System and method for supporting full volume encryption devices in a client hosted virtualization system

1. A client hosted virtualization system (CHVS) comprising:

a full volume encryption (FVE) storage device;

a processor operable to execute code; and

a non-volatile memory including first code to implement a basic input/output system to initialize the CHVS, and second code to implement a virtualization manager operable to:

initialize the CHVS;

authenticate a first virtual machine image associated with a first virtual machine;

launch the first virtual machine on the CHVS based on the first virtual machine image;

receive a first transaction from the first virtual machine, a target of the first transaction being the FVE storage device;

send the first transaction to the FVE storage device;

receive a first response to the first transaction from the FVE storage device; and

send the first response to the first virtual machine;

wherein the CHVS is configurable in a first configuration to execute the first code and not the second code, and is configurable in a second configuration to execute the second code and not the first code.

2. The CHVS of claim 1 , further comprising a mass storage device, and wherein the first virtual machine image:

is stored on the mass storage device; and

includes an operating system and an application.

3. The CHVS of claim 1 , further comprising:

a general purpose encryption (GPE) engine;

wherein in sending the first transaction to the FVE storage device, the virtualization manager is further operable to send the first transaction to the GPE engine.

4. The CHVS of claim 3 , wherein:

the first transaction is a write transaction; and

in sending the first transaction to the GPE engine, the virtualization manager is further operable to direct the GPE engine to encrypt information associated with the first transaction, and to store the information on the FVE storage device.

5. The CHVS of claim 3 , wherein:

the first transaction is a read transaction;

in sending the first transaction to the GPE engine, the virtualization manager is further operable to direct the GPE retrieve information associated with the first transaction from the FVE storage device; and

in receiving the first response to the first transaction from the FVE storage device engine, the virtualization manager is further operable to direct the GPE engine to decrypt the information.

6. The CHVS of claim 1 , wherein the virtualization manager is further operable to:

authenticate a second virtual machine image associated with a second virtual machine;

launch the second virtual machine on the CHVS based on the second virtual machine image;

receive a second transaction from the second virtual machine, a target of the second transaction being the FVE storage device;

send the second transaction to the FVE storage device;

receive a second response to the first transaction from the FVE storage device; and

send the second response to the second virtual machine.

7. The CHVS of claim 6 , further comprising:

an unencrypted storage device;

wherein the virtualization manager is further operable to:

receive a third transaction from the first virtual machine, a target of the third transaction being the unencrypted storage device;

send the third transaction to the unencrypted storage device;

receive a third response to the third transaction from the unencrypted storage device; and

send the third response to the first virtual machine.

8. The CHVS of claim 7 , wherein the virtualization manager is further operable to:

receive a fourth transaction from the second virtual machine, a target of the fourth transaction being the unencrypted storage device;

send the fourth transaction to the unencrypted storage device;

receive a fourth response to the fourth transaction from the unencrypted storage device; and

send the fourth response to the second virtual machine.

9. A method of providing a client hosted virtualization system (CHVS) comprising:

storing first code in a non-volatile memory of the CHVS to implement a basic input/output system to initialize the CHVS;

storing second code in the non-volatile memory, the second code being operable to:

initialize the CHVS;

authenticate a first virtual machine image associated with a first virtual machine;

launch the first virtual machine on the CHVS based on the first virtual machine image;

receive a first transaction from the first virtual machine, a target of the first transaction being a full volume encryption (FVE) storage device of the CHVS;

send the first transaction to the FVE storage device;

receive a first response to the first transaction from the FVE storage device; and

send the first response to the first virtual machine;

determining to execute the first code to the exclusion of the second code;

in response to determining to execute the first code, executing the first code;

determining to execute the second code to the exclusion of the first code; and

in response to determining to execute the second code, executing the second code.

10. The method of claim 9 , wherein the first virtual machine image includes an operating system and an application.

11. The method of claim 9 , wherein in sending the first transaction to the FVE storage device, the second code is further operable to send the first transaction to a general purpose encryption (GPE) engine of the CHVS.

