Multicast live migration for encrypted virtual machines
A method includes receiving a request to migrate a virtual machine executing on a source host computer system to a first destination host computer system. The method further includes receiving, from the virtual machine executing on the source host computer system, an encryption key specific to the virtual machine. One or more memory pages associated with the virtual machine are encrypted using the encryption key specific to the virtual machine. The method further includes causing the one or more memory pages associated with the virtual machine to be copied to the first destination host computer system.
1. A method comprising:
receiving, by a processing device of a source host computer system, a request to migrate a virtual machine (VM) running on the source host computer system to a first destination host computer system;
receiving, by the processing device, from the VM, an encryption key associated with the VM;
decrypting, using an encryption key associated with the source host computer system, one or more memory pages associated with the VM, wherein the encryption key associated with the source host computer system is derived from an address of a memory page of the one or more memory pages;
encrypting, using the encryption key associated with the VM, the one or more memory pages; and
causing the one or more memory pages to be copied to the first destination host computer system.
2. The method of claim 1 , further comprising:
receiving a request to migrate the VM from the source host computer system to a second destination host computer system; and
causing the one or more memory pages to be copied to the second destination host computer system while the one or more memory pages are copied to the first destination host computer system.
3. The method of claim 1 , wherein the encryption key is isolated from a hypervisor managing the VM on the source host computer system.
4. The method of claim 1 , wherein the encryption key is derived from a feature that is specific to the VM.
5. The method of claim 1 , wherein the encryption key associated with the source host computer system is derived from a memory address of the source host computer system associated with the one or more memory pages of the VM.
6. The method of claim 1 , further comprising:
receiving a request to initialize the VM on the destination host computer system; and injecting, into the VM on the destination host computer system, the encryption key associated with the VM.
7. The method of claim 1 , further comprising:
generating a snapshot of the VM running on the source host computer system, by storing, in a non-volatile storage, the one or more memory pages associated with the VM that are encrypted using the encryption key associated with the VM.
8. A system comprising:
a memory component; and
a processing device of a destination host computer system, the processing device to:
detect that an encryption key associated with a virtual machine (VM) that is being migrated from a source host computer system to the destination host computer system is provided by the VM to an encryption engine running at the source host computer system;
receive, from the source host computer system, one or more memory pages associated with a virtual machine (VM);
decrypt, using the encryption key provided by the VM to the encryption engine, the one or more memory pages associated with the VM;
encrypt, using an encryption key associated with the destination host computer system, the one or more memory pages associated with the VM, wherein the encryption key associated with the destination host computer system is derived from a memory address of the destination host computer system associated with the one or more memory pages of the VM;
store the one or more memory pages at the memory component; and
execute the VM on the destination host computer system.
9. The system of claim 8 , wherein the encryption key is isolated from a hypervisor managing the VM on the destination host computer system.
10. The system of claim 8 , wherein the encryption key is derived from a feature that is specific to the VM.
11. The system of claim 8 , wherein the encryption key associated with the destination host computer system is a hardware-generated token.
12. The system of claim 8 , wherein the processing device is further to:
receive, from the source host computer system, a snapshot of the VM executing on the source host computer system, wherein the snapshot comprises one or more memory pages associated with the VM that are encrypted using the encryption key;
decrypt the one or more memory pages using the encryption key; and
initialize the VM to execute on the destination host computer system.
13. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method comprising:
receiving a request to migrate a virtual machine (VM) running on a source host computer system to a first destination host computer system;
receiving, from the VM, an encryption key associated with the VM;
decrypting, using an encryption key associated with the source host computer system, one or more memory pages associated with the VM, wherein the encryption key associated with the source host computer system is derived from an address of a memory page of the one or more memory pages;
encrypting, using the encryption key associated with the VM, the one or more memory pages; and
causing the one or more memory pages to be copied to the first destination host computer system.
14. The non-transitory computer readable storage medium of claim 13 , wherein the processing device is further to perform:
receiving a request to migrate the VM from the source host computer system to a second destination host computer system; and
causing the one or more memory pages to be copied to the second destination host computer system while the one or more memory pages are copied to the first destination host computer system.
15. The non-transitory computer readable storage medium of claim 13 , wherein the encryption key is isolated from a hypervisor managing the VM on the source host computer system.
16. The non-transitory computer readable storage medium of claim 13 , wherein the encryption key is derived from a feature that is specific to the VM.
17. The non-transitory computer readable storage medium of claim 13 , further comprising:
generating a snapshot of the VM executing on the source host computer system, by
storing, in a non-volatile storage, the one or more memory pages associated with the VM that are encrypted using the encryption key associated with the VM.