept, by the data protection component within the first guest privilege context, a data input operation of the guest OS for reading data from the computer-readable storage medium;
• apply, by the data protection component within the first guest privilege context, a data protection operation to the data, the data protection operation comprising a decryption operation or a data integrity validation operation;
• and
• based on applying the data protection operation to the data, communicate an outcome of the data protection operation to the guest OS.