SYSTEM FOR SECURING VIRTUAL MACHINE DISKS ON A REMOTE SHARED STORAGE SUBSYSTEM

• US 20120173866A1
• Filed: 12/31/2010
• Published: 07/05/2012
• Est. Priority Date: 12/31/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ashok, Rohith, Whalley, Ian N., Hogstrom, Matthew R.
• Granted Patent: US 8,495,356 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Embodiments of the present invention provide a method, data processing system and computer program product for secure distribution of virtualized storage. In an embodiment of the invention, a method for secure distribution of virtualized storage in a host in a cloud computing can include composing at least one virtual machine (VM) disk in a secure container and configured to deploy VM images into a cloud computing environment, encrypting the composed at least one VM disk, transmitting the encrypted VM disk to a hypervisor in the cloud computing environment receiving a request to activate a VM instance and generating a bootloader in the secure container, transmitting the bootloader to the hypervisor in the cloud computing environment and providing a key to the bootloader to unlock the at least one VM disk.

Claims

1-5. -5. (canceled)

6. A cloud computing data processing system comprising:

a secure container executing on a hardware appliance with at least one processor and memory and configured for communicative coupling to different hypervisors, each of the different hypervisors supporting VM storage in a cloud computing environment;

a data store of VM images for storage in at least one of the different hypervisors; and

,

a secure distribution module executing in the memory of the hardware appliance, the module comprising program code enabled upon execution in the hardware appliance to compose at least one machine (VM) disk in a secure container, which is configured to deploy VM images into the cloud computing environment, to encrypt the composed at least one VM disk, to transmit the at least one encrypted VM disk to a hypervisor in the cloud computing environment, to receive a request to activate a VM instance and generate a bootloader in the secure container, to transmit the bootloader to the hypervisor in the cloud computing environment and to provide a key to the bootloader to unlock the at least one VM disk.

7. The system of claim 6, wherein the program code of the module transmits the encrypted VM disk to a hypervisor in the cloud computing environment by establishing a secure communicative link between the secure container and the hypervisor, and by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the secure communicative link.

8. The system of claim 6, wherein the program code of the module establishes a secure communicative link between the secure container and the hypervisor by establishing a secure sockets layer (SSL) communication layer link between the secure container and the hypervisor and by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the SSL communication layer link.

9. A computer program product for secure distribution of virtualized storage in a cloud computing environment, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code for composing at least one machine (VM) disk in a secure container and configured to deploy VM images into a cloud computing environment;

computer readable program code for encrypting the composed VM disk;

computer readable program code for transmitting the encrypted VM disk to a hypervisor in the cloud computing environment;

computer readable program code for receiving a request to activate a VM instance and generating a bootloader in the secure container; and

,

computer readable program code for transmitting the bootloader to the hypervisor in the cloud computing environment and providing a key to the bootloader to unlock the at least one VM disk

10. The computer program product of claim 9, wherein the computer readable program code for transmitting the encrypted VM disk to a hypervisor in the cloud computing environment, comprises:

computer readable program code for establishing a secure communicative link between the secure container and the hypervisor; and

,

computer readable program code for transmitting the encrypted VM disk to the hypervisor in the cloud computing environment by the secure communicative link.

11. The computer program product of claim 9, wherein the computer readable program code for establishing a secure communicative link between the secure container and the hypervisor, comprises computer readable program code for establishing a secure sockets layer (SSL) communication layer link between the secure container and the hypervisor, and, by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the SSL communication layer link.

12. The computer program product of claim 9, wherein the computer readable program code for generating a bootloader in the secure container comprises computer readable program code for generating a security token for the bootloader.

13. The computer program product of claim 9, wherein the computer readable program code for providing a key to the bootloader to unlock the at least one VM disk comprises:

computer readable program code for verifying a security token of the bootloader; and

responsive to verifying the bootloader, computer readable program code for providing the key to unlock the at least one VM disk