Asynchronous encryption and decryption of virtual machine memory for live migration
Examples perform asynchronous encrypted live migration of virtual machines (VM) from a source host to a destination host. The encryption of the memory blocks of the VM is performed optionally before a request for live migration is received or after said request. The more resource intensive decryption of the memory blocks of the VM is performed by the destination host in a resource efficient manner, reducing the downtime apparent to users. Some examples contemplate decrypting memory blocks of the transmitted VM on-demand and opportunistically, according to a pre-determined rate, or in accordance with parameters established by a user.
1. A system comprising:
a memory area associated with a computing device, said memory area storing memory blocks; and
a processor programmed to:
encrypt, at a first host, one or more memory blocks associated with a source virtual machine (VM);
transfer the one or more encrypted memory blocks to one or more second hosts; and
decrypt, at the one or more second hosts, only those memory blocks of the one or more encrypted memory blocks needed to execute a destination VM at the one or more second hosts.
2. The system of claim 1 , wherein the processor is programmed to:
receive a request associated with one or more first memory blocks of the one or more encrypted memory blocks; and
selectively decrypt, at the one or more second hosts, the one or more first memory blocks after receiving the request during a first phase of a plurality of phases.
3. The system of claim 2 , wherein the processor is programmed to decrypt, at the one or more second hosts, one or more second memory blocks of the one or more encrypted memory blocks at a predetermined rate during a second phase of the plurality of phases.
4. The system of claim 1 , wherein the processor is further programmed to decrypt, at the one or more second hosts, remaining encrypted memory blocks of the one or more encrypted memory blocks on-demand or opportunistically after completion of the decryption of the memory blocks needed to execute the destination VM at one or more second hosts.
5. The system of claim 1 , wherein the processor is programmed to:
identify one or more first memory blocks of the one or more memory blocks associated with a first priority of a plurality of priorities;
identify one or more second memory blocks of the one or more memory blocks associated with a second priority of the plurality of priorities;
wherein the first priority is different from the second priority;
decrypt, at the one or more second hosts, the one or more first memory blocks associated with the first priority before the one or more second memory blocks associated with the second priority are decrypted.
6. The system of claim 1 , wherein the processor is programmed to:
associate the one or more memory blocks with a flag after encrypting the one or more memory blocks; and
disassociate the one or more memory blocks from the flag after decrypting the one or more encrypted memory blocks.
7. The system of claim 1 , wherein the processor is further programmed to:
determine whether one or more first memory blocks of the one or more memory blocks are encrypted with a first parameter; and
when the one or more first memory blocks are determined to be encrypted with the first parameter, encrypt, at the first host, the one or more first encrypted memory blocks with a second parameter.
8. The system of claim 1 , wherein the processor is further programmed to:
calculate one or more hashes of the memory blocks;
encrypt the one or more calculated hashes;
transfer the one or more encrypted hashes to one or more destination hosts; and
decrypt the one or more hashes at the one or more destination hosts.
9. A method for encrypting memory blocks, said method comprising:
encrypting one or more memory blocks associated with a source host with a first parameter;
transferring the one or more encrypted memory blocks to one or more destination hosts; and
decrypting only those memory blocks of the one or more encrypted memory blocks that are required to perform a checkpoint restore operation of a source virtual machine at the one or more destination hosts.
10. The method of claim 9 , further comprising:
identifying one or more first memory blocks of the one or more memory blocks associated with a first priority of a plurality of priorities;
identifying one or more second memory blocks of the one or more memory blocks associated with a second priority of the plurality of priorities, wherein the first priority is different from the second priority, wherein decrypting the one or more encrypted memory blocks comprises decrypting the one or more first memory blocks associated with the first priority, and decrypting the one or more second memory blocks associated with the second priority after the one or more first memory blocks are decrypted.
11. The method of claim 9 , further comprising identifying a pattern associated with the encryption of the one or more memory blocks, wherein decrypting the one or more encrypted memory blocks comprises decrypting the one or more encrypted memory blocks based on the pattern.
12. The method of claim 9 , further comprising determining whether one or more first memory blocks of the one or more memory blocks are encrypted with a second parameter, wherein encrypting one or more memory blocks comprises, when the one or more first memory blocks are determined to be encrypted with the second parameter, encrypting the one or more first encrypted memory blocks with the first parameter, such that the encryption with the first parameter and the encryption with the second parameter are nested.
13. The method of claim 9 , further comprising receiving a request associated with one or more first memory blocks of the one or more encrypted memory blocks, wherein decrypting the one or more encrypted memory blocks comprises selectively decrypting the one or more first memory blocks after receiving the request during a first phase of a plurality of phases.
14. The method of claim 13 , wherein decrypting the one or more encrypted memory blocks comprises decrypting one or more second memory blocks of the one or more encrypted memory blocks at a predetermined rate during a second phase of the plurality of phases.
15. The method of claim 9 , wherein transferring the one or more memory blocks further comprises:
optionally downgrading locks on one or more disks of a source host from an exclusive mode to a non-exclusive mode, wherein a destination hosts opens the disks in non-exclusive mode while the source host is executing;
suspending execution of the source host; transferring virtual memory of the source host to the destination host, wherein the destination host begins execution after restoration of the virtual memory at the destination host; and
optionally closing the disks on the source host, wherein the destination host upgrades the locks from the non-exclusive mode to the exclusive mode.
16. The method of claim 9 , wherein performing a checkpoint restore operation of a source virtual machine at the one or more destination hosts comprises restoring a virtual device state of the source host at the one or more destination hosts.
17. One or more non-transitory computer-readable storage media including computer-executable instructions that, when executed, cause at least one processor to:
encrypt, at a first host, one or more memory blocks associated with a first parameter;
transfer the one or more encrypted memory blocks to one or more destination hosts; and
decrypt, at one or more second hosts, only those memory blocks of the one or more encrypted memory blocks that are required to perform a checkpoint restore operation of a source virtual machine at the one or more second hosts.
18. The one or more non-transitory computer-readable storage media of claim 17 , wherein the computer-executable instructions, when executed, cause at least one processor to:
receive a request associated with one or more first memory blocks of the one or more encrypted memory blocks;
selectively decrypt, at the one or more second hosts, the one or more first memory blocks after receiving the request during a first phase of a plurality of phases; and
decrypt, at the one or more second hosts, one or more second memory blocks of the one or more encrypted memory blocks at a predetermined rate during a second phase of the plurality of phases.
19. The one or more non-transitory computer-readable storage media of claim 17 , wherein the computer-executable instructions, when executed, cause at least one processor to:
identify one or more first memory blocks of the one or more memory blocks associated with a first priority of a plurality of priorities;
identify one or more second memory blocks of the one or more memory blocks associated with a second priority of the plurality of priorities;
wherein the first priority is different from the second priority; and
decrypt, at the one or more second hosts, the one or more first memory blocks associated with the first priority before the one or more second memory blocks associated with the second priority are decrypted.
20. The one or more non-transitory computer-readable storage media of claim 17 , wherein the computer-executable instructions, when executed, cause at least one processor to:
determine whether one or more first memory blocks of the one or more memory blocks are encrypted with a second parameter before the one or more first memory blocks are encrypted with the first parameter; and
when the one or more first memory blocks are determined to be encrypted with the second parameter, encrypt the one or more first encrypted memory blocks with the first parameter, such that the encryption with the first parameter and the encryption with the second parameter are nested.