Granted Patent B2

US 8,627,112 · App. 12/749,881 · Granted Jan 7, 2014

Inventors: Pradeep Kumar Chaturvedi (Bangalore, IN); Gosukonda Naga Venkata Satya Sudhakar (Bangalore, IN)

Assignee: Novell, Inc.

Abstract

Claims (49)

1. An apparatus, comprising:

a first node including encrypted memory locations that have been allocated to store encrypted information; and

a storage supervision processor executing a single hypervisor and communicatively coupled to the first node to:

permit access to a designated number of the encrypted memory locations to a single application executed by an associated virtual machine (VM) subject to the hypervisor, the encrypted memory locations being usable as main memory, and the single application being from a plurality of applications executing in the associated VM; and

deny access to the designated number of the encrypted memory locations to any other application executed by the associated VM, or any other VM, the information to be encrypted and decrypted using the single hypervisor and a dynamic encryption key; and

a key generation module, implemented by a processor, to generate the dynamic encryption key to be made accessible to the single hypervisor, the dynamic encryption key created for each snapshot taken of the associated VM.

2. The apparatus of claim 1 , further comprising:

a second node to execute the single application, and to request storage and recall of the information using a memory configuration associated with the encrypted memory locations.

3. The apparatus of claim 1 , further comprising:

a second node to execute the single application, and to request storage and recall of the information without having a memory configuration associated with the encrypted memory locations.

4. The apparatus of claim 1 , further comprising:

a second node to house the storage supervision processor.

5. The apparatus of claim 1 , wherein the encrypted memory locations comprise non-volatile memory.

6. A processor-implemented method to execute on one or more processors that perform the method, comprising:

executing a single hypervisor;

allocating encrypted memory locations to store encrypted information, the encrypted memory locations being usable as main memory, and the information to be encrypted and decrypted using the single hypervisor and a dynamic encryption key;

permitting access to a designated number of the encrypted memory locations to a single application executed by an associated virtual machine (VM) subject to the hypervisor, the single application being from a plurality of applications executing in the associated VM; and

denying access to the designated number of the encrypted memory locations to any other application executed by the associated VM, or any other VM; and

creating, by the hypervisor, the dynamic encryption key associated with the information for each snapshot taken of the associated VM.

7. The method of claim 6 , wherein the permitting access comprises:

permitting access when the single application requests access using a secure memory request designated by the associated VM.

8. The method of claim 6 , wherein the single application comprises

one of a word processing application, a presentation application, a spreadsheet application, an email application, a database application, or a browser application.

9. The method of claim 6 , further comprising:

presenting the encrypted memory locations by the hypervisor to the associated VM as a secure disk file memory configuration, wherein the associated VM is to manage storage operations associated with secure disk file memory.

10. The method of claim 9 , further comprising:

mounting a secure disk containing the secure disk file by the associated VM;

mapping memory in the secure disk file to the designated number of the encrypted memory locations; and

granting access to the secure disk file to the single application by the associated VM.

11. The method of claim 6 , further comprising:

storing the encrypted information in the encrypted memory locations comprising non-volatile memory locations; and

one of transmitting the encrypted information and at least one shared key to a new hypervisor or transmitting a decrypted version of the encrypted information to the new hypervisor over a secure network connection.

12. The method of claim 6 , further comprising:

decrypting the encrypted information to provide the information;

assembling a memory file comprising content of regular memory associated with the single application and the information; and

migrating the memory file to a physical machine to permit unencrypted access to the information by the physical machine.

13. The method of claim 6 , further comprising:

granting access by the hypervisor to an operating system (OS) associated with the associated VM, to the designated number of the encrypted memory locations, without transmitting a configuration of the encrypted memory locations to the associated VM.

14. The method of claim 6 , further comprising:

receiving a request to access the encrypted memory locations from an unknown application that is not the single application, or an unknown VM that is not associated with the single application; and

denying access to the unknown application or the unknown VM by the associated VM.

15. The method of claim 6 , wherein the information is to be shared between the single application and another application, further comprising:

requesting recall of the information by the single application;

decrypting of the encrypted information by the hypervisor to provide the information; and

transmitting the information from the hypervisor to the single application.

16. The method of claim 6 , further comprising:

requesting storage of the information by the single application;

encrypting the information by the hypervisor to provide the encrypted information; and

storing the encrypted information in the encrypted memory locations by the hypervisor.

Assignments (16)

Continuity (1)