Creation and delivery of encrypted virtual disks
The present application is directed to methods and systems for receiving a request for a virtual disk and creating a virtual disk that includes the virtual disk attributes identified in the request or determined by an organization's security policies. The created virtual disk can then be encrypted and in some aspects, an encryption key for the encrypted virtual disk can be stored in an encryption key database. Upon creating and encrypting the virtual disk, the virtual disk can be transmitted to a client. The client, upon receiving the encrypted virtual disk, can mount the virtual disk into the client system. The encrypted virtual disk may be stored as a file within an unencrypted virtual disk, and the unencrypted virtual disk backed up to a local or remote storage location.
1. A method for centralized encrypted virtual disk delivery from a server to a client device, the method comprising:
receiving, by a virtual disk creator executing on a server, a request from a policy engine executing on a client device to generate a virtual disk in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses, the request having encryption attributes and machine credentials identifying the client device that transmitted the request, the encryption attributes including an encryption key that includes the machine credentials, and at least one of a type of encryption and an encryption strength;
generating, responsive to the request by the virtual disk creator, the virtual disk responsive to the request and based on disk attributes specified in the request, the request initiated by the client device;
encrypting, responsive to the request by the virtual disk creator, the generated virtual disk using the encryption key and the machine credentials, based on the received request, the received request having encryption attributes including the encryption key and at least one of the type of encryption and the encryption strength;
storing, by the virtual disk creator, a disk identifier, the encryption key, and the machine credentials, to a centralized database;
transmitting, by the virtual disk creator, the encrypted virtual disk to the client device; and
receiving, by the server from the client device, an unencrypted backup virtual disk comprising an encrypted disk file of the encrypted virtual disk; and
storing, by the server, the backup virtual disk in a backup storage location, the backup virtual disk comprising the encrypted disk file recognized by an operating system of the client device as a backup disk.
2. The method of claim 1 , wherein the request to generate a virtual disk from the policy engine executing on the client device comprises one or more of the following: a size of the requested virtual disk and a type of storage.
3. The method of claim 1 , further comprising queuing, by the virtual disk creator, the request to generate a virtual disk from the policy engine executing on the client device until the virtual disk creator has availability to respond to the request.
4. The method of claim 1 , further comprising transmitting, by the virtual disk creator, the encrypted virtual disk over a secure network using an encrypted network protocol.
5. The method of claim 1 , further comprising receiving, by the virtual disk creator, the request from the policy engine executing on the client device responsive to a determination that an application executed by the client device requires a secure storage area.
6. The method of claim 5 , further comprising determining that the application requires a secure storage area responsive to the application comprising one of a remote-display protocol client and a streamed application.
7. The method of claim 1 , further comprising receiving, by the virtual disk creator, the request from the policy engine executing on the client device responsive to a determination that at least one attribute of a secure storage area existing on the client device does not correspond to a predetermined security requirement.
8. A method of centralized encrypted virtual disk delivery from a server to a client device, comprising:
receiving, by a virtual disk creator executing on a server, a request from a policy engine executing on a client device to generate a virtual disk in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses, the request having encryption attributes and machine credentials identifying the client device that transmitted the request, the encryption attributes including an encryption key that includes the machine credentials, and at least one of a type of encryption and an encryption strength;
generating, responsive to the request by the virtual disk creator, the virtual disk responsive to the request and based on disk attributes specified in the request, the request initiated by the client device;
encrypting, responsive to the request by the virtual disk creator, the generated virtual disk using the encryption key and the machine credentials, based on the received request, the received request having encryption attributes including the encryption key and at least one of the type of encryption and the encryption strength;
storing, by the virtual disk creator, a disk identifier, the encryption key, and the machine credentials, to a centralized database;
transmitting, by the virtual disk creator, the encrypted virtual disk to the client device;
receiving, by the server from the client device, an unencrypted backup virtual disk comprising an encrypted disk file of the encrypted virtual disk; and
storing, by the server, the backup virtual disk in a backup storage location, the backup virtual disk comprising the encrypted disk file is recognized by an operating system of the client device as a backup disk.
9. The method of claim 8 , wherein receiving the unencrypted backup virtual disk comprises receiving the unencrypted backup virtual disk from the client device responsive to a backup policy executed by the client device.
10. The method of claim 8 , wherein the request to generate a virtual disk from the policy engine executing on the client device comprises one or more of the following: a size of the requested virtual disk and a type of storage.
11. The method of claim 8 , comprising:
queuing, by the virtual disk creator, the request to generate a virtual disk from the policy engine executing on the client device until the virtual disk creator has availability to respond to the request.
12. The method of claim 8 , comprising:
transmitting, by the virtual disk creator, the encrypted virtual disk over a secure network using an encrypted network protocol.
13. The method of claim 8 , comprising:
receiving, by the virtual disk creator, the request from the policy engine executing on the client device responsive to a determination that an application executed by the client device requires a secure storage area, the application comprising one of a remote-display protocol client and a streamed application.
14. The method of claim 8 , comprising:
receiving the request from a policy engine executing on the client device in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses.
15. A system for centralized encrypted virtual disk delivery from a server to a client device, the system comprising:
a computing device in communication with a client device, executing a virtual disk creator, the virtual disk creator comprising a processor configured to:
receive a request sent from a policy engine executing on a client device to generate a virtual disk in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses, the received request including encryption attributes and machine credentials identifying the client device that transmitted the request, the encryption attributes including an encryption key that includes the machine credentials, and at least one of a type of encryption and an encryption strength,
generate the virtual disk responsive to the request and based on disk attributes specified in the request, the request initiated by the client device,
encrypt the generated virtual disk, responsive to the request, using the encryption key and the machine credentials, based on the received request, wherein the received request includes encryption attributes including the encryption key and at least one of the type of encryption and the encryption strength, and the encryption key,
store a disk identifier, the encryption key, and the machine credentials to a centralized database,
transmit the encrypted virtual disk to the client device,
receive, by the server from the client device, an unencrypted backup virtual disk comprising an encrypted disk file of the encrypted virtual disk; and
store, by the server, the backup virtual disk in a backup storage location, the backup virtual disk comprising the encrypted disk file recognized by an operating system of the client device as a backup disk.
16. The system of claim 15 , wherein the request to generate a virtual disk from the policy engine executing on the client device comprises one or more of the following: a size of the requested virtual disk and a type of storage.
17. The system of claim 15 , wherein the virtual disk creator is further configured to queue the request to generate a virtual disk from the policy engine executing on the client device until the virtual disk creator has availability to respond to the request.
18. The system of claim 15 , wherein the virtual disk creator is further configured to transmit the encrypted virtual disk over a secure network using an encrypted network protocol.
19. The system of claim 15 , wherein the virtual disk creator is further configured to receive the request from the policy engine executing on the client device responsive to a determination that an application executed by the client device requires a secure storage area.
20. The system of claim 19 , wherein the application executed by the client device comprises one of a remote-display protocol client and a streamed application.
21. The system of claim 15 , wherein the virtual disk creator is further configured to receive the request from the policy engine executing on the client device responsive to a determination that at least one attribute of a secure storage area existing on the client device does not correspond to a predetermined security requirement.
22. The system of claim 15 , wherein the backup service is configured to receive the unencrypted backup virtual disk from the client device, the unencrypted backup virtual disk sent responsive to a backup policy executed by the client device.