Secure virtualized data volumes
View Patent ↗A method of securing a virtual data volume storing data in a first virtualized computing environment including: deriving a cryptographic key for encrypting the data, the key being derived from first and second parameters; and encrypting the data, wherein the first parameter is generated for association with the virtualized data volume, and the second parameter is generated based on at least one characteristic of a second virtualized computing environment.
1. A method of securing a virtual data volume storing data in a first virtualized computing environment comprising:
deriving a cryptographic key for encrypting the data, the key being derived from first and second parameters, the first parameter being a pseudo random number generated by a virtual machine for which the virtual data volume is instantiated; and
encrypting the data,
wherein the first parameter is generated for association with the virtual data volume, the virtual data volume corresponding to at least one data storage device provided by the first virtualized computing environment, and the second parameter is generated based on at least one characteristic of a second virtualized computing environment, wherein the first virtualized computing environment is different from the second virtualized computing environment, and wherein the virtual machine and the encrypted virtual data volume are packaged into a portable virtual machine package for transfer to the second virtualized computing environment.
2. The method of claim 1 wherein the at least one characteristic is a characteristic common to the first virtualized computing environment and the second virtualized computing environment.
3. The method of claim 2 wherein the at least one characteristic is a characteristic of a hypervisor of the second virtualized computing environment.
4. The method of claim 1 wherein the at least one characteristic is a processor identifier for the second virtualized computing environment.
5. The method of claim 1 wherein the at least one characteristic is a hash value associated with the second virtualized computing environment.
6. The method of claim 1 wherein the portable virtual machine package is encrypted for the transfer.
7. A data volume security system to secure a virtual data volume storing data in a first virtualized computing environment, the system comprising:
at least one processor and memory configured to derive a cryptographic key for encrypting the data, the cryptographic key being derived from first and second parameters, the first parameter being a pseudo-random number generated by a virtual machine for which the virtual data volume is instantiated,
wherein the first parameter is generated for association with the virtual data volume, the virtual data volume corresponding to at least one data storage device provided by the first virtualized computing environment, and the second parameter is generated based on at least one characteristic of a second virtualized computing environment, wherein the first virtualized computing environment is different from the second virtualized computing environment, and wherein the virtual machine and the encrypted virtual data volume are packaged into a portable virtual machine package for transfer to the second virtualized computing environment.
8. The system of claim 7 wherein the at least one characteristic is a characteristic common to the first virtualized computing environment and the second virtualized computing environment.
9. A non-transitory computer-readable storage medium comprising computer-executable code which, when executed on a computer, causes the computer to:
derive a cryptographic key for encrypting the data, the key being derived from first and second parameters, the first parameter being a pseudo random number generated by a virtual machine for which the virtual data volume is instantiated; and
encrypt the data,
wherein the first parameter is generated for association with the virtual data volume, the virtual data volume corresponding to at least one data storage device provided by the first virtualized computing environment, and the second parameter is generated based on at least one characteristic of a second virtualized computing environment, wherein the first virtualized computing environment is different from the second virtualized computing environment, and wherein the virtual machine and the encrypted virtual data volume are packaged into a portable virtual machine package for transfer to the second virtualized computing environment.