Online disk encryption using mirror driver
Provided are techniques for encrypting a virtual disk of a virtual computing instance (VCI) while the VCI is online and still running using a mirror driver. In certain aspects a mirror driver is a filter running in an I/O stack used for accessing a virtual disk, such that the mirror driver receives I/Os destined to the virtual disk and mirrors those I/Os to the virtual disk and one or more additional virtual disks. The mirror driver begins copying data from an unencrypted source virtual disk to a destination virtual disk, and the data is encrypted as it is stored in the destination virtual disk, while the VCI is still online. During the copying, as new writes are issued to the unencrypted source virtual disk from the VCI, the mirror driver mirrors the writes to both the unencrypted source virtual disk and the destination virtual disk.
1. A method for encrypting an unencrypted source virtual disk of a virtual computing instance (VCI), the method comprising:
copying and encrypting contents of the unencrypted source virtual disk to a destination virtual disk; and
during the copying and encrypting:
mirroring write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
executing the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
executing the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk,
wherein the unencrypted source virtual disk is implemented as one or more snapshots and an active delta virtual disk file,
wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
determining the one or more snapshots exist as one or more inactive delta virtual disk files representing the one or more snapshots of the unencrypted source virtual disk;
copying and encrypting contents of the one or more inactive delta virtual disk files to the destination virtual disk;
copying and encrypting contents of the active delta virtual disk file to an active destination virtual disk file of the destination virtual disk;
associating the encrypted contents of the active delta virtual disk file and the encrypted contents of the one or more inactive delta virtual disk files with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
2. The method of claim 1 , wherein the copying and encrypting is performed while the VCI is online.
3. The method of claim 1 , further comprising installing a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
4. The method of claim 3 , further comprising removing the mirror driver after the copying and encrypting is complete.
5. The method of claim 4 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.
6. A non-transitory computer-readable storage medium containing a program which, when executed by one or more processors, performs operations for encrypting an unencrypted source virtual disk of a virtual computing instance (VCI), the operations comprising:
copying and encrypting contents of the unencrypted source virtual disk to a destination virtual disk; and
during the copying and encrypting:
mirroring write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
executing the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
executing the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk,
wherein the unencrypted source virtual disk is implemented as one or more snapshots and an active delta virtual disk file,
wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
determining the one or more snapshots exist as one or more inactive delta virtual disk files representing the one or more snapshots of the unencrypted source virtual disk;
copying and encrypting contents of the one or more inactive delta virtual disk files to the destination virtual disk;
copying and encrypting contents of the active delta virtual disk file to an active destination virtual disk file of the destination virtual disk;
associating the encrypted contents of the active delta virtual disk file and the encrypted contents of the one or more inactive delta virtual disk files with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
7. The non-transitory computer readable storage medium of claim 6 , wherein the copying and encrypting is performed while the VCI is online.
8. The non-transitory computer readable storage medium of claim 6 , wherein the operations further comprise installing a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
9. The non-transitory computer readable storage medium of claim 8 , wherein the operations further comprise removing the mirror driver after the copying and encrypting is complete.
10. The non-transitory computer readable storage medium of claim 9 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.
11. A system, comprising:
a processor; and
a memory, wherein the memory includes a program executable in the processor to perform operations for encrypting an unencrypted source virtual disk of a virtual computing instance (VCI), the operations comprising:
copying and encrypting contents of the unencrypted source virtual disk to a destination virtual disk; and
during the copying and encrypting:
mirroring write commands issued to the unencrypted source virtual disk to both the unencrypted source virtual disk and the destination virtual disk;
executing the mirrored write commands on the unencrypted source virtual disk by writing data corresponding to the write commands to the unencrypted source virtual disk as unencrypted data; and
executing the mirrored write commands on the destination virtual disk by encrypting data corresponding to the write commands and writing the encrypted data to the destination virtual disk,
wherein the unencrypted source virtual disk is implemented as one or more snapshots and an active delta virtual disk file,
wherein the copying and encrypting contents of the unencrypted source virtual disk to the destination virtual disk comprises:
determining the one or more snapshots exist as one or more inactive delta virtual disk files representing the one or more snapshots of the unencrypted source virtual disk;
copying and encrypting contents of the one or more inactive delta virtual disk files to the destination virtual disk;
copying and encrypting contents of the active delta virtual disk file to an active destination virtual disk file of the destination virtual disk;
associating the encrypted contents of the active delta virtual disk file and the encrypted contents of the one or more inactive delta virtual disk files with the destination virtual disk; and
subsequent to the associating the encrypted contents, configuring the virtual computing instance to use the destination virtual disk by setting metadata of the virtual computing instance.
12. The system of claim 11 , wherein the copying and encrypting is performed while the VCI is online.
13. The system of claim 11 , wherein the operations further comprise installing a mirror driver on the unencrypted source virtual disk and the destination virtual disk, wherein the mirror driver is configured to perform the mirroring.
14. The system of claim 13 , wherein the operations further comprise removing the mirror driver after the copying and encrypting is complete.
15. The system of claim 14 , wherein the VCI is stunned during installing the mirror driver and removing the mirror driver.