Secure virtual machine memory
View Patent ↗Apparatus, systems, and methods may operate to restore an operational state of an associated virtual machine (VM) using encrypted information stored in encrypted memory locations. A single hypervisor may be used to encrypt and decrypt the information. Access may be permitted to a designated number of the encrypted memory locations only to a single application executed by the associated VM subject to the hypervisor. Access may be denied to any other application executed by the associated VM, or any other VM.
1. A machine-readable medium that is not a transitory propagating signal, the machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
granting access by a single hypervisor to an operating system (OS) associated with an associated virtual machine (VM), to a designated number of the encrypted memory locations, without transmitting a configuration of the encrypted memory locations to the associated VM;
copying, by the hypervisor, associated VM memory to a file in response to an instruction to snapshot virtual machine memory, clone the associate VM, pause the associated VM, or suspend the associated VM, the associated VM memory including encrypted memory locations, a designated number of the encrypted memory locations assigned to a single application executing in the OS of the associated VM, the encrypted memory locations specified by memory addresses, the encrypted memory locations accessible to the single application via a secure memory access request to the OS using the memory addresses, the copying including encrypting data from the encrypted memory locations prior to storage in the file;
restoring an operational state of application data for the associated VM, using encrypted information of the application data stored in the encrypted memory locations, the information to be encrypted and decrypted using the single hypervisor; and
permitting, in response to a request by the single application executed in the OS of the associated VM, access to the designated number of the encrypted memory locations only to the single application executed by the associated VM subject to the hypervisor, wherein the access is denied to any other application executed by the associated VM, or any other VM.
2. The machine-readable medium of claim 1 , wherein the operations further comprise:
receiving a request to access the encrypted memory locations from an unknown application that is not the single application, or an unknown VM that is not associated with the single application; and
denying access to the unknown application by the associated VM.
3. The machine-readable medium of claim 1 , wherein the operations further comprise:
receiving a request to restore the operational state of application data for the associated VM after one of a pause operation or a suspend operation;
decrypting, by the hypervisor, the encrypted information to provide the information; and
transmitting the information to be used to restore the operational state of application data for the associated VM.
4. The machine-readable medium of claim 1 , wherein the operations further comprise:
creating, by the hypervisor, a decryption key associated with the information once for a lifetime of the VM, or for some number of times equal to a number of snapshots taken of the VM.
5. An apparatus comprising:
a first node including encrypted memory locations specified by memory addresses; and
a storage supervision processor to execute a single hypervisor, the storage supervision processor to:
copy associated virtual machine (VM) memory to a file in response to an instruction to snapshot virtual machine memory, clone the associate VM, pause the associated VM, or suspend the associated VM, the associated VM memory including the encrypted memory locations, a designated number of the encrypted memory locations assigned to a single application executing in an operating system (OS) of the associated VM, the encrypted memory locations accessible to the single application via a secure memory access request to the OS using the memory addresses, wherein to copy the associated VM memory includes encrypting data from the encrypted memory locations prior to storage in the file restore an operational state of application data for the associated VM using encrypted information of the application data stored in the encrypted memory locations;
permit, in response to a request by the single application executed in an operating system of the associated VM, access to the designated number of the encrypted memory locations only to the single application executed by the associated VM on a second node subject to the hypervisor, wherein the access is denied to any other application executed by the associated VM, or any other VM; and
grant access to the OS associated with the associated VM, to a designated number of the encrypted memory locations, without transmitting a configuration of the encrypted memory locations to the associated VM.
6. The apparatus of claim 5 , wherein the apparatus is to:
receive a request to access the encrypted memory locations from an unknown application that is not the single application, or an unknown VM that is not associated with the single application; and
deny access to the unknown application by the associated VM.
7. The apparatus of claim 5 , wherein the apparatus is to:
receive a request to restore the operational state of the application data for the associated VM after one of a pause operation or a suspend operation;
decrypt, by the hypervisor, the encrypted information to provide the information; and
transmit the information to be used to restore the operational state application data for of the associated VM.
8. The apparatus of claim 5 , wherein the hypervisor is to create a decryption key associated with the information once for a lifetime of the VM, or for some number of times equal to a number of snapshots taken of the VM.
9. A processor-implemented method to execute on one or more processors that perform the method, comprising:
granting access by a single hypervisor to an operating system (OS) associated with an associated virtual machine (VM), to a designated number of the encrypted memory locations, without transmitting a configuration of the encrypted memory locations to the associated VM;
copying, by the hypervisor, associated VM memory to a file in response to an instruction to snapshot virtual machine memory, clone the associate VM, pause the associated VM, or suspend the associated VM, the associated VM memory including encrypted memory locations, a designated number of the encrypted memory locations assigned to a single application executing in the OS of the associated VM, the encrypted memory locations specified by memory addresses, the encrypted memory locations accessible to the single application via a secure memory access request to the OS using the memory addresses, the copying including encrypting data from the encrypted memory locations prior to storage in the file;
restoring an operational state of application data for the associated VM, using encrypted information of the application data stored in the encrypted memory locations, the information to be encrypted and decrypted using the single hypervisor; and
permitting, in response to a request by the single application executed in the OS of the associated VM, access to the designated number of the encrypted memory locations only to the single application executed by the associated VM subject to the hypervisor, wherein the access is denied to any other application executed by the associated VM, or any other VM.
10. The method of claim 9 , further comprising:
receiving a request to access the encrypted memory locations from an unknown application that is not the single application, or an unknown VM that is not associated with the single application; and
denying access to the unknown application by the associated VM.
11. The method of claim 9 , further comprising:
receiving a request to restore the operational state of the application data for the associated VM after one of a pause operation or a suspend operation;
decrypting, by the hypervisor, the encrypted information to provide the information; and
transmitting the information to be used to restore the operational state of the associated VM.
12. The method of claim 9 , further comprising:
creating, by the hypervisor, a decryption key associated with the information once for a lifetime of the VM, or for some number of times equal to a number of snapshots taken of the VM.