US 7,890,754 B2Granted

Selective encryption system and method for I/O operations

AssigneeVMware, Inc.

InventorsCarl A. Waldspurger, Matthew Eccleston

Life of this patent

Estimating the term…

Loading patent…

Abstract

Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

Claims5

Dependent claims

In a computer having a storage device, a method for storing some data in the storage device in an unencrypted form and storing other data in the storage device in an encrypted form and for selecting said some data to be stored in the unencrypted form, the computer including executable instructions for performing the method, the method comprising:

compiling a database of identifiers of allocation units, where each allocation unit contains only general-use data and each allocation unit comprises a predetermined integral multiple number of minimum I/O units of the device;
determining whether each of a plurality of test allocation units corresponds to general-use data by determining whether the test allocation unit corresponds to any identifier of allocation units of general-use data in the database;
if a test allocation unit corresponds to an identifier of allocation units of general-use data in the database, storing the test allocation unit in the unencrypted form in the storage device;
and
storing a plurality of test allocation units that do not correspond to identifiers of allocation units of general-use data in the database in the encrypted form in the storage device.

2 more elements

Dependencies are inferred from the claim text.