Systems and methods for selectively masking data on virtual storage devices

A system for selectively masking data on virtual storage devices, the system comprising:

• an identification module, stored in memory, that identifies data stored on virtual storage within a physical storage area that can be accessed by a virtual machine, wherein the virtual storage device comprises a non-protected partition and a protected partition;
• an interception module, stored in memory, that intercepts, from a process executing outside the virtual machine that has a higher privilege level than the processes of the virtual machine, an attempt by a process of the virtual machine to read the data that can be accessed by the virtual machine, wherein the attempt to read the data comprises an attempt to read a partition table of the virtual storage device;
• a security module, stored in memory, that determines, based on an access-privilege evaluation performed by the process executing outside the virtual machine, that the virtual machine process attempting to read the data is not authorized to read the data;
• a masking module, stored in memory, that, in response to determining that the virtual machine process is not authorized to read the data, protects the data from unprivileged access by masking the data from the virtual machine process, wherein masking the data comprises providing, to the virtual machine process, contextually correct information without disclosing protected elements of the data by providing, via the partition table, correct partition data for the non-protected partition while providing empty entries in place of correct partition data for the protected partition;
• and
• at least one processor that executes the identification module, the interception module, the security module, and the masking module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify data stored on a virtual storage device within a physical storage area that can be accessed by a virtual machine, wherein the virtual storage device comprises a non-protected partition and a protected partition;
• intercept, from a process executing outside the virtual machine that has a higher privilege level than the processes of the virtual machine, an attempt by a process of the virtual machine to read the data that can be accessed by the virtual machine, wherein the attempt to read the data comprises an attempt to read a partition table of the virtual storage device;
• determine, based on an access-privilege evaluation performed by the process executing outside the virtual machine, that the virtual machine process attempting to read the data is not authorized to read the data;
• and
• in response to determining that the virtual machine process is not authorized to read the data, protect the data from unprivileged access by masking the data from the virtual machine process, wherein masking the data comprises providing, to the virtual machine process, contextually correct information without disclosing protected elements of the data by providing, via the partition table, correct partition data for the non-protected partition while providing empty entries in place of correct partition data for the protected partition.