System and method of migrating one or more storage class memories from a first information handling system to a second information handling system
A Computing environment is described to enable an information handling system (IHS) to receive a public encryption key from another IHS; and decrypt with a public encryption key one or more encrypted symmetric encryption keys, encrypted via a private encryption key, to obtain one or more symmetric encryption keys respectively associated with one or more memory address ranges. The IHS may physically receive a memory device that was utilized by the other IHS to store information in an encrypted fashion. The IHS may further decrypt, with a first encryption key of the one or more symmetric encryption keys associated with a first address range of the one or more address ranges, first encrypted data stored by the at least one non-volatile memory medium to obtain first data.
1. A computing environment, comprising:
a first information handling system, comprising:
at least one first processor; and a first memory, coupled to the at least one first processor, that stores first instructions executable by the at least one first processor;
wherein, when the first instructions are executed by the at least one first processor, the first instructions cause the first information handling system to:
establish a root of trust chain associated with the at least one first processor;
generate one or more encrypted symmetric encryption keys, including encrypting the one or more encrypted symmetric encryption keys via an asymmetric cryptographic process with a private encryption key associated with a public encryption key,
wherein the one or more encrypted symmetric encryption keys are not available outside of the root of trust chain;
receive a notification from a second information handling system indicating that the second information handling system is ready to proceed with a migration of a memory device to the second information handling system from the first information handling system, wherein the first information handling system waits for the notification for a threshold time after determining that the memory device has been physically migrated from the first information handling system,
the memory device including at least one volatile memory and at least one non-volatile memory,
wherein the memory device is utilized by the first information handling system to store information in an encrypted fashion;
in response to receiving the notification within a time that is less than the threshold time, extend the root of trust chain to the second information handling system, including providing the public encryption key and the one or more encrypted symmetric encryption keys to the second information handling system;
the second information handling system comprising: at least one second processor; and a second memory, coupled to the at least one second processor, that stores second instructions executable by the at least one second processor; wherein, when the second instructions are executed by the at least one second processor, the second instructions cause the second information handling system to:
receive, via a data link layer of an Open Systems Interconnection (OSI) model, the public encryption key and the one or more encrypted symmetric encryption keys from the first information handling system;
receive, via the data link layer of the (OSI) model, from the first information handling system, one or more memory address ranges of the memory device and respectively associated one or more encrypted symmetric encryption keys; and
decrypt, via the asymmetric cryptographic process, the one or more encrypted symmetric encryption keys to obtain one or more symmetric encryption keys respectively associated with the one or more memory address ranges, wherein the asymmetric cryptographic process utilizes the public encryption key to decrypt the one or more encrypted symmetric encryption keys to obtain one or more symmetric encryption keys;
wherein the second information handling system is configured to physically receive the memory device,
wherein the first information handling system continues to update, via an application, one or more symmetric encryption keys and their respective address ranges for other memory devices that have not been physically migrated from the first information handling system; and
wherein the second instructions further cause the second information handling system to:
decrypt, via a symmetric encryption process, first encrypted data stored by the at least one non-volatile memory to obtain first data, wherein the symmetric encryption process utilizes a first encryption key of the one or more symmetric encryption keys associated with a first address range of the one or more address ranges, wherein the first encrypted data is stored via the first address range; and
decrypt, via the symmetric encryption process, second encrypted data stored by the at least one non-volatile memory to obtain second data, wherein the symmetric encryption process utilizes a second encryption key of the one or more symmetric encryption keys associated with a second address range of the one or more address ranges, wherein the second encrypted data is stored via the second address range.
2. The computing environment of claim 1 ,
wherein the first address range of the memory device is associated with a first virtual machine, and
wherein the second address range of the memory device is associated with a second virtual machine, different from the first virtual machine.
3. The computing environment of claim 1 , wherein the memory device includes a non-volatile dual-inline memory module that includes the at least one non-volatile memory and the at least one non-volatile memory.
