Storage encryption

摘要

Storage associated with a virtual machine or other type of device may be migrated between locations (e.g., physical devices, network locations, etc.). To maintain the security of the storage, a system may manage the encryption of the storage area such that a storage area is encrypted with a first encryption key that may be maintained through the migration. A header of the storage area, on the other hand, may be encrypted using a second encryption key and the first encryption key may be stored therein. Upon transfