Virtual machine image encryption

1. A computer implemented method for encrypting a virtual machine image, the method comprising:

locating an encrypted virtual machine image including an encryption boot loader;

extracting the encryption boot loader from the encrypted virtual machine image;

transmitting the extracted encryption boot loader to a designated trustee;

placing a pre-boot execution environment (PXE) on the encrypted virtual machine image; and

booting an operation system associated with the encrypted virtual machine image, wherein booting the operating system associated with encrypted virtual machine image includes:

receiving, from the PXE of the encrypted virtual machine image, a signal to initiate retrieval of the encryption boot loader from the designated trustee;

responsive to the signal from the PXE, retrieving the encryption boot loader from the designated trustee;

updating the encrypted virtual machine image to include the encryption boot loader; and

booting the operating system at the encrypted virtual machine using the encryption boot loader.

2. The method of claim 1 , further comprising:

transmitting a decryption key associated with the encrypted virtual machine image to the designated trustee.

3. The method of claim 1 , further comprising:

encrypting the virtual machine image; and

inserting the encryption boot loader into the encrypted virtual machine image.

4. The method of claim 1 , further comprising transmitting the encrypted virtual machine image to a public cloud computing platform.

5. The method of claim 1 , wherein the encrypted virtual machine image represents a virtual machine environment with one or more encrypted storage partitions.

6. The method of claim 1 , wherein booting the operating system associated with the encrypted virtual machine image, further comprises:

verifying the identity of the encrypted virtual machine image from which the signal was received;

responsive to verification of the encrypted virtual machine image, retrieving a decryption key associated with the encrypted virtual machine image from the designated trustee;

processing the retrieved encryption boot loader by injecting the retrieved decryption key in to the encryption boot loader; and

performing a pre-boot authentication of the encrypted virtual machine image using the processed encryption boot loader.

7. The method of claim 1 , wherein retrieving the encryption boot loader from the designated trustee includes:

sending a request to a server coupled to a data repository storing the encryption boot loader;

wherein the storage of encryption boot loader is associated with a plurality of trustees; and

retrieving the encryption boot loader only if, the request is authorized;

wherein the request is authorized based on the application at the server of a trustee policy to responses by the one or more designated trustees to the request.

8. A system comprising: a processor; and

a memory having instructions stored thereon, which when executed by the processor, cause the system to:

locate an encrypted virtual machine image including an encryption boot loader;

extract the encryption boot loader from an encrypted virtual machine image;

transmit the extracted encryption boot loader to a designated trustee;

place a pre-boot execution environment (PXE) on the encrypted virtual machine image; and

boot an operation system associated with the encrypted virtual machine image, wherein the instructions in the memory to boot the operating system include further instructions, which when executed by the processor, cause the system to:

receive, from the PXE of the encrypted virtual machine image, a signal to initiate retrieval of the encryption boot loader from the designated trustee;

retrieve the encryption boot loader from the designated trustee in response to the received signal from the PXE;

update the encrypted virtual machine image to include the encryption boot loader; and

boot the operating system at the encrypted virtual machine using the encryption boot loader.

9. The system of claim 8 , wherein the memory has further instructions, which when executed by the processor, cause the system to:

transmit a decryption key associated with the encrypted virtual machine image to the designated trustee.

10. The system of claim 8 , wherein the memory has further instructions, which when executed by the processor, cause the system to:

encrypt the virtual machine image; and

insert the encryption boot loader into the encrypted virtual machine image.

11. The system of claim 8 , wherein the memory has further instructions, which when executed by the processor, cause the system to:

transmit, via a network, the encrypted virtual machine image to a public cloud computing platform.

12. The system of claim 8 , wherein the encrypted virtual machine image represents a virtual machine environment with one or more encrypted storage partitions.

13. The system of claim 8 , wherein the instructions in the memory to boot the operating system include further instructions, which when executed by the processor, cause the system to:

verify the identity of the encrypted virtual machine image from which the signal was received;

retrieve a decryption key associated with the encrypted virtual machine image from the designated trustee, in response to verification of the encrypted virtual machine image;

process the retrieved encryption boot loader by injecting the retrieved decryption key in to the encryption boot loader; and

perform a pre-boot authentication of the encrypted virtual machine image using the processed encryption boot loader.

14. The system of claim 8 , wherein the instructions in the memory to retrieve the encryption boot loader from the designated trustee, include further instructions, which when executed by the processor, cause the system to:

send a request to a server coupled to a data repository storing the encryption boot loader;

wherein the storage of encryption boot loader is associated with a plurality of trustees; and

retrieve the encryption boot loader only if, the request is authorized;

wherein the request is authorized based on the application at the server of a trustee policy to responses to the request by the one or more designated trustees.