# US 2014/0157363 A1 · Methods and systems for secure storage segmentation based on security context in a virtual environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157363 A1 - Document ID: US20140157363A1 - Status: Published application - Kind: A1 - Application number: 13/706,256 - Filed: 2012-12-05 - Published: 2014-06-05 - Earliest claimed: 2012-12-05 - Assignees: Symantec Corporation - Inventors: Deb Banerjee - Web page: https://patentgrep.com/patent/US20140157363A1 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5044: {considering hardware capabilities} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - H04L 63/105: {Multiple levels of security} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer system identifies a request to place a workload in a hypervisor-based host. The computer system identifies a security level of the workload. The computer system identifies a security level of a storage device associated with the hypervisor-based host. If the security level of the workload corresponds to the security level of the storage device, the computer system grants the request to place the workload in the hypervisor-based host. If the security level of the workload does not correspond to the security level of the storage device, the computer system denies the request to place the workload in the hypervisor-based host. ## Claims ### Claim 1 A method comprising: identifying a request to place a workload in a hypervisor-based host; identifying a security level of the workload; identifying a security level of a storage device associated with the hypervisor-based host; granting the request to place the workload in the hypervisor-based host if the security level of the workload corresponds to the security level of the storage device; and denying the request to place the workload in the hypervisor-based host if the security level of the workload does not correspond to the security level of the storage device. ### Claim 2 (depends on 1) The method of claim 1, wherein the workload is an instance of a virtual machine on the hypervisor-based host. ### Claim 3 (depends on 1) The method of claim 1 wherein granting the request to place the workload in the hypervisor-based host comprises: associating at least one virtual disk on the storage device with the workload. ### Claim 4 (depends on 3) The method of claim 3, wherein the storage device is a physical disk comprising a plurality of virtual disks used by workloads on different hypervisor-based hosts. ### Claim 5 (depends on 4) The method of claim 4, wherein each of the workloads is assigned to one of: a cloud tenant, a cloud sub-tenant, or an operation performed for a cloud tenant or sub-tenant. ### Claim 6 (depends on 1) The method of claim 1, wherein the security level of the storage device is identified based on at least one of: the security level of the workload, input provided by a system administrator, or sensitivity of content on the storage device. ### Claim 7 (depends on 1) The method of claim 1, wherein the request to place the workload in the hypervisor-based host is any one of an initial placement request with respect to the workload or a request to migrate the workload to the hypervisor-based host from another hypervisor-based host. ### Claim 8 A system comprising: a memory; and a processing device coupled with the memory to: identify a request to place a workload in a hypervisor-based host; identify a security level of the workload; identify a security level of a storage device associated with the hypervisor-based host; grant the request to place the workload in the hypervisor-based host if the security level of the workload corresponds to the security level of the storage device; and deny the request to place the workload in the hypervisor-based host if the security level of the workload does not correspond to the security level of the storage device. ### Claim 9 (depends on 8) The system of claim 8, wherein the workload is an instance of a virtual machine on the hypervisor-based host. ### Claim 10 (depends on 8) The system of claim 8, wherein when granting the request to place the workload in the hypervisor-based host comprises, the processing device further to: associate at least one virtual disk on the storage device with the workload. ### Claim 11 (depends on 10) The system of claim 10, wherein the storage device is a physical disk comprising a plurality of virtual disks used by workloads on different hypervisor-based hosts. ### Claim 12 (depends on 11) The system of claim 11, wherein each of the workloads is assigned to one of: a cloud tenant, a cloud sub-tenant, or an operation performed for a cloud tenant or sub-tenant. ### Claim 13 (depends on 8) The system of claim 8, wherein the security level of the storage device is identified based on at least one of: the security level of the workload, input provided by a system administrator, or sensitivity of content on the storage device. ### Claim 14 (depends on 8) The system of claim 8, wherein the request to place the workload in the hypervisor-based host is any one of an initial placement request with respect to the workload or a request to migrate the workload to the hypervisor-based host from another hypervisor-based host. ### Claim 15 A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method comprising: identifying a request to place a workload in a hypervisor-based host; identifying a security level of the workload; identifying a security level of a storage device associated with the hypervisor-based host; granting the request to place the workload in the hypervisor-based host if the security level of the workload corresponds to the security level of the storage device; and denying the request to place the workload in the hypervisor-based host if the security level of the workload does not correspond to to the security level of the storage device. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the workload is an instance of a virtual machine on the hypervisor-based host, and wherein the request to place the workload in the hypervisor-based host is any one of an initial placement request with respect to the workload or a request to migrate the workload to the hypervisor-based host from another hypervisor-based host. ### Claim 17 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein when granting the request to place the workload in the hypervisor-based host the processing device further to perform: associating at least one virtual disk on the storage device with the workload. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the storage device is a physical disk comprising a plurality of virtual disks used by workloads on different hypervisor-based hosts. ### Claim 19 (depends on 18) The non-transitory computer readable storage medium of claim 18, wherein each of the workloads is assigned to one of: a cloud tenant, a cloud sub-tenant, or an operation performed for a cloud tenant or sub-tenant. ### Claim 20 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the security level of the storage device is identified based on at least one of: the security level of the workload, input provided by a system administrator, or sensitivity of content on the storage device.