Encrypted virtual machines in a cloud

• US 9,225,529 B1
• Filed: 12/10/2013
• Issued: 12/29/2015
• Est. Priority Date: 12/10/2013
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Natanzon, Assaf, Amit, Amir
• Primary Examiner(s): Ho, Dao
• Application Number:
  US14/102,043
• Time in Patent Office: 749 Days
• Field of Search: 726/27, 713/153, 713/165
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 11/1471 involving logging of persistent data for recovery
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: G06F 2201/82 Solving problems relating to consistency ensuring consistency in mirrored systems G06F11/2064
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method, system, and computer program product for intercepting communication between a virtual machine and an encrypted replication data stored on a storage medium and redirecting the communication to a remote replication appliance and using a key stored on the remote replication appliance to enable the virtual machine to facilitate communication with the encrypted replication data stored on the storage medium, wherein facilitating communication enables the virtual machine to interact with the encrypted replication data as unencrypted data.

Claims

1. A system for accessing encrypted replication data stored on a storage medium, the system comprising:

a remote replication appliance, and

computer-executable logic operating in memory, wherein the computer-executable program logic is configured to enable a processor to execute;

intercepting communication between a virtual machine and the encrypted replication data stored on the storage medium and redirecting the communication to the remote replication appliance; and

using a key stored on the remote replication appliance to enable the virtual machine to facilitate communication with the encrypted replication data stored on the storage medium;

wherein facilitating communication enables the virtual machine to interact with the encrypted replication data as unencrypted data; and

installing a certificate for accessing a key manager;

obtaining a key from the key manager; and

erasing the key from the remote replication appliance once communication between the virtual machine and the encrypted replication data stored on the storage medium has finished.

2. The system of claim 1, wherein the facilitating communication comprises encrypting data sent from the virtual machine and sending the encrypted data to the encrypted replication data stored on the storage medium.

3. The system of claim 1, wherein facilitating communication comprises decrypting data sent from the encrypted replication data stored on the storage medium and sending the decrypted data to the virtual machine.

4. The system of claim 1 wherein obtaining the key from the key manager comprises providing the key manager with a key ID.

5. A method for accessing encrypted replication data stored on a storage medium, the method comprising:

intercepting communication between a virtual machine and the encrypted replication data stored on the storage medium and redirecting the communication to a remote replication appliance; and

using a key stored on the remote replication appliance to enable the virtual machine to facilitate communication with the encrypted replication data stored on the storage medium;

wherein facilitating communication enables the virtual machine to interact with the encrypted replication data as unencrypted data; and

installing a certificate for accessing a key manager;

obtaining a key from the key manager; and

erasing the key from the remote replication appliance once communication between the virtual machine and the encrypted replication data stored on the storage medium has finished.

6. The method of claim 5 wherein the facilitating communication comprises encrypting data sent from the virtual machine and sending the encrypted data to the encrypted replication data stored on the storage medium.

7. The method of claim 5 wherein facilitating communication comprises decrypting data sent from the encrypted replication data stored on the storage medium and sending the decrypted data to the virtual machine.

8. The method of claim 5 wherein obtaining the key from the key manager comprises providing the key manager with a key ID.

9. A computer program product comprising:

a non-transitory computer readable medium encoded with computer executable program code, wherein the code enables a processor to execute;

intercepting communication between a virtual machine and encrypted replication data stored on a storage medium and redirecting the communication to a remote replication appliance;

using a key stored on the remote replication appliance to enable the virtual machine to facilitate communication with the encrypted replication data stored on the storage medium;

wherein facilitating communication enables the virtual machine to interact with the encrypted replication data as unencrypted data; and

installing a certificate for accessing a key manager;

obtaining a key from the key manager; and

erasing the key from the remote replication appliance once communication between the virtual machine and the encrypted replication data stored on the storage medium has finished.

10. The program product of claim 9 wherein the facilitating communication comprises encrypting data sent from the virtual machine and sending the encrypted data to the encrypted replication data stored on the storage medium.

11. The program product of claim 9 wherein facilitating communication comprises decrypting data sent from the encrypted replication data stored on the storage medium and sending the decrypted data to the virtual machine.

12. The program product of claim 9 wherein obtaining the key from the key manager comprises providing the key manager with a key ID.

13. The program product of claim 9 wherein the code further enables the processor to execute:

erasing the key from the remote replication appliance if the certificate is not re-installed at a regular interval.

14. The program product of claim 9 wherein redirecting the communication comprises sending data to the remote replication appliance as a SCSI command and modifying some of the fields in a CDB of the SCSI command.