Multiple encryption keys for a virtual machine

• US 10,069,626 B2
• Filed: 02/23/2016
• Issued: 09/04/2018
• Est. Priority Date: 02/23/2016
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Riel, Henri Van
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US15/051,505
• Publication Number:
  US 20170244557A1
• Time in Patent Office: 924 Days
• Field of Search: 713171
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A method includes, with a computing system, exiting a context of a virtual machine, the exiting in response to a request from a guest operating system of the virtual machine to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine. The method further includes, with the computing system, loading the second encryption key identifier into a virtual machine control module of a virtual processor of the virtual machine and after loading the second encryption key identifier, entering the context of the virtual machine.

Claims

1. A method comprising:

with a computing system, exiting a context of a virtual machine, the exiting in response to a request to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine;

with the computing system, loading the second encryption key identifier into a virtual machine control module associated with the virtual machine; and

with the computing system, after loading the second encryption key identifier, entering the context of the virtual machine.

2. The method of claim 1, wherein the loading is in response to determining that the second encryption key identifier is valid for the virtual machine.

3. The method of claim 1, further comprising, denying the request in response to determining that second encryption key identifier is not valid for the virtual machine.

4. The method of claim 1, further comprising, with the computing system, associating a virtual processor of the virtual machine with an encryption key identifier, and only running applications associated with the encryption key identifier on the virtual processor.

5. The method of claim 1, further comprising:

with a guest operating system of the virtual machine, switching from a first application to a second application; and

in response to determining that there is no encryption key identifier associated with the second application, maintaining within a virtual machine control module, an encryption key associated with the first application.

6. The method of claim 1, wherein the first encryption key identifier is associated with a first application set and the second encryption key identifier is associated with a second application set, the request being in response to the virtual machine switching from an application from the first application set to an application from the second application set.

7. The method of claim 6, wherein the first application set comprises a nested virtual machine.

8. The method of claim 1, further comprising, to create a new application set, with a guest operating system of the virtual machine, requesting a new encryption key identifier for the new application set.

9. The method of claim 8, wherein the requesting is made to an encryption module of the computing system, the encryption module configured to maintain encryption keys associated with encryption key identifiers.

10. The method of claim 9, further comprising receiving the new encryption key identifier from the encryption module and providing the new encryption key identifier to the guest operating system.

12. The method of claim 1, further comprising, with the computing system, verifying that the second encryption key identifier is valid for the virtual machine.

13. The method of claim 12, further comprising, with the computing system, replacing the first encryption key identifier with the second encryption key identifier within a virtual machine control module of the virtual processor.

14. The method of claim 13, further comprising, with the computing system, reentering the context of the virtual machine.

11. A method comprising,

with a guest operating system, switching from a first application of a first application set to a second application of a second application set, the first application set being associated with a first encryption key identifier and the second application set being associated with a second encryption key identifier;

with the guest operating system, sending a request to a hypervisor managing a virtual machine that supports the guest operating system, the request being to switch from the first encryption key identifier to the second encryption key identifier for a virtual processor;

with a computing system that supports the virtual machine, exiting a context of the virtual machine and entering a context of the hypervisor in response to the request; and

with the guest operating system, after receiving notification that the second encryption key identifier has been loaded, executing the second application.

15. The method of claim 11, further comprising, with the hypervisor:

receiving a request from the guest operating system for a new encryption key identifier;

instructing an encryption module to generate a new encryption key identifier;

receiving the new encryption key identifier from the encryption module; and

storing the new encryption key identifier such that the new encryption key identifiers associated with the guest operating system.

16. The method of claim 15, further comprising, with the hypervisor, providing the new encryption key identifier to the guest operating system.

17. A method comprising:

with a hypervisor, receiving a request from a guest operating system of the virtual machine supported by the hypervisor, the request being to switch an encryption key identifier in a virtual machine control module for the machine from a first encryption key identifier to a second encryption key identifier;

with the hypervisor, after a context switch from the guest operating system to the hypervisor, switching the encryption key identifier in the virtual machine control module of a virtual processor from the first encryption key identifier to the second encryption key identifier, both the first encryption key identifier and the second encryption key identifier being valid for the virtual machine; and

causing the host computing system that supports the virtual machine to enter a context of the virtual machine.

18. The method of claim 17, wherein the first encryption key identifier is associated with a first application set and the second encryption key identifier is associated with a second application set.

19. The method of claim 18, wherein the encryption key identifier identifies an encryption key stored within a secure encryption module, the encryption key being inaccessible to a host system that supports the virtual machine.