US 10,382,408 B1Granted

Computing instance migration

AssigneeAmazon Technologies, Inc.

InventorsKhaja Ehteshamuddin Ahmed, Diwakar Gupta, Matthew Shawn Wilson

Life of this patent

Estimating the term…

Loading patent…

Abstract

Technology for migration of a computing instance is provided. In one example, a method may include receiving instructions to initiate migration of the computing instance from a first host to a second host. A first message for sending to the first host may be generated which includes instructions to send data representing the computing instance to the second host. The first message may further include encryption information for use in deriving at least one key for encrypting communications to the second host from the first host. A second message for sending to the second host may be generated which includes instructions to receive the data representing the computing instance from the first host. The second message may further include information for use in deriving at least one key for decrypting communications from the first host. The first and second messages may be sent to the respective first and second hosts.

Claims20

Dependent claims

A computing device for secured migration of a computing instance, comprising:

a processor;
a memory in electronic communication with the processor;
and
instructions stored in the memory, the instructions being executable by the processor to:
receive instructions at a migration authority to initiate migration of the computing instance from a first host to a second host using a secure process, the instructions identifying the first and second hosts;
generate a first message at the migration authority for transmission to the first host, the first message including instructions to send data representing the computing instance to the second host using the secure process, wherein encryption information is known to the first host, prior to the instruction received at the migration authority, for deriving at least one key for encrypting communications to the second host;
generate a second message at the migration authority for transmission to the second host, the second message including instructions to receive the data representing the computing instance from the first host using the secure process, wherein the encryption information is known to the second host, prior to the instruction received at the migration authority, for deriving at least one key for decrypting communications from the first host;
encrypt the first message with a public key of the first host and the second message with a public key of the second host;
and
send the first and second messages to the first and second hosts.

7 more elements

A computer implemented method for migration of a computing instance using a processor of the computer, the method comprising:

identifying instructions to initiate migration of the computing instance from a first host to a second host using a secure process;
generating a first message, using the processor, for sending to the first host, the first message including instructions to send data representing the computing instance to the second host using the secure process, wherein encryption information is known to the first host, prior to identifying the instruction to initiate migration for use by the first host in deriving at least one key for encrypting communications to the second host from the first host;
generating a second message, using the processor, for sending to the second host, the second message including instructions to receive the data representing the computing instance from the first host using the secure process, wherein the encryption information is known to the second host, prior to identifying the instruction to initiate migration for use by the second host in deriving at least one key for decrypting communications from the first host;
and
sending the first and second messages to the respective first and second hosts.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/652,864Filed 18 Jul 2017 · continuation
Priority: 23 Mar 2015
Granted: 13 Aug 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/0435
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: wherein the sending and receiving network entities apply…
G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 21/606
Protecting data: by securing the transmission between two devices or processes
H04L 63/062
For supporting key management in a packet data network: for key distribution, e.g. centrally by trusted party