System and method for virtual machine data protection in a public cloud

• US 8,838,968 B2
• Filed: 05/14/2012
• Issued: 09/16/2014
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Hadar, Eitan, Mankovski, Serge Jr.
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US13/470,395
• Publication Number:
  US 20130305046A1
• Time in Patent Office: 855 Days
• Field of Search: 713/167, 713/168, 713/169, 726/2, 709/232
• US Class Current: 713/168
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method includes partitioning a disk image file into a plurality of segments. The method also includes generating a unique key for each segment, storing the unique keys in an image mapping file, and transmitting the image mapping file to a particular one of a plurality of nodes on a network. The method further includes transmitting a first segment and a second segment of the plurality of segments to different nodes of the plurality of nodes.

Claims

1. A method, comprising:

partitioning a disk image file into a plurality of segments, the disk image file being associated with a first node of a plurality of nodes on a network;

generating a unique key for each segment;

storing the unique keys in an image mapping file;

transmitting the image mapping file to the first node based on the association between the first node and the disk image file;

transmitting a first segment of the plurality of segments to a second node of the plurality of nodes and a second segment of the plurality of segments to a third node of the plurality of nodes, the second and third nodes being different from the one or more first node; and

associating a location of the first segment with the unique key of the first segment, and a location of the second segment with the unique key of the second segment.

2. The method of claim 1, further comprising compressing the disk image file.

3. The method of claim 1, further comprising:

encrypting each segment;

generating an encryption key for each segment; and

storing the encryption keys in the image mapping file.

4. The method of claim 1, wherein generating a unique key for each segment comprises generating a unique key based on a hash function, and wherein the image mapping file comprises a distributed hash table.

5. The method of claim 1, wherein the disk image file comprises a virtual machine image.

6. The method of claim 1, further comprising replicating the plurality of segments across the plurality of nodes on the network.

7. The method of claim 1, further comprising:

retrieving the image mapping file;

retrieving the plurality of segments from the plurality of nodes based on the unique keys in the image mapping file; and

generating the disk image file from the plurality of segments.

8. A system, comprising:

a memory; and

one or more processors operable to;

partition a disk image file into a plurality of segments, the disk image file being associated with a first node of a plurality of nodes on a network;

generate a unique key for each segment;

store the unique keys in an image mapping file;

transmit the image mapping file to the first node based on the association between the first node and the disk image file;

transmit a first segment of the plurality of segments to a second node of the plurality of nodes and a second segment of the plurality of segments to a third node of the plurality of nodes, the second and third nodes being different from the one or more first node; and

associate a location of the first segment with the unique key of the first segment, and a location of the second segment with the unique key of the second segment.

9. The system of claim 8, wherein the processors are further operable to compress the disk image file.

10. The system of claim 8, wherein the processors are further operable to:

encrypt each segment;

generate an encryption key for each segment; and

store the encryption keys in the image mapping file.

11. The system of claim 8, wherein the processors operable to generate a unique key for each segment are further operable to generate a unique key based on a hash function, and wherein the image mapping file comprises a distributed hash table.

12. The system of claim 8, wherein the disk image file comprises a virtual machine image.

13. The system of claim 8, wherein the processors are further operable to replicate the plurality of segments across the plurality of nodes on the network.

14. The system of claim 8, wherein the processors are further operable to:

retrieve the image mapping file;

retrieve the plurality of segments from the plurality of nodes based on the unique keys in the image mapping file; and

generate the disk image file from the plurality of segments.

15. A non-transitory computer readable medium comprising instructions that, when executed by a processor, are operable to:

partition a disk image file into a plurality of segments, the disk image file being associated with a first node of a plurality of nodes on a network;

generate a unique key for each segment;

store the unique keys in an image mapping file;

transmit the image mapping file to the first node based on the association between the first node and the disk image file;

transmit a first segment of the plurality of segments to a second node of the plurality of nodes and a second segment of the plurality of segments to a third node of the plurality of nodes, the second and third nodes being different from the one or more first node and

associate a location of the first segment with the unique key of the first segment, and a location of the second segment with the unique key of the second segment.

16. The computer readable medium of claim 15, wherein the instructions are further operable to compress the disk image file.

17. The computer readable medium of claim 15, wherein the instructions are further operable to:

encrypt each segment;

generate an encryption key for each segment; and

store the encryption keys in the image mapping file.

18. The computer readable medium of claim 15, wherein the instructions operable to generate a unique key for each segment are further operable to generate a unique key based on a hash function, and wherein the image mapping file comprises a distributed hash table.

19. The computer readable medium of claim 15, wherein the instructions are further operable to replicate the plurality of segments across the plurality of nodes on the network.

20. The computer readable medium of claim 15, wherein the instructions are further operable to:

retrieve the image mapping file;

retrieve the plurality of segments from the plurality of nodes based on the unique keys in the image mapping file; and

generate the disk image file from the plurality of segments.