Securing data for dynamic environment
An information handling system may include at least one processor and a memory. The information handling system may be configured to: store a cryptographic lockbox that is secured by a set of secrets and that is accessible from a virtual machine, wherein the set of secrets comprises a first subset of one or more secrets based on a hardware environment of the information handling system and a second subset of one or more secrets based on a virtualized environment associated with the virtual machine; migrate the virtual machine to a different information handling system, wherein the migration is configured not to alter the second subset; and access the cryptographic lockbox from the migrated virtual machine.
1. An information handling system comprising:
at least one processor; and
a memory;
wherein the information handling system is configured to:
store a cryptographic lockbox that is a component of a virtual machine, wherein the cryptographic lockbox is secured by a set of secrets and is accessible from the virtual machine, and wherein the set of secrets comprises a first subset of one or more secrets based on a hardware environment of the information handling system and a second subset of one or more secrets based on a virtualized environment associated with the virtual machine, wherein the second subset is inaccessible to non-privileged users of the information handling system;
migrate the virtual machine to a different information handling system, wherein the migration is configured not to alter the second subset; and
access the cryptographic lockbox from the migrated virtual machine.
2. The information handling system of claim 1 , wherein the hardware environment comprises a hyper-converged infrastructure cluster.
3. The information handling system of claim 2 , wherein the first subset comprises a virtual object associated with the cluster.
4. The information handling system of claim 1 , wherein the second subset comprises an attribute of the virtual machine.
5. The information handling system of claim 1 , wherein the cryptographic lockbox is secured by concatenating the secrets of the first and second subsets to generate a concatenated result, deriving a cryptographic key from the concatenated result, and encrypting the cryptographic lockbox with the cryptographic key.
6. A computer-implemented method comprising:
storing a cryptographic lockbox that is a component of a virtual machine, wherein the cryptographic lockbox is secured by a set of secrets and is accessible from the virtual machine, and wherein the set of secrets comprises a first subset of one or more secrets based on a hardware environment of the information handling system and a second subset of one or more secrets based on a virtualized environment associated with the virtual machine, wherein the second subset is inaccessible to non-privileged users of the information handling system;
migrating the virtual machine to a different information handling system, wherein the migration is configured not to alter the second subset; and
accessing the cryptographic lockbox from the migrated virtual machine.
7. The method of claim 6 , wherein the hardware environment comprises a hyper-converged infrastructure cluster.
8. The method of claim 7 , wherein the first subset comprises a virtual object associated with the cluster.
9. The method of claim 6 , wherein the second subset comprises an attribute of the virtual machine.
10. The method of claim 6 , wherein the cryptographic lockbox is secured by concatenating the secrets of the first and second subsets to generate a concatenated result, deriving a cryptographic key from the concatenated result, and encrypting the cryptographic lockbox with the cryptographic key.
11. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable instructions thereon that are executable by a processor of an information handling system for:
storing a cryptographic lockbox that is a component of a virtual machine, wherein the cryptographic lockbox is secured by a set of secrets and is accessible from the virtual machine, and wherein the set of secrets comprises a first subset of one or more secrets based on a hardware environment of the information handling system and a second subset of one or more secrets based on a virtualized environment associated with the virtual machine, wherein the second subset is inaccessible to non-privileged users of the information handling system;
migrating the virtual machine to a different information handling system, wherein the migration is configured not to alter the second subset; and
accessing the cryptographic lockbox from the migrated virtual machine.
12. The article of claim 11 , wherein the hardware environment comprises a hyper-converged infrastructure cluster.
13. The article of claim 12 , wherein the first subset comprises a virtual object associated with the cluster.
14. The article of claim 11 , wherein the second subset comprises an attribute of the virtual machine.
15. The article of claim 11 , wherein the cryptographic lockbox is secured by concatenating the secrets of the first and second subsets to generate a concatenated result, deriving a cryptographic key from the concatenated result, and encrypting the cryptographic lockbox with the cryptographic key.