Storage encryption
View Patent ↗Storage associated with a virtual machine or other type of device may be migrated between locations (e.g., physical devices, network locations, etc.). To maintain the security of the storage, a system may manage the encryption of the storage area such that a storage area is encrypted with a first encryption key that may be maintained through the migration. A header of the storage area, on the other hand, may be encrypted using a second encryption key and the first encryption key may be stored therein. Upon transfer, the header may be re-encrypted to affect the transfer of security.
1. One or more non-transitory computer-readable media storing instructions that when executed by one or more computers cause the one or more computers to:
encrypt, using a first key, data in a storage area of a virtualization environment, the storage area being provisioned for a virtual machine;
store, in a header of the storage area, the first key, the header being logically separated from the data;
encrypt, using a second key, the first key; and
responsive to a request to migrate the storage area from a first location of the virtualization environment to a second location of the virtualization environment:
decrypt, using the second key, the first key;
encrypt, using a third key, the first key;
migrate, from the first location and to the second location, the data, the data being encrypted in accordance with the first key;
decrypt, using the third key, the first key; and
encrypt, using a fourth key, the first key.
2. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to encrypt, using the fourth key, the header, the header comprising the first key.
3. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to store, in the header, the third key.
4. The one or more non-transitory computer-readable media of claim 3 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to remove, after encrypting the first key using the fourth key, the third key from the header.
5. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to migrate, from the first location and to the second location, the data without modifying its encryption.
6. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to migrate, from a first device of the virtualization environment and to a second device of the virtualization environment, the data.
7. The one or more non-transitory computer-readable media of claim 6 , wherein the instructions, when executed by the one or more computers, cause the one or more computers to:
migrate, from the first device and to the second device, state information associated with the virtual machine;
instantiate, on the second device and based on the state information, a new virtual machine; and
provide the new virtual machine with access to the data.
8. A system, comprising:
a plurality of computing devices associated with a virtualization environment, the plurality comprising a first device comprising a storage area provisioned for a virtual machine, the storage area comprising data and a header logically separated from the data;
at least one processor; and
a memory storing instructions that when executed by the at least one processor cause the system to:
encrypt, using a first key, the data;
store, in the header, the first key;
encrypt, using a second key, the first key; and
responsive to a request to migrate the storage area from the first device to a second device of the plurality of computing devices associated with a virtualization environment:
decrypt, using the second key, the first key;
encrypt, using a third key, the first key;
migrate, from the first device and to the second device, the data, the data being encrypted in accordance with the first key;
decrypt, using the third key, the first key; and
encrypt, using a fourth key, the first key.
9. The system of claim 8 , wherein the instructions, when executed by the at least one processor, cause the system to encrypt, using the fourth key, the header, the header comprising the first key.
10. The system of claim 8 , wherein the instructions, when executed by the at least one processor, cause the system to store, in the header, the third key.
11. The system of claim 10 , wherein the instructions, when executed by the at least one processor, cause the system to remove, after encrypting the first key using the fourth key, the third key from the header.
12. The system of claim 8 , wherein the instructions, when executed by the at least one processor, cause the system to migrate, from the first device and to the second device, the data without modifying its encryption.
13. The system of claim 8 , wherein the instructions, when executed by the at least one processor, cause the system to:
migrate, from the first device and to the second device, state information associated with the virtual machine; and
instantiate, on the second device and based on the state information, a new virtual machine.
14. The system of claim 13 , wherein the instructions, when executed by the at least one processor, cause the system to:
decrypt, on the second device and using the fourth key, the first key;
decrypt, on the second device and using the first key, the data; and
provide, by the second device, the new virtual machine with access to the data.
15. A method, comprising:
encrypting, by one or more computing devices associated with a virtualization environment and using a first key, data in a storage area of the virtualization environment, the storage area being provisioned for a virtual machine;
storing, by the one or more computing devices and in a header of the storage area, the first key, the header being logically separated from the data;
encrypting, by the one or more computing devices and using a second key, the first key; and
responsive to receiving a request to migrate the storage area from a first location of the virtualization environment to a second location of the virtualization environment:
decrypting, by the one or more computing devices and using the second key, the first key;
encrypting, by the one or more computing devices and using a third key, the first key;
migrating, by the one or more computing devices, from the first location, and to the second location, the data, the data being encrypted in accordance with the first key;
decrypting, by the one or more computing devices and using the third key, the first key; and
encrypting, by the one or more computing devices and using a fourth key, the first key.
16. The method of claim 15 , comprising encrypting, by the one or more computing devices and using the fourth key, the header, the header comprising the first key.
17. The method of claim 15 , comprising storing, by the one or more computing devices and in the header, the third key.
18. The method of claim 17 , comprising removing, by the one or more computing devices and after encrypting the first key using the fourth key, the third key from the header.
19. The method of claim 15 , wherein the virtualization environment comprises a first device and a second device, the method comprising:
instantiating, by the first device, an instance of the virtual machine;
providing, by the first device, the instance with access to the data;
instantiating, by the second device, a different instance of the virtual machine; and
providing, by the second device, the different instance with access to the data.
20. The method of claim 19 , wherein providing the instance with access to the data comprises decrypting, using the second key, the first key, and decrypting, using the first key, the data, and wherein providing the different instance with access to the data comprises decrypting, using the fourth key, the first key, and decrypting, using the first key, the data.