Migration of full-disk encrypted virtualized storage between blade servers

• US 9,047,468 B2
• Filed: 12/30/2008
• Issued: 06/02/2015
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sakthikumar, Palsamy, Zimmer, Vincent J.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US12/317,945
• Publication Number:
  US 20090169020A1
• Time in Patent Office: 2,345 Days
• Field of Search: 380/278
• US Class Current: 1/1
• CPC Class Codes: G06F 11/203 using migration
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

A method, system and computer-readable storage medium with instructions to migrate full-disk encrypted virtual storage between blade servers. A key is obtained to perform an operation on a first blade server. The key is obtained from a virtual security hardware instance and provided to the first blade server via a secure out-of-band communication channel. The key is migrated from the first blade server to a second blade server. The key is used to perform hardware encryption of data stored on the first blade server. The data are migrated to the second blade server without decrypting the data at the first blade server, and the second blade server uses the key to access the data. Other embodiments are described and claimed.

Claims

1. A method comprising:

with a chassis management module instantiating a plurality of virtual security hardware instances corresponding to a plurality of blade servers, obtaining a key from a first virtual security hardware instance of said plurality of virtual security hardware instances, the key to perform an operation on a first blade server of said plurality of blade servers, wherein the first virtual security hardware instance corresponds to said first blade server;

in response to a command directed at first security hardware of the first blade server, providing the key to the first blade server via a secure out-of-band communication channel between said chassis management module and said plurality of blade servers, wherein the secure out-of-band communication channel comprises a signal path that is inaccessible to an external network;

with said chassis management module, migrating, without decrypting, encrypted data stored on the first blade server to a second blade server of said plurality of blade servers, the encrypted data having been encrypted with the key; and

with said chassis management module, migrating said key from said first virtual security hardware instance to a second virtual security hardware instance of said plurality of virtual security hardware instances via said secure out-of-band communication channel, the second virtual security hardware instance corresponding to said second blade server.

2. The method of claim 1 further comprising:

using the key to access the encrypted data with the second blade server.

3. The method of claim 1, further comprising:

intercepting the command directed to the first security hardware associated with the first blade server; and

sending the command via the secure out-of-band communication channel to the first virtual security hardware instance.

4. The method of claim 1 wherein the key is a storage root key for the first virtual security hardware instance.

5. The method of claim 1, wherein each of said plurality of virtual security hardware instances is configured to emulate security features of a physical trusted platform module.

6. A system comprising:

a plurality of blade servers, a chassis management module, and a secure out-of-band communication channel between the plurality of blade servers and the chassis management module, the secure out-of-band communication channel being inaccessible to an external network, wherein;

the chassis management module is configured to;

instantiate a plurality of virtual security hardware instances respectively corresponding to said plurality of blade servers;

obtain a key from a first virtual security hardware instance of said plurality of virtual security hardware instances, the key to perform an operation on a first blade server of said plurality of blade servers, wherein the first virtual hardware instance corresponds to said first blade server; and

in response to a command directed at first security hardware of the first blade server, provide the key to the first blade server via the security out-of-band communication channel;

the first blade server comprises an interface configured to obtain the key to perform the operation on the first blade server; and

the chassis management module is further configured to;

migrate, without decrypting, encrypted data stored on the first blade server to a second blade server of said plurality of blade servers, the encrypted data having been encrypted with the key; and

migrate the key from the first virtual security hardware instance to a second virtual security hardware instance of said plurality of virtual security hardware instances via said secure out-of-band communication channel, the second virtual security hardware instance corresponding to said second blade server.

7. The system of claim 6 wherein

the first blade server is configured to use the key to perform hardware encryption of data stored on the first blade server to produce said encrypted data;

and

the second blade server is configured to use the key to access the encrypted data.

8. The system of claim 6, further comprising:

an interface at the first blade server configured to

intercept the command directed to the first security hardware associated with the first blade server; and

send the command via the secure out-of-band communication channel to the first virtual security hardware instance.

9. The system of claim 6 wherein

the key is a storage root key for the first virtual security hardware instance.

10. The system of claim 6, wherein each of said plurality of virtual security hardware instances is configured to emulate security features of a physical trusted platform module.

11. A non-transitory computer-readable storage medium comprising instructions which when executed by at least one processor cause the performance of the following operations comprising:

instantiating a plurality of virtual security hardware instances corresponding to a plurality of blade servers with a chassis management module;

obtaining a key from a first virtual security hardware instance of said plurality of virtual security hardware instances, the key to perform an operation on a first blade server of said plurality of blade servers, wherein the first virtual security hardware instance corresponds to said first blade server;

in response to a command directed at first security hardware of the first blade server, providing the key to the first blade server via a secure out-of-band communication channel between said chassis management module and said plurality of blade servers, wherein the secure out-of-band communication channel comprises a signal path that is inaccessible to an external network;

migrating, without decrypting, encrypted data stored on the first blade server to a second blade server of said plurality of blade servers, the encrypted data having been encrypted with the key; and

migrating said key from said first virtual security hardware instance to a second virtual security hardware instance of said plurality of virtual security hardware instances via said secure out-of-band communication channel, the second virtual security hardware instance corresponding to said second blade server.

12. The computer-readable storage medium of claim 11, wherein said instructions when executed further cause the performance of the following operations comprising:

using the key to perform hardware encryption of data stored on the first blade server; and

using the key to access the data at the second blade server.

13. The computer-readable storage medium of claim 11, wherein said instructions when executed further cause the performance of the following operations comprising:

intercepting the command directed to the first security hardware associated with the first blade server; and

sending the command via the secure out-of-band communication channel to the first virtual security hardware instance.

14. The computer-readable storage medium of claim 11 wherein the key is a storage root key for the first virtual security hardware instance.

15. The computer readable storage medium of claim 11, wherein each of said plurality of virtual security hardware instances is configured to emulate security features of a physical trusted platform module.