System and method for slice virtual disk encryption

1. A method for providing slice virtual disk encryption, the method comprising:

transmitting, by a hardware processor associated with a virtual machine, an input/output request to a data storage system, wherein the input/output request includes a virtual machine identifier, and wherein the input/output request includes a data payload to write to the data storage system;

identifying a virtual disk in the data storage system that is associated with the virtual machine based on the virtual machine identifier, wherein the virtual disk includes a slice of a persistent storage device;

identifying a start address and an end address of the virtual disk based on a virtual disk identifier;

transmitting a key request for a key encryption key, wherein the key request includes the start address and the end address of the virtual disk;

determining whether the start address and the end address are valid in response to receiving the key request;

generating the key encryption key, in response to the determining that the start address and the end address are valid;

generating a smart key encryption key based on the key encryption key and the start address and the end address;

encrypting a media encryption key with the smart key encryption key; and

encrypting the data payload with the encrypted media encryption key prior to storing the data payload in the virtual disk.

2. The method of claim 1 , wherein the start address and the end address are valid if the start address and the end address are within a logical block address range.

3. The method of claim 1 , wherein the start address is a first logical block of the virtual disk and the end address is a last logical block of the virtual disk.

4. The method of claim 1 , further comprising in response to the determining that the start address, and the end address are not valid, denying the input/output request.

5. The method of claim 4 , wherein the identifying of the virtual disk associated with the virtual machine is via a mapping table maintained by a hypervisor.

6. The method of claim 4 , wherein the identifying of the start address and the end address associated with the virtual disk is via an address lookup table maintained by a virtual machine server.

7. The method of claim 1 , wherein the key encryption key is generated by a key management service.

8. The method of claim 7 , wherein a virtual machine server stores an identifier of the key encryption key.

9. The method of claim 1 , wherein the key encryption key is associated with the persistent storage device.

10. A method for providing slice virtual disk encryption, the method comprising:

transmitting, by a virtual machine, an input/output request to query data from a data storage system, wherein the input/output request includes a virtual machine identifier;

identifying a virtual disk associated with the virtual machine based on the virtual machine identifier;

updating the input/output request with a virtual disk identifier of the virtual disk associated with the virtual machine;

updating the input/output request with a start address and an end address based on the virtual disk identifier;

validating the input/output request based on the start address and the end address;

subsequent to the validating the input/output request, querying data from the virtual disk; and

decrypting the queried data prior to transmitting a response to the virtual machine, wherein the response includes the decrypted data.

11. The method of claim 10 , wherein the data is decrypted with an encrypted media encryption key.

12. The method of claim 11 , wherein the encrypted media encryption key is encrypted by a smart key encryption key.

13. The method of claim 12 , wherein the smart key encryption key includes a key encryption key, the start address, and the end address.

14. The method of claim 10 , wherein the validating the input/output request includes determining whether the start address and the end address are valid.

15. The method of claim 14 , wherein the determining whether the start address and the end address are valid includes determining whether the start address and the end address are within a logical block address range.

16. A system comprising:

a virtual machine to transmit an input/output request to a data storage system;

a hypervisor configured to maintain a map of the virtual machine to a virtual disk, wherein the virtual disk is a slice of a persistent storage device;

a virtual machine server configured to maintain a map of the virtual disk to a start address and an end address and to update the input/output request with the start address, the end address, and a virtual disk identifier associated with the virtual machine; and

a hardware processor configured to: determine whether the start address and the end address are valid;

if the start address and the end address are valid, then process the input/output request; and transmit a response to the input/output request.

17. The system of claim 16 , wherein the virtual machine server generates a smart key encryption key, wherein the smart key encryption key includes a key encryption key, the start address, and the end address.

18. The system of claim 17 , wherein the virtual machine server stores an identifier of the key encryption key.

19. The system of claim 16 , wherein the start address and the end address are valid if the start address and the end address are within a logical block address range.

20. The system of claim 19 , wherein the virtual disk includes the logical block address range.