4. The computing environment of claim 3 , wherein the at least one non-volatile memory includes flash memory.
5. The computing environment of claim 1 , wherein the second information handling system further comprising: a baseboard management controller configured to receive the public encryption key from the first information handling system via the data link layer of the Open Systems Interconnection (OSI) model, wherein, to receive the one or more encrypted symmetric encryption keys from the first information handling system, the instructions further cause the baseboard management controller to receive the one or more encrypted symmetric encryption keys from the first information handling system via the data link layer of the OSI model.
6. The computing environment of claim 1 , wherein, to decrypt the first encrypted data stored by the at least one non-volatile memory to obtain the first data, the second instructions further cause an operating system executed by the second information handling system to decrypt, with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, the first encrypted data stored by the at least one non-volatile memory to obtain the first data.
7. The computing environment of claim 1 , wherein, to decrypt the first encrypted data stored by the at least one non-volatile memory to obtain the first data, the second instructions further cause a virtual machine executed by the second information handling system to decrypt, with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, the first encrypted data stored by the at least one non-volatile memory medium to obtain the first data.
8. A method, comprising:
establishing, by a first information handling system, a root of trust chain associated with the information handling system;
generating, by the first information handling system, one or more encrypted symmetric encryption keys, including encrypting the one or more encrypted symmetric encryption keys via an asymmetric cryptographic process with a private encryption key associated with a public encryption key,
wherein the one or more encrypted symmetric encryption keys are not available outside of the root of trust chain;
receiving, by the first information handling system, a notification from a second information handling system indicating that the second information handling system is ready to proceed with a migration of a memory device to the second information handling system from the first information handling system,
wherein the first information handling system waits for the notification for a threshold time after determining that the memory device has been physically migrated from the first information handling system,
the memory device including at least one volatile memory and at least one non-volatile memory,
wherein the memory device is utilized by the first information handling system to store information in an encrypted fashion;
in response to receiving the notification within a time that is less than the threshold time, extending, by the first information handling system, the root of trust chain to the second information handling system, including providing the public encryption key and the one or more encrypted symmetric encryption keys to the second information handling system;
receiving, via a data link layer of an Open Systems Interconnection (OSI) model by the second information handling system, the public encryption key and the one or more encrypted symmetric encryption keys from the first information handling system;
receiving, via the data link layer of the (OSI) model, by the second information handling system and from the first information handling system, one or more memory address ranges of the memory device and respectively associated one or more encrypted symmetric encryption keys;
decrypting, by the second information handling system, the one or more encrypted symmetric encryption keys, via the asymmetric cryptographic process, to obtain one or more symmetric encryption keys respectively associated with the one or more memory address ranges, wherein the asymmetric cryptographic process utilizes the public encryption key to decrypt the one or more encrypted symmetric encryption keys to obtain the one or more symmetric encryption keys;
physically receiving, by the second information handling system, the memory device,
wherein the first information handling system continues to update, via an application, one or more symmetric encryption keys and their respective address ranges for other memory devices that have not been physically migrated from the first information handling system;
decrypting, by the second information handling system, with a first encryption key of the one or more symmetric encryption keys associated with a first address range of the one or more address ranges, first encrypted data stored by the at least one non-volatile memory to obtain first data; and
decrypting, by the second information handling system, with a second encryption key of the one or more symmetric encryption keys associated with a second address range of the one or more address ranges, second encrypted data stored by the at least one non-volatile memory to obtain second data.
9. The method of claim 8 ,
wherein the first address range of the memory device is associated with a first virtual machine, and
wherein the second address range of the memory device is associated with a second virtual machine, different from the first virtual machine.
10. The method of claim 8 , wherein the memory device includes a non-volatile dual-inline memory module that includes the at least one non-volatile memory and the at least one non-volatile memory.
11. The method of claim 10 , wherein the at least one non-volatile memory includes flash memory.
12. The method of claim 8 , wherein the receiving, by the second information handling system, the public encryption key from the first information handling system includes receiving, by a baseboard management controller of the second information handling system, the public encryption key from the first information handling system via the data link layer of the Open Systems Interconnection (OSI) model.
13. The method of claim 8 , wherein the decrypting with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory to obtain the first data includes an operating system executed by the second information handling system decrypting with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory to obtain the first data.
