Storage encryption
AssigneeCitrix Systems, Inc.
InventorMichael Bursell
Life of this patent
Estimating the term…
Abstract
Storage associated with a virtual machine or other type of device may be migrated between locations (e.g., physical devices, network locations, etc.). To maintain the security of the storage, a system may manage the encryption of the storage area such that a storage area is encrypted with a first encryption key that may be maintained through the migration. A header of the storage area, on the other hand, may be encrypted using a second encryption key and the first encryption key may be stored therein. Upon transfer, the header may be re-encrypted to affect the transfer of security.
Claims20
One or more non-transitory computer-readable media storing instructions that when executed by one or more computers cause the one or more computers to:
- encrypt, using a first key, data in a storage area of a virtualization environment, the storage area being provisioned for a virtual machine;
- store, in a header of the storage area, the first key, the header being logically separated from the data;
- encrypt, using a second key, the first key;
- and
- responsive to a request to migrate the storage area from a first location of the virtualization environment to a second location of the virtualization environment:
- decrypt, using the second key, the first key;
- encrypt, using a third key, the first key;
- migrate, from the first location and to the second location, the data, the data being encrypted in accordance with the first key;
- decrypt, using the third key, the first key;
- and
- encrypt, using a fourth key, the first key.
A system, comprising:
- a plurality of computing devices associated with a virtualization environment, the plurality comprising a first device comprising a storage area provisioned for a virtual machine, the storage area comprising data and a header logically separated from the data;
- at least one processor;
- and
- a memory storing instructions that when executed by the at least one processor cause the system to:
- encrypt, using a first key, the data;
- store, in the header, the first key;
- encrypt, using a second key, the first key;
- and
- responsive to a request to migrate the storage area from the first device to a second device of the plurality of computing devices associated with a virtualization environment:
- decrypt, using the second key, the first key;
- encrypt, using a third key, the first key;
- migrate, from the first device and to the second device, the data, the data being encrypted in accordance with the first key;
- decrypt, using the third key, the first key;
- and
- encrypt, using a fourth key, the first key.
A method, comprising:
- encrypting, by one or more computing devices associated with a virtualization environment and using a first key, data in a storage area of the virtualization environment, the storage area being provisioned for a virtual machine;
- storing, by the one or more computing devices and in a header of the storage area, the first key, the header being logically separated from the data;
- encrypting, by the one or more computing devices and using a second key, the first key;
- and
- responsive to receiving a request to migrate the storage area from a first location of the virtualization environment to a second location of the virtualization environment:
- decrypting, by the one or more computing devices and using the second key, the first key;
- encrypting, by the one or more computing devices and using a third key, the first key;
- migrating, by the one or more computing devices, from the first location, and to the second location, the data, the data being encrypted in accordance with the first key;
- decrypting, by the one or more computing devices and using the third key, the first key;
- and
- encrypting, by the one or more computing devices and using a fourth key, the first key.
Dependencies are inferred from the claim text.