Protecting virtual machine data in cloud environments
Disclosed are methods and systems that include receiving updated operating system information, encrypting the updated operating system information, and updating a map file. The updated operating system information is received at an encryption virtual machine. The encrypting the updated operating system information results in the encrypted updated operating system information. The encrypting the updated operating system information is managed by the encryption virtual machine. The updated operating system information is encrypted in response to receipt of the updated operating system information. The updated operating system information is encrypted using an encryption key. In certain embodiments, the updating includes storing operating system metadata in the map file (where the operating system metadata is associated with the encrypted updated operating system information) and storing the encryption key in the map file (where the storing the encryption key in the map file associates the encryption key with the operating system metadata).
1. A computer-implemented method comprising:
receiving updated operating system information at a storage server resident in an encryption virtual machine, wherein
the updated operating system information is received from a storage client that receives the updated operating system information from a virtual machine,
the storage client is resident in a first virtual disk of the virtual machine, and
the updated operating system information comprises an update to operating system information stored as encrypted operating system information stored in a storage volume of one or more storage volumes of a second virtual disk;
encrypting the updated operating system information, wherein
the encrypting the updated operating system information results in encrypted updated operating system information,
the encrypting the updated operating system information is managed by the encryption virtual machine,
the updated operating system information is encrypted in response to receipt of the updated operating system information, and
the updated operating system information is encrypted using an encryption key;
storing the encrypted updated operating system information in at least one storage volume of the one or more storage volumes, wherein
the storing is performed by the encryption virtual machine; and
updating a map file, wherein
the updating the map file associates the encrypted updated operating system information with the virtual machine.
2. The computer-implemented method of claim 1 , wherein the updating the map file comprises:
storing operating system metadata in the map file, wherein
the operating system metadata is associated with the encrypted updated operating system information; and
storing the encryption key in the map file, wherein
the storing the encryption key in the map file associates the encryption key with the operating system metadata.
3. The computer-implemented method of claim 2 , further comprising:
receiving updated application data, wherein
the updated application data is received at the encryption virtual machine; and
encrypting the updated application data, wherein
the encrypting the updated application data results in encrypted updated application data,
the encrypting the updated application data is managed by the encryption virtual machine,
the operating system metadata identifies a location at which the encrypted updated application data is to be stored,
the location is a location in a storage volume,
the storing stores the encrypted updated application data at the location in the storage volume, and
the encryption virtual machine and the storage volume are communicatively coupled to one another.
4. The computer-implemented method of claim 3 , further comprising:
storing the encrypted updated application data, wherein
the location is a location of a file in a storage volume,
the file is a virtual machine disk file,
the encrypted updated operating system information and the encrypted updated application data are stored in the virtual machine disk file, and
the encryption virtual machine and the storage volume are communicatively coupled to one another.
5. The computer-implemented method of claim 3 , wherein
the encrypted updated application data and the encrypted updated operating system information are associated with one another by virtue of
the updated application data being associated with an application executed in an operating system of an application virtual machine, and
the updated operating system information being associated with the application virtual machine.
6. The computer-implemented method of claim 3 , wherein
the updated application data is encrypted using the encryption key.
7. The computer-implemented method of claim 3 , wherein
the updated operating system information is received in response to operating system information being updated, and
the updated application data is encrypted in response to receipt of the updated application data.
8. The computer-implemented method of claim 3 , further comprising:
sending a request for the updated application data, wherein
the updated application data is associated with an application executed in an operating system executed by an application virtual machine,
the operating system is loaded into the application virtual machine by a loader, and
the request is sent by the encryption virtual machine.
9. The computer-implemented method of claim 3 , further comprising:
storing the encrypted updated operating system information and the encrypted updated application data in a storage volume, wherein
the encryption virtual machine and the storage volume are communicatively coupled to one another.
10. The computer-implemented method of claim 2 , wherein
the updated operating system information comprises one or more operating system modules of an operating system of an application virtual machine, and
the operating system metadata comprises information for booting the operating system in the application virtual machine.
11. The computer-implemented method of claim 2 , further comprising:
determining that operating system information has been updated, wherein
the operating system information being updated results in the updated operating system information being received by the encryption virtual machine; and
determining that application data has been updated, wherein
the application data being updated results in the updated application data being received by the encryption virtual machine.
12. The computer-implemented method of claim 2 , further comprising:
sending a request for the updated operating system information, wherein
the updated operating system information is associated with an operating system executed by an application virtual machine,
the operating system is loaded into the application virtual machine by a loader,
the request is sent by the encryption virtual machine, and
the encryption virtual machine sends the request to the loader.