12. The method of claim 11 , wherein:

the first transaction is a write transaction; and

in sending the first transaction to the GPE engine, the second code is further operable to:

direct the GPE engine to encrypt information associated with the first transaction; and

store the information on the FVE storage device.

13. The method of claim 11 , wherein:

the first transaction is a read transaction;

in sending the first transaction to the GPE engine, the second code is further operable to direct the GPE retrieve information associated with the first transaction from the FVE storage device; and

in receiving the first response to the first transaction from the FVE storage device engine, the second code is further operable to direct the GPE engine to decrypt the information.

14. The method of claim 9 , the second code being further operable to:

authenticate a second virtual machine image associated with a second virtual machine;

launch the second virtual machine on the CHVS based on the second virtual machine image;

receive a second transaction from the second virtual machine, a target of the second transaction being the FVE storage device;

send the second transaction to the FVE storage device;

receive a second response to the second transaction from the FVE storage device; and

send the second response to the second virtual machine.

15. The method of claim 14 , the second code being further operable to:

receive a third transaction from the first virtual machine, a target of the third transaction being an unencrypted storage device of the CHVS;

send the third transaction to the unencrypted storage device;

receive a third response to the third transaction from the unencrypted storage device; and

send the third response to the first virtual machine.

16. The method of claim 15 , the second code being further operable to:

receive a fourth transaction from the second virtual machine, a target of the fourth transaction being an unencrypted storage device of the CHVS;

send the fourth transaction to the unencrypted storage device;

receive a fourth response to the fourth transaction from the unencrypted storage device; and

send the fourth response to the second virtual machine.

17. Machine-executable code for an information handling system (IHS), wherein the machine-executable code is embedded within a non-transitory medium and includes instructions for carrying out a method, the method comprising:

storing first code in a non-volatile memory of the IHS to implement a basic input/output system to initialize the IHS;

storing second code in the non-volatile memory, the second code being operable to:

initialize the IHS;

authenticate a first virtual machine image associated with a first virtual machine, the first virtual machine image including a first operating system and a first application;

launch the first virtual machine on the IHS based on the first virtual machine image;

receive a first transaction from the first virtual machine, a target of the first transaction being a full volume encryption (FVE) storage device of the client hosted virtualization system;

send the first transaction to the FVE storage device;

receive a first response to the first transaction from the FVE storage device; and

send the first response to the first virtual machine;

determining to execute the first code to the exclusion of the second code;

in response to determining to execute the first code, executing the first code;

determining to execute the second code to the exclusion of the first code; and

in response to determining to execute the second code, executing the second code.

18. The machine-executable code of claim 17 , wherein:

the first transaction is a write transaction;

in sending the first transaction to the FVE storage device, the second code is further operable to send the first transaction to a GPE engine of the client hosted virtualization system; and

in sending the first transaction to the GPE engine, the second code is further operable to:

direct the GPE engine to encrypt information associated with the first transaction; and

store the information on the FVE storage device.

19. The machine-executable code of claim 17 , wherein:

the first transaction is a read transaction;

in sending the first transaction to the FVE storage device, the second code is further operable to:

send the first transaction to a GPE engine of the client hosted virtualization system; and

direct the GPE retrieve information associated with the first transaction from the FVE storage device; and

in receiving the first response to the first transaction from the FVE storage device engine, the second code is further operable to direct the GPE engine to decrypt the information.

20. The machine-executable code of claim 17 , the second code being further operable to:

authenticate a second virtual machine image associated with a second virtual machine;

launch the second virtual machine on the client hosted virtualization system based on the second virtual machine image;

receive a second transaction from the second virtual machine, a target of the second transaction being the FVE storage device;

send the second transaction to the FVE storage device;

receive a second response to the second transaction from the FVE storage device; and

send the second response to the second virtual machine.