Online disk encryption using mirror driver
Provided are techniques for encrypting a virtual disk of a virtual computing instance (VCI) while the VCI is online and still running using a mirror driver. In certain aspects a mirror driver is a filter running in an I/O stack used for accessing a virtual disk, such that the mirror driver receives I/Os destined to the virtual disk and mirrors those I/Os to the virtual disk and one or more additional virtual disks. The mirror driver begins copying data from an unencrypted source virtual disk to a destination virtual disk, and the data is encrypted as it is stored in the destination virtual disk, while the VCI is still online. During the copying, as new writes are issued to the unencrypted source virtual disk from the VCI, the mirror driver mirrors the writes to both the unencrypted source virtual disk and the destination virtual disk.
1. A method for encrypting an unencrypted source virtual disk of a virtual computing instance (VCI), the method comprising:
copying and encrypting contents of the unencrypted source virtual disk to a destination virtual disk; and
during the copying and encrypting:
mirroring write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
executing the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
executing the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk, wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
associating encrypted contents of an active delta virtual disk file of the unencrypted source virtual disk and encrypted contents of one or more inactive delta virtual disk files of the unencrypted source virtual disk with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
2. The method of claim 1 , wherein the copying and encrypting is performed while the VCI is online.
3. The method of claim 1 , further comprising installing a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
4. The method of claim 3 , further comprising removing the mirror driver after the copying and encrypting is complete.
5. The method of claim 4 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.
6. The method of claim 1 , wherein the unencrypted source virtual disk is implemented as one or more snapshots and the active delta virtual disk file.
7. The method of claim 6 , further comprising determining the one or more snapshots exist as the one or more inactive delta virtual disk files.
8. A system for encrypting an unencrypted source virtual disk of a virtual computing instance (VCI), the system comprising:
at least one memory; and
at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
copy and encrypting contents of the unencrypted source virtual disk to a destination virtual disk; and
during the copying and encrypting:
mirror write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
execute the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
execute the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk, wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
associating encrypted contents of an active delta virtual disk file of the unencrypted source virtual disk and encrypted contents of one or more inactive delta virtual disk files of the unencrypted source virtual disk with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
9. The system of claim 8 , wherein the copying and encrypting is performed while the VCI is online.
10. The system of claim 8 , wherein the at least one processor and the at least one memory are further configured to install a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
11. The system of claim 10 , wherein the at least one processor and the at least one memory are further configured to remove the mirror driver after the copying and encrypting is complete.
12. The system of claim 11 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.
13. The system of claim 8 , wherein the unencrypted source virtual disk is implemented as one or more snapshots and the active delta virtual disk file.
14. The system of claim 13 , wherein the at least one processor and the at least one memory are further configured to determine the one or more snapshots exist as the one or more inactive delta virtual disk files.
15. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
copy and encrypting contents of an unencrypted source virtual disk of a virtual computing instance (VCI) to a destination virtual disk; and
during the copying and encrypting:
mirror write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
execute the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
execute the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk, wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
associating encrypted contents of an active delta virtual disk file of the unencrypted source virtual disk and encrypted contents of one or more inactive delta virtual disk files of the unencrypted source virtual disk with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
16. The non-transitory computer-readable medium of claim 15 , wherein the copying and encrypting is performed while the VCI is online.
17. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to install a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
18. The non-transitory computer-readable medium of claim 17 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to remove the mirror driver after the copying and encrypting is complete.
19. The non-transitory computer-readable medium of claim 18 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.
20. The non-transitory computer-readable medium of claim 15 , wherein the unencrypted source virtual disk is implemented as one or more snapshots and the active delta virtual disk file.