13. The computer-implemented method of claim 1 , wherein
the virtual machine is one or a plurality of virtual machines,
each of a plurality of virtual disks is associated with each of the virtual machines,
the storage client is one or a plurality of storage clients, and
each of the plurality of storage clients is resident in a corresponding one of the plurality of virtual disks.
14. A computer program product comprising:
a plurality of instructions, comprising
a first set of instructions, executable by a processor of a computer system, configured to receive updated operating system information at a storage server resident in an encryption virtual machine, wherein
the updated operating system information is received from a storage client that receives the updated operating system information from a virtual machine,
the storage client is resident in a first virtual disk of the virtual machine, and
the updated operating system information comprises an update to operating system information stored as encrypted operating system information stored in a storage volume of one or more storage volumes of a second virtual disk,
a second set of instructions, executable by the processor, configured to encrypt the updated operating system information, wherein
the second set of instructions result in encrypted updated operating system information,
the encryption virtual machine manages encryption of the updated operating system information,
the updated operating system information is encrypted in response to receipt of the updated operating system information, and
the updated operating system information is encrypted using an encryption key,
a third set of instructions, executable by the processor, configured to store the encrypted updated operating system information in at least one storage volume of the one or more storage volumes, wherein
the third set of instructions are performed by the encryption virtual machine, and
a fourth set of instructions, executable by the processor, configured to update a map file, wherein
the map file associates the encrypted updated operating system information with the virtual machine; and
a non-transitory computer-readable storage medium, wherein the instructions are encoded in the non-transitory computer-readable storage medium.
15. The computer program product of claim 14 , wherein the fourth set of instructions comprises:
a first subset of instructions, executable by the processor, configured to store operating system metadata in the map file, wherein
the operating system metadata is associated with the encrypted updated operating system information; and
a second subset of instructions, executable by the processor, configured to store the encryption key in the map file, wherein
the second subset of instructions associates the encryption key with the operating system metadata.
16. The computer program product of claim 15 , wherein the instructions further comprise:
a fourth set of instructions, executable by the processor, configured to receive updated application data, wherein
the updated application data is received at the encryption virtual machine; and
a fifth set of instructions, executable by the processor, configured to encrypt the updated application data, wherein
the fifth set of instructions result in encrypted updated application data,
the encryption virtual machine manages encryption of the updated application data,
the operating system metadata identifies a location at which the encrypted updated application data is to be stored,
the location is a location in a storage volume,
the fifth set of instructions stores the encrypted updated application data at the location in the storage volume, and
the encryption virtual machine and the storage volume are communicatively coupled to one another.
17. The computer program product of claim 16 , wherein the instructions further comprise:
a sixth set of instructions, executable by the processor, configured to store the encrypted updated application data, wherein
the location is a location of a file in a storage volume communicatively coupled to the computer system,
the file is a virtual machine disk file,
the encrypted updated operating system information and the encrypted updated application data are stored in the virtual machine disk file, and
the encryption virtual machine and the storage volume are communicatively coupled to one another.
18. The computer program product of claim 16 , wherein
the encrypted updated application data and the encrypted updated operating system information are associated with one another by virtue of
the updated application data being associated with an application executed in an operating system of an application virtual machine, and
the updated operating system information being associated with the application virtual machine.
19. The computer program product of claim 16 , wherein the instructions further comprise:
a sixth set of instructions, executable by the processor, configured to store the encrypted updated operating system information and the encrypted updated application data in a storage volume, wherein
the encryption virtual machine and the storage volume are communicatively coupled to one another.
20. The computer program product of claim 15 , wherein
the updated operating system information comprises one or more operating system modules of an operating system of an application virtual machine, and
the operating system metadata comprises information for booting the operating system in the application virtual machine.
21. A computer system comprising:
one or more hardware processors;
a computer-readable storage medium coupled to the one or more hardware processors; and
a plurality of instructions, encoded in the computer-readable storage medium and configured to cause the one or more hardware processors to
receive updated operating system information at a storage server resident in an encryption virtual machine, wherein
the updated operating system information is received from a storage client that receives the updated operating system information from a virtual machine,
the storage client is resident in a first virtual disk of the virtual machine, and
the updated operating system information comprises an update to operating system information stored as encrypted operating system information stored in a storage volume of one or more storage volumes of a second virtual disk,
encrypt the updated operating system information, wherein
the instructions configured to cause the one or more hardware processors to encrypt result in encrypted updated operating system information,
the encryption virtual machine manages encryption of the updated operating system information,
the updated operating system information is encrypted in response to receipt of the updated operating system information, and
the updated operating system information is encrypted using an encryption key,
store the encrypted updated operating system information in at least one storage volume of the one or more storage volumes, wherein
the storing is performed by the encryption virtual machine, and
update a map file, wherein
the instructions configured to cause the one or more hardware processors to update the map file associate the encrypted updated operating system information with the virtual machine.