Virtual machine page movement for encrypted memory
AssigneeRed Hat, Inc.
InventorsMichael Tsirkin, Henri Han van Riel
Life of this patent
Estimating the term…
Abstract
Systems and methods for migrating encrypted storage blocks in a security enhanced manner. An example method may comprise: selecting, by a processing device, a storage block from a plurality of storage blocks comprising encrypted content, the storage block being associated with a computing process; restricting access of the computing process to the storage block; causing the storage block to be decrypted using a first cryptographic input and encrypted using a second cryptographic input; copying the storage block from a first location within the plurality of storage blocks to a second location within the plurality of storage blocks; and providing access of the computing process to the storage block at the second location.
Claims20
A method comprising:
- selecting, by a processing device, a storage block from a plurality of storage blocks that comprise encrypted content, wherein the storage block is associated with a computing process;
- restricting access of the computing process to the storage block;
- causing the storage block to be decrypted using a first cryptographic input that is location dependent and subsequently encrypted using a second cryptographic input that is location independent;
- copying the storage block from a first location within the plurality of storage blocks to a second location within the plurality of storage blocks;
- and
- providing access of the computing process to the storage block at the second location.
A system comprising:
- a memory;
- a processing device operatively coupled to the memory, the processing device to:
- select a storage block from a plurality of storage blocks that comprise encrypted content, wherein the storage block is associated with a computing process;
- restrict access of the computing process to the storage block;
- cause the storage block to be decrypted using a first cryptographic input that is location dependent and subsequently encrypted using a second cryptographic input that is location independent;
- copy the storage block from a first location within the plurality of storage blocks to a second location within the plurality of storage blocks;
- and
- provide access of the computing process to the storage block at the second location.
A non-transitory machine-readable storage medium storing instructions that cause a processing device to:
- select, by a hypervisor, a memory page from a plurality of memory pages that comprise encrypted content, wherein the memory page is associated with a virtual machine;
- restrict access of the virtual machine to the memory page;
- cause the memory page to be decrypted using a first cryptographic input that is location dependent and subsequently encrypted using a second cryptographic input that is location independent;
- copy, by the hypervisor, the memory page from a first location within a memory device to a second location within the memory device;
- and
- provide access of the virtual machine to the memory page at the second location.
Dependencies are inferred from the claim text.