Selective Encryption System and Method for I/O Operations

• US 20080320316A1
• Filed: 09/02/2008
• Published: 12/25/2008
• Est. Priority Date: 04/26/2001
• Status: Active Grant

• Current Assignee: VMware, Inc. (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: WALDSPURGER, Carl A., ECCLESTON, Matthew
• Granted Patent: US 7,890,754 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

Claims

1. A method for classifying data stored in a storage device of a computer comprising:

compiling a database of identifiers of allocation units of general-use data, in which each allocation unit comprises a predetermined integral multiple number of minimum I/O units of the device;

automatically determining whether each of a plurality of test allocation units corresponds to general-use data by determining whether the test allocation unit corresponds to any identifier of allocation units of general-use data in the database.

2. A method as in claim 1, in which:

the database is a hash table; and

the step of compiling the database of identifiers comprises computing a hash value for a plurality of known general-use allocation units and making an entry in the hash table corresponding to the hash value.

3. A method as in claim 2, in which the known general-use allocation units include program code.

4. A method as in claim 2, in which the known general-use allocation units are portions of a plurality of known executable files.

5. A method as in claim 1, in which the device is a disk and the allocation units are disk blocks.