Accessing a remote virtual environment without user authentication
View Patent ↗A method, system and computer program product for providing a secure connection between a client and a remote server to run a Virtual Environment (VE), including (a) establishing a repository for VE content on the remote server; (b) creating a data necessary for the VE to function; (c) generating a two key pairs that includes a VE key pair and a client key pair, wherein the VE key pair includes encryption and decryption keys, the client key pair includes decryption and encryption keys corresponding to encryption and decryption keys of the corresponding VE key pair and the two key pairs are used to provide a full duplex secure network channel between the client and the repository; (d) storing the data necessary for the VE to function as the VE content using data from the VE key pair in the repository; (e) receiving the address for accessing the stored data; and (f) from the client side, using the VE address and the client key pair to start the VE from the data necessary for the VE to function.
1. A method for providing data access for a client on shared storage with a unique address, the method comprising the steps of:
(A) data preparation and distribution on a shared server, including
(i) generating a pair of encryption/decryption keys;
(ii) on the client, selecting plaintext data to be stored on the shared storage;
(iii) on the server, preparing server data need to run a server program, and embedding the encryption/decryption key pair into the server data;
(iv) encrypting the plaintext data into cyphertext data using an encryption key from the pair;
(v) storing the cyphertext data on the shared storage;
(vi) receiving the unique address of the stored cyphertext data inside the shared storage for direct access of the encrypted data from the client;
(vii) storing the encryption/decryption key pair on the client;
(B) data utilization on the shared server, including
(i) running a server program that utilizes the cyphertext data and the server data and communicates with the client program using the cyphertext data;
(ii) for accessing the cyphertext data from the client, using the unique address to directly obtain data from the shared storage by client, without authentication, and using a decryption key from the encryption/decryption key pair to decrypt the cyphertext data;
(iii) for providing the cyphertext data from the shared server to the client, using an embedded key pair to encrypt the plaintext data, and storing it in the shared storage, wherein the client accesses the cyphertext data without authentication;
(C) data utilization on the client, including
(i) starting a client program that accesses the shared storage without authentication, sends requests to the shared storage, and receives responses from the shared storage, wherein:
(ii) in response to a read request from the client program to the server program, directly obtaining a portion of the cyphertext data from the shared storage by sending a request with offset/size parameters using the unique address, and decrypting cyphertext data using the decryption key from the encryption/decryption pair;
(iii) in response to a write request from the client program, encrypting a portion of the plaintext data using the encryption key from the encryption/decryption key pair, and storing the cyphertext data by sending the write request with offset/size parameters using the unique address.
2. The method of claim 1 , wherein the server is running a Virtual Machine under control of a Virtual Machine Monitor or a Hypervisor, and the data is a Virtual Machine image file.
3. The method of claim 1 , wherein the client program stores commands to the server in encrypted form, and wherein responses from the server use the cyphertext data stored on the shared storage.
4. The method of claim 3 , wherein the commands are activated when either the server or the client is not active.
5. The method of claim 1 , wherein the client initiates a virtual environment on the client side using the cyphertext data from the shared storage.
6. The method of claim 5 , wherein the virtual environment includes a Virtual Machine.
7. The method of claim 1 , wherein
the client initiates a virtual environment on the server side using the cyphertext data from the shared storage.
8. The method of claim 7 , wherein an identifier identifies a portion of data in the BLOB that is requested by the user.
9. The method of claim 1 , wherein the cyphertext data accessible to the client is stored as a BLOB (Binary Large Object).
10. A system for providing data access for a client on shared storage with a unique address, the system comprising a processor and computer code running on the processor for implementing the steps of:
(A) data preparation and distribution on a server, including
(i) generating a first pair of encryption/decryption keys;
(ii) selecting a plaintext data to be stored on the shared storage;
(iii) encrypting of the plaintext data using the encryption key from the first pair into cyphertext data;
(iv) storing the cyphertext data on the shared storage;
(v) receiving, from the client, the unique address of the stored cyphertext data in the shared storage for direct access of the cyphertext data;
(B) data utilization on the client, including
(i) starting a client program that access the cyphertext data without authentication;
(ii) in response to a read request with offset/size parameters from the client program, directly obtaining a portion of the cyphertext data from the shared storage by sending the read request using the unique address, and decrypting the cyphertext data using the decryption key from the first pair;
(iii) in response to a write request from the client program, encrypting portion of the plaintext data using the encryption key from the first pair, and storing the cyphertext data by sending the write request with offset/size parameters and the unique address to the shared storage.
11. The method of claim 10 , wherein the server is running a Virtual Machine under control of a Virtual Machine Monitor or a Hypervisor, and the data is a Virtual Machine image file.