Creation and delivery of encrypted virtual disks

A method of centralized encrypted virtual disk delivery from a server to a client device, comprising:

• receiving, by a virtual disk creator executing on a server, a request from a policy engine executing on a client device to generate a virtual disk in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses, the request having encryption attributes and machine credentials identifying the client device that transmitted the request, the encryption attributes including an encryption key that includes the machine credentials, and at least one of a type of encryption and an encryption strength;
• generating, responsive to the request by the virtual disk creator, the virtual disk responsive to the request and based on disk attributes specified in the request, the request initiated by the client device;
• encrypting, responsive to the request by the virtual disk creator, the generated virtual disk using the encryption key and the machine credentials, based on the received request, the received request having encryption attributes including the encryption key and at least one of the type of encryption and the encryption strength;
• storing, by the virtual disk creator, a disk identifier, the encryption key, and the machine credentials, to a centralized database;
• transmitting, by the virtual disk creator, the encrypted virtual disk to the client device;
• receiving, by the server from the client device, an unencrypted backup virtual disk comprising an encrypted disk file of the encrypted virtual disk;
• and
• storing, by the server, the backup virtual disk in a backup storage location, the backup virtual disk comprising the encrypted disk file is recognized by an operating system of the client device as a backup disk.

A system for centralized encrypted virtual disk delivery from a server to a client device, the system comprising:

• a computing device in communication with a client device, executing a virtual disk creator, the virtual disk creator comprising a processor configured to:
• receive a request sent from a policy engine executing on a client device to generate a virtual disk in response to a determination by the client device that the client device does not comprise a secure storage area having an allocated range of secure memory addresses, the received request including encryption attributes and machine credentials identifying the client device that transmitted the request, the encryption attributes including an encryption key that includes the machine credentials, and at least one of a type of encryption and an encryption strength,
• generate the virtual disk responsive to the request and based on disk attributes specified in the request, the request initiated by the client device,
• encrypt the generated virtual disk, responsive to the request, using the encryption key and the machine credentials, based on the received request, wherein the received request includes encryption attributes including the encryption key and at least one of the type of encryption and the encryption strength, and the encryption key,
• store a disk identifier, the encryption key, and the machine credentials to a centralized database,
• transmit the encrypted virtual disk to the client device,
• receive, by the server from the client device, an unencrypted backup virtual disk comprising an encrypted disk file of the encrypted virtual disk;
• and
• store, by the server, the backup virtual disk in a backup storage location, the backup virtual disk comprising the encrypted disk file recognized by an operating system of the client device as a backup disk.