System for securing virtual machine disks on a remote shared storage subsystem

• US 8,495,356 B2
• Filed: 12/31/2010
• Issued: 07/23/2013
• Est. Priority Date: 12/31/2010
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ashok, Rohith, Hogstrom, Matthew R., Whalley, Ian N.
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US12/983,053
• Publication Number:
  US 20120173866A1
• Time in Patent Office: 935 Days
• Field of Search: 713/150, 717/174, 718/1
• US Class Current: 713/150
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Embodiments of the present invention provide a method, data processing system and computer program product for secure distribution of virtualized storage. In an embodiment of the invention, a method for secure distribution of virtualized storage in a host in a cloud computing can include composing at least one virtual machine (VM) disk in a secure container and configured to deploy VM images into a cloud computing environment, encrypting the composed at least one VM disk, transmitting the encrypted VM disk to a hypervisor in the cloud computing environment receiving a request to activate a VM instance and generating a bootloader in the secure container, transmitting the bootloader to the hypervisor in the cloud computing environment and providing a key to the bootloader to unlock the at least one VM disk.

Claims

1. A cloud computing data processing system comprising:

a hardware appliance having a secure container configured for communicative coupling to different hypervisors, each of the different hypervisors supporting virtual machine (VM) storage in a cloud computing environment;

a data store of VM images for storage in at least one of the different hypervisors; and

,

a secure distribution module executing in the memory of the hardware appliance, the module comprising program code enabled upon execution in the hardware appliance to compose at least one VM disk in a secure container, which is configured to deploy VM images into the cloud computing environment, to encrypt the composed at least one VM disk, to transmit the at least one encrypted VM disk to a hypervisor in the cloud computing environment, to generate a bootloader associated with the encrypted VM disk in the secure container, to generate a security token for the bootloader, to transmit the bootloader to the hypervisor in the cloud computing environment, to receive a request to activate a VM instance, to request a key by the bootloader, to verify the bootloader using the security token, and to provide the key to the bootloader to unlock the at least one VM disk upon verification of the bootloader.

2. The system of claim 1, wherein the program code of the module transmits the encrypted VM disk to a hypervisor in the cloud computing environment by establishing a secure communicative link between the secure container and the hypervisor, and by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the secure communicative link.

3. The system of claim 1, wherein the program code of the module establishes a secure communicative link between the secure container and the hypervisor by establishing a secure sockets layer (SSL) communication layer link between the secure container and the hypervisor and by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the SSL communication layer link.

4. A computer program product for secure distribution of virtualized storage in a cloud computing environment, the computer program product comprising:

a computer readable storage device having stored therein computer readable program code, the computer readable program code comprising;

computer readable program code for composing at least one virtual machine (VM) disk in a secure container and configured to deploy VM images into a cloud computing environment;

computer readable program code for encrypting the composed VM disk;

computer readable program code for transmitting the encrypted VM disk to a hypervisor in the cloud computing environment;

computer readable program code for generating a bootloader associated with the encrypted VM disk in the secure container;

computer readable program code for generating a security token for the bootloader;

computer readable program code for transmitting the bootloader to the hypervisor in the cloud computing environment;

computer readable program code for receiving a request to activate a VM instance;

computer readable program code for requesting a key by the bootloader;

computer readable program code for verifying the bootloader using the security token; and

computer readable program code for providing the key to the bootloader to unlock the at least one VM disk upon verification of the bootloader.

5. The computer program product of claim 4, wherein the computer readable program code for transmitting the encrypted VM disk to a hypervisor in the cloud computing environment, comprises:

computer readable program code for establishing a secure communicative link between the secure container and the hypervisor; and

,

computer readable program code for transmitting the encrypted VM disk to the hypervisor in the cloud computing environment by the secure communicative link.

6. The computer program product of claim 4, wherein the computer readable program code for establishing a secure communicative link between the secure container and the hypervisor, comprises computer readable program code for establishing a secure sockets layer (SSL) communication layer link between the secure container and the hypervisor, and, by transmitting the encrypted VM disk to the hypervisor in the cloud computing environment over the SSL communication layer link.