Systems, methods and computer readable medium to implement secured computational infrastructure for cloud and data center environments
Systems, methods, and non-transitory computer-readable medium are provided to secure data centers and cloud computing. A method receives network identifiers for functions, requests a network key for each function, allocates network interfaces, requests a virtual network interface controller allocation, requests a network key for each cloud function, receives storage identifiers for functions, requests a storage key for each cloud function, allocates virtual storage disks, requests a storage interface controller allocation, requests a storage key for each cloud function. Methods secure migration of a virtual machine from a source to a target server. A server includes multiple cores where each core is dedicated to a compute function and a unique key encrypts data of each compute function. A non-transitory computer-readable medium encodes programs that execute the above methods.
1. A method of computer security executed on one or more servers of a cloud or data center provider, comprising:
receiving a network identifier for a plurality of functions from a cloud or data center manager;
requesting a network key for each function from key server(s) or from a local key generator based on one or multiple secrets;
allocating a plurality of isolated network interfaces based on a cloud or data center provider's and/or a customer's requirements;
requesting a virtual network interface controller allocation per function per virtual machine;
requesting from the key server a network key for each cloud or data center function;
receiving a storage identifier for a plurality of functions from a cloud or data center manager;
requesting a storage key for each function from key server(s) or from a local key generator based on one or multiple secrets;
allocating a plurality of isolated virtual storage disks based on cloud or data center provider and/or customer requirements;
requesting a storage controller allocation per function per virtual machine;
requesting from the key server a storage key(s) for each cloud or data center function; and
encrypting each function with either the network key or the storage key.
2. The method of claim 1 , wherein the network key(s) are obtained from key server(s) and/or from a local key generator based on one or multiple secrets from cloud or data center provider and/or customer.
3. The method of claim 1 , wherein the storage key(s) are obtained from key server(s) and/or from a local key generator based on one or multiple secrets from cloud or data center provider and/or customer.
4. The method of claim 1 , wherein each network key and each storage key is retrieved from a key management server that resides on premises only accessible to a customer of the cloud or data center provider.
5. The method of claim 1 , wherein each network key and each storage key is retrieved from a key management server that resides on one or more servers.
6. The method of claim 1 , wherein the network key is retrieved from a key management server that resides on customer premises for customer storage and connectivity.
7. The method of claim 5 , wherein the network key is retrieved from a key management server that resides on customer premises for customer storage and connectivity.