Secure Migration of Virtual Machines from Source to Target and Transfer of VM Descriptor and Keys Between Physical Servers

A non-transitory computer-readable medium for secure migration of a virtual machine from a source server to a target server, comprising instructions stored thereon that when executed on server(s) perform the steps of:

• requesting a public key from the target server;
• transmitting the target's public key to the source server;
• encrypting the virtual machine descriptor with the target's public key;
• decrypting the virtual machine descriptor using the target's private key;
• and
• restoring a virtual machine associated with the virtual machine descriptor on the target server.

A method of transferring a virtual machine descriptor and associated keys through a key management server from a first physical server to a second physical server, comprising:

• sending a storage key management server (KMS) public key to a first physical server;
• sending the storage KMS public key to a second physical server;
• encrypting the first physical server key with the KMS public key and sending the encrypted first physical server key to the storage KMS;
• encrypting the second physical server key with the KMS public key and sending the encrypted second physical server key to the storage KMS;
• sending the first physical server key to a virtual machine (VM) to encrypt the VM descriptor;
• encrypting the VM storage key(s) with the first physical server key and sending it to the VM KMS;
• sending the encrypted VM storage key(s) to the storage KMS;
• decrypting the VM storage key(s) with the first physical server key and encrypting it with the second physical server key;
• sending the VM storage key(s) encrypted with the second physical server key to the VM KMS;
• sending the VM storage key(s) encrypted with the second physical server key to the second physical server;
• sending the second physical server key to the VM at the second physical server to decrypt the VM storage key(s);
• transferring the VM descriptor from the first physical server to the second physical server;
• and
• decrypting VM storage key(s) using the second physical server key.

A non-transitory computer-readable medium for transferring a virtual machine from a first physical server to a second physical server comprising instructions stored thereon that when executed on server(s) perform the steps of:

• sending a storage key management server (KMS) public key to a first physical server;
• sending the storage KMS public key to a second physical server;
• encrypting the first physical server key with the KMS public key and sending the encrypted first physical server key to the storage KMS;
• encrypting the second physical server key with the KMS public key and sending the encrypted second physical server key to the storage KMS;
• sending the first physical server key to a virtual machine (VM) to encrypt the VM descriptor;
• encrypting the VM storage key(s) with the first physical server key and sending it to the VM KMS;
• sending the encrypted VM storage key(s) to the storage KMS;
• decrypting the VM storage key(s) with the first physical server key and encrypting it with the second physical server key;
• sending the VM storage key(s) encrypted with the second physical server key to the VM KMS;
• sending the VM storage key(s) encrypted with the second physical server key to the second physical server;
• sending the second physical server key to the VM at the second physical server to decrypt the VM storage key(s);
• transferring the VM descriptor from the first physical server to the second physical server;
• and
• decrypting VM storage key(s) using the second physical server key.