Back to results
US 8,621,196 B2Granted
Booting from an encrypted ISO image
AssigneeVerizon Patent and Licensing Inc.
InventorsSeshubabu Pasam, Michael J. Matczynski, Zhiyuan Zhang
Life of this patent
Estimating the term…
Abstract
A device is provided in a data center that is connected to a cloud computing environment. The device receives unencrypted information, and divides the unencrypted information into multiple data chunks. The device also derives an encryption key for each data chunk, of the multiple data chunks, based on a master key, a chunk number associated with each data chunk, and a salt value. The device further encrypts each data chunk with a corresponding derived encryption key, combines the encrypted data chunks to create encrypted information, and provides the encrypted information to the cloud computing environment.
Claims15
A method, comprising:
- receiving an unencrypted International Organization for Standards (ISO) image, associated with booting one or more client devices, by a device provided in a data center connected to a cloud computing environment;
- dividing, by the device, the unencrypted ISO image into multiple data chunks of a set data size, wherein a last data chunk is smaller than the set data size;
- deriving, by the device, an encryption key for each data chunk based on a master key and a chunk number associated with each data chunk;
- padding the last data chunk to correspond to the set data size;
- encrypting, by the device, each data chunk with a corresponding derived encryption key;
- aggregating, by the device, the encrypted data chunks to create an encrypted ISO image;
- and
- providing, by the device, the encrypted ISO image to one or more devices of the cloud computing environment,
- wherein the one or more devices of the cloud computing environment are to decrypt a portion of the encrypted ISO image for provision to the one or more client devices.
6 more elements
A device provided in a data center connected to a cloud computing environment, the device comprising:
- a memory;
- and
- a processor configured to:
- receive an unencrypted International Organization for Standards (ISO) image associated with booting one or more client devices,
- divide the unencrypted ISO image into multiple data chunks of a set data size,
- padding the last data chunk to correspond to the set data size,
- derive an encryption key for each data chunk, of the multiple data chunks, based on a master key, a chunk number associated with each data chunk, and a salt value,
- pad the last data chunk to correspond to the set data size;
- encrypt each data chunk with a corresponding derived encryption key,
- combine the encrypted data chunks to create an encrypted ISO image, and
- provide the encrypted ISO image to one or more devices of the cloud computing environment,
- where the one or more devices of the cloud computing environment are to decrypt a portion of the encrypted ISO image for provision to the one or more client devices.
9 more elements
A method, comprising:
- receiving, by a device and from a virtual machine of the device, a request for a range of encrypted information that corresponds to less than an entirety of a stored International Organization for Standards (ISO) image associated with performing booting via the virtual machine;
- rounding, by the device, a starting byte offset of the range down to a next lower chunk size, wherein the chunk size is a predetermined value, and a beginning value of the next lower chunk size is determined based on the starting byte offset;
- rounding, by the device, an ending byte offset of the range up to a next upper chunk size, wherein a beginning value of the next upper chunk size is determined based on the ending byte offset;
- retrieving, by the device, an encrypted information portion provided between the rounded starting byte offset and the rounded ending byte offset;
- deriving, by the device, an encryption key for each data chunk, in the encrypted information portion, based on a master key, a chunk number associated with each data chunk, and a salt value;
- decrypting, by the device, each data chunk with a corresponding derived encryption key;
- aggregating, by the device, the decrypted data chunks to create a decrypted information portion;
- and
- providing, by the device, the decrypted information portion to the virtual machine.
6 more elements
A device, comprising:
- a memory;
- and
- a processor configured to:
- receive, from a virtual machine of the device, a request for a range of encrypted information that corresponds to less than an entirety of a stored International Organization for Standards (ISO) image associated with performing booting via the virtual machine,
- round a starting byte offset of the requested range down to a next lower chunk size to create first excess data with respect to the requested range,
- round an ending byte offset of the range up to a next upper chunk size to create second excess data with respect to the requested range,
- retrieve an encrypted information portion provided between the rounded starting byte offset and the rounded ending byte offset,
- determine an encryption key for each data chunk, in the encrypted information portion, based on a master key, a chunk number associated with each data chunk, and a salt value,
- decrypt each data chunk with a corresponding determined encryption key,
- aggregate the decrypted data chunks to create a decrypted information portion,
- determine that the decrypted information portion is larger than the requested range by at least a first amount corresponding to the first excess data and the second excess data,
- discard, from the decrypted information portion, an amount of data corresponding to the first amount to modify the decrypted information portion relative to the requested range, and
- provide the modified decrypted information portion to the virtual machine.
10 more elements
Dependencies are inferred from the claim text.