# US 10,372,919 B1 · Protecting virtual machine data in cloud environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,919 B1 - Document ID: US10372919B1 - Status: Granted - Kind: B1 - Application number: 15/893,931 - Filed: 2018-02-12 - Granted: 2019-08-06 - Earliest claimed: 2015-03-31 - Assignees: Veritas Technologies LLC - Applicants: Veritas Technologies LLC - Inventors: Soumya Tripathy; Subhadeep Ghosh - Web page: https://patentgrep.com/patent/US10372919B1 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - G06F 9/4406: {Loading of operating system} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various systems, methods, and processes to protect virtual machine data in cloud computing environments are disclosed. A request for application data is received. The application data is encrypted, the request is received at an encryption virtual machine, and the encryption virtual machine is configured to receive the request from application virtual machines via loaders. A map file is accessed to identify an application virtual machine for which the application data is requested and the application data is accessed in a storage volume. The storage volume is communicatively coupled to the encryption virtual machine, and the encryption virtual machine is coupled between the application virtual machines and the storage volume. The application data is received from the storage volume and decrypted at the encryption virtual machine. The decrypted application data is sent to the loaders. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a request for application data, wherein the application data is encrypted, the request is received at an encryption virtual machine, and the encryption virtual machine is configured to receive the request from a plurality of application virtual machines via a plurality of loaders; accessing a map file to identify an application virtual machine of the plurality of application virtual machines for which the application data is requested; accessing the application data in a storage volume, wherein the storage volume is communicatively coupled to the encryption virtual machine, and the encryption virtual machine is coupled between the plurality of application virtual machines and the storage volume, receiving the application data from the storage volume, wherein the application data is decrypted at the encryption virtual machine to produce decrypted application data; and sending the decrypted application data to the plurality of loaders. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: requesting updated application data from the application virtual machine; receiving the updated application data from the application virtual machine; encrypting the updated application data at the encryption virtual machine, to form encrypted updated application data; storing the encrypted updated application data in the storage volume; and updating the map file. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the storage volume is not communicatively coupled to the plurality of application virtual machines. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein a loader of the plurality of loaders implements a Storage Area Network (SAN) client, the encryption virtual machine implements a SAN target, and the SAN client serves the application virtual machine with the decrypted application data sent to the loader from the SAN target. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the map file comprises an encryption key associated with the application virtual machine, the map file maintains a mapping between the application virtual machine and the encryption key associated with the application virtual machine, and the map file comprises a location of the application data in the storage volume. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, wherein the loader is communicatively coupled to both the application virtual machine and the encryption virtual machine, and the loader is implemented in a virtual disk, the loader is a boot loader, and the virtual disk is an iPXE disk. ### Claim 7 (depends on 4) The computer-implemented method of claim 4, wherein the SAN client uses Internet Small Computer System Interface (iSCSI) protocol to send the request for the application data to the SAN target, and the SAN target uses the iSCSI protocol to send the decrypted application data to the SAN client. ### Claim 8 A non-transitory computer readable storage medium comprising program instructions executable to: receive a request for application data, wherein the application data is encrypted, the request is received at an encryption virtual machine, and the encryption virtual machine is configured to receive the request from a plurality of application virtual machines via a plurality of loaders; access a map file to identify an application virtual machine of the plurality of application virtual machines for which the application data is requested; access the application data in a storage volume, wherein the storage volume is communicatively coupled to the encryption virtual machine, and the encryption virtual machine is coupled between the plurality of application virtual machines and the storage volume, receive the application data from the storage volume, wherein the application data is decrypted at the encryption virtual machine to produce decrypted application data; and send the decrypted application data to the plurality of loaders. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: requesting updated application data from the application virtual machine; receiving the updated application data from the application virtual machine; encrypting the updated application data at the encryption virtual machine, to form encrypted updated application data; storing the encrypted updated application data in the storage volume; and updating the map file. ### Claim 10 (depends on 8) The non-transitory computer readable storage medium of claim 8, wherein the storage volume is not communicatively coupled to the plurality of application virtual machines. ### Claim 11 (depends on 8) The non-transitory computer readable storage medium of claim 8, wherein a loader of the plurality of loaders implements a Storage Area Network (SAN) client, the encryption virtual machine implements a SAN target, and the SAN client serves the application virtual machine with the decrypted application data sent to the loader from the SAN target. ### Claim 12 (depends on 8) The non-transitory computer readable storage medium of claim 8, wherein the map file comprises an encryption key associated with the application virtual machine, the map file maintains a mapping between the application virtual machine and the encryption key associated with the application virtual machine, and the map file comprises a location of the application data in the storage volume. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the loader is communicatively coupled to both the application virtual machine and the encryption virtual machine, and the loader is implemented in a virtual disk, the loader is a boot loader, and the virtual disk is an iPXE disk. ### Claim 14 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the SAN client uses Internet Small Computer System Interface (iSCSI) protocol to send the request for the application data to the SAN target, and the SAN target uses the iSCSI protocol to send the decrypted application data to the SAN client. ### Claim 15 A system comprising: one or more hardware processors; and a memory coupled to the one or more hardware processors, wherein the memory stores program instructions executable by the one or more hardware processors to: receive a request for application data, wherein the application data is encrypted, the request is received at an encryption virtual machine, and the encryption virtual machine is configured to receive the request from a plurality of application virtual machines, via a plurality of loaders; access a map file to identify an application virtual machine of the plurality of application virtual machines for which the application data is requested; access the application data in a storage volume, wherein the storage volume is communicatively coupled to the encryption virtual machine, and the encryption virtual machine is coupled between the plurality of application virtual machines and the storage volume, receive the application data from the storage volume, wherein the application data is decrypted at the encryption virtual machine to produce decrypted application data; and send the decrypted application data to the plurality of loaders. ### Claim 16 (depends on 15) The system of claim 15, further comprising: requesting updated application data from the application virtual machine; receiving the updated application data from the application virtual machine; encrypting the updated application data at the encryption virtual machine, to form encrypted updated application data; storing the encrypted updated application data in the storage volume; and updating the map file. ### Claim 17 (depends on 15) The system of claim 15, wherein the storage volume is not communicatively coupled to the plurality of application virtual machines. ### Claim 18 (depends on 15) The system of claim 15, wherein a loader of the plurality of loaders implements a Storage Area Network (SAN) client, the encryption virtual machine implements a SAN target, and the SAN client serves the application virtual machine with the decrypted application data sent to the loader from the SAN target. ### Claim 19 (depends on 15) The system of claim 15, wherein the map file comprises an encryption key associated with the application virtual machine, the map file maintains a mapping between the application virtual machine and the encryption key associated with the application virtual machine, and the map file comprises a location of the application data in the storage volume. ### Claim 20 (depends on 18) The system of claim 18, wherein the loader is communicatively coupled to both the application virtual machine and the encryption virtual machine, the loader is implemented in a virtual disk, the loader is a boot loader, and the virtual disk is an iPXE disk, the SAN client uses Internet Small Computer System Interface (iSCSI) protocol to send the request for the application data to the SAN target, and the SAN target uses the iSCSI protocol to send the decrypted application data to the SAN client.