14. The method of claim 8 , wherein the decrypting with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory medium to obtain the first data includes a virtual machine executed by the second information handling system decrypting with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory to obtain the first data.
15. A non-transitory computer-readable non-transitory memory that includes first instructions;
wherein, when the first instructions are executed by at least one first processor of a first information handling system, the first instructions cause the first information handling system to:
establish a root of trust chain associated with the at least one first processor;
generate one or more encrypted symmetric encryption keys, including encrypting the one or more encrypted symmetric encryption keys via an asymmetric cryptographic process with a private encryption key associated with a public encryption key,
wherein the one or more encrypted symmetric encryption keys are not available outside of the root of trust chain,
receive a notification from a second information handling system indicating that the second information handling system is ready to proceed with a migration of a memory device to the second information handling system from the first information handling system, wherein the first information handling system waits for the notification for a threshold time after determining that the memory device has been physically migrated from the first information handling system,
the memory device including at least one volatile memory and at least one non-volatile memory,
wherein the memory device is utilized by the first information handling system to store information in an encrypted fashion;
in response to receiving the notification within a time that is less than the threshold time, extend the root of trust chain to the second information handling system, including providing the public encryption key and the one or more encrypted symmetric encryption keys to the second information handling system;
wherein, when second instructions are executed by at least one second processor of a second information handling system, the second instructions cause the second information handling system to:
receive, via a data link layer of an Open Systems Interconnection (OSI) model, the public encryption key and the one or more encrypted symmetric encryption keys from the first information handling system;
receive, via the data link layer of the (OSI) model, from the first information handling system, one or more memory address ranges of the memory device and respectively associated one or more encrypted symmetric encryption keys; and
decrypt, via the asymmetric cryptographic process, the one or more encrypted symmetric encryption keys to obtain one or more symmetric encryption keys respectively associated with the one or more memory address ranges,
wherein the asymmetric cryptographic process utilizes the public encryption key to obtain the one or more symmetric encryption keys;
wherein the second information handling system is configured to physically receive the memory device,
wherein the first information handling system continue to update, via an application, one or more symmetric encryption keys and their respective address ranges for other memory devices that have not been physically migrated from the first information handling system; and
wherein the second instructions further cause the second information handling system to:
decrypt, with a first encryption key of the one or more symmetric encryption keys associated with a first address range of the one or more address ranges, first encrypted data stored by the at least one non-volatile memory to obtain first data; and
decrypt, with a second encryption key of the one or more symmetric encryption keys associated with a second address range of the one or more address ranges, second encrypted data stored by the at least one non-volatile memory to obtain second data.
16. The non-transitory computer-readable non-transitory memory of claim 15 , wherein the first address range of the memory device is associated with a first virtual machine, and wherein the second address range of the memory device is associated with a second virtual machine, different from the first virtual machine.
17. The non-transitory computer-readable non-transitory memory of claim 15 , wherein the memory device includes a non-volatile dual-inline memory module that includes the at least one non-volatile memory and the at least one non-volatile memory.
18. The non-transitory computer-readable non-transitory memory of claim 15 , wherein the second information handling system includes a baseboard management controller configured to receive the public encryption key from the first information handling system via the data link layer of the Open Systems Interconnection (OSI) model, wherein, to receive the public encryption key from the first information handling system, the second instructions further cause the baseboard management controller to receive the public encryption key from the first information handling system via the data link layer of the OSI model.
19. The non-transitory computer-readable non-transitory memory of claim 15 , wherein, to decrypt with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, the first encrypted data stored by the at least one non-volatile memory to obtain the first data, the second instructions further cause an operating system executed by the second information handling system to decrypt with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory to obtain the first data.
20. The non-transitory computer-readable non-transitory memory of claim 15 , wherein, to decrypt with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, the first encrypted data stored by the at least one non-volatile memory to obtain the first data, the second instructions further cause a virtual machine executed by the second information handling system to decrypt with the first encryption key of the one or more symmetric encryption keys associated with the first address range of the one or more address ranges, by the second information handling system, the first encrypted data stored by the at least one non-volatile memory to obtain the first data.