Migration of full-disk encrypted virtualized storage between blade servers

• US 20090169020A1
• Filed: 12/30/2008
• Published: 07/02/2009
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zimmer, Vincent J., Sakthikumar, Palsamy
• Granted Patent: US 9,047,468 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 11/203 using migration
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

A method, system and computer-readable storage medium with instructions to migrate full-disk encrypted virtual storage between blade servers. A key is obtained to perform an operation on a first blade server. The key is obtained from a virtual security hardware instance and provided to the first blade server via a secure out-of-band communication channel. The key is migrated from the first blade server to a second blade server. The key is used to perform hardware encryption of data stored on the first blade server. The data are migrated to the second blade server without decrypting the data at the first blade server, and the second blade server uses the key to access the data. Other embodiments are described and claimed.

Claims

1. A method comprising:

obtaining a key to perform an operation on a first blade server of a plurality of blade servers from a virtual security hardware instance associated with the first blade server;

providing the key via the secure out-of-band communication channel to the first blade server; and

migrating the key from the first blade server to a second blade server of the plurality of blade servers.

2. The method of claim 1 further comprising:

using the key to perform hardware encryption of data stored on the first blade server;

migrating the data to the second blade server without decrypting the data at the first blade server; and

using the key to access the data at the second blade server.

3. The method of claim 1 wherein

the key is obtained in response to a command directed to first security hardware associated with the first blade server.

4. The method of claim 3 further comprising:

intercepting the command directed to the first security hardware associated with the first blade server; and

sending the command via the secure out-of-band communication channel to the virtual security hardware instance.

5. The method of claim 3 wherein

the command is issued by software running on the first blade server;

and

the key is provided to the software to perform the operation.

6. The method of claim 1 wherein

the virtual security hardware instance is one of a plurality of virtual security hardware instances managed by a chassis management module;

each of the plurality of virtual security hardware instances corresponds to one of the plurality of blade servers; and

the chassis management module provides the key via the secure out-of-band communication channel to the first blade server.

7. The method of claim 1 wherein

the key is a storage root key for the virtual security hardware instance.

8. A system comprising:

a plurality of blade servers, wherein

a first blade server of the plurality of blade servers further comprises an interface configured to obtain a key to perform an operation on the first blade server from a first virtual security hardware instance of a plurality of virtual security hardware instances;

a chassis management module configured to provide the plurality of virtual security hardware instances, each of the virtual security hardware instances corresponding to a respective blade server of the plurality of blade servers; and

a secure out-of-band communication channel between the chassis management module and the plurality of blade servers;

wherein the chassis management module is further configured to;

provide the key via the secure out-of-band communication channel to the first blade server; and

migrate the key from the first blade server to a second blade server of the plurality of blade servers.

9. The system of claim 8 wherein

the first blade server is configured to use the key to perform hardware encryption of data stored on the first blade server;

the chassis management module is configured to migrate the data to the second blade server without decrypting the data at the first blade server; and

the second blade server is configured to use the key to access the data at the second blade server.

10. The system of claim 8 wherein

the key is obtained in response to a command directed to first security hardware associated with the first blade server.

11. The system of claim 10 further comprising:

an interface at the first blade server configured to

intercept the command directed to the first security hardware associated with the first blade server; and

send the command via the secure out-of-band communication channel to the first virtual security hardware instance.

12. The system of claim 10 wherein

the command is issued by software running on the first blade server;

and

the key is provided to the software to perform the operation.

13. The system of claim 8 wherein

the key is a storage root key for the first virtual security hardware instance.

14. A computer-readable storage medium comprising:

instructions to obtain a key to perform an operation on a first blade server of a plurality of blade servers from a virtual security hardware instance associated with the first blade server;

instructions to provide the key via the secure out-of-band communication channel to the first blade server; and

instructions to migrate the key from the first blade server to a second blade server of the plurality of blade servers.

15. The computer-readable storage medium of claim 14 further comprising:

instructions to use the key to perform hardware encryption of data stored on the first blade server;

instructions to migrate the data to the second blade server without decrypting the data at the first blade server; and

instructions to use the key to access the data at the second blade server.

16. The computer-readable storage medium of claim 14 wherein

the key is obtained in response to a command directed to first security hardware associated with the first blade server.

17. The computer-readable storage medium of claim 16 further comprising:

instructions to intercept the command directed to the first security hardware associated with the first blade server; and

instructions to send the command via the secure out-of-band communication channel to the virtual security hardware instance.

18. The computer-readable storage medium of claim 16 wherein

the command is issued by software running on the first blade server;

and

the key is provided to the software to perform the operation.

19. The computer-readable storage medium of claim 14 wherein

the key is a storage root key for the first virtual security hardware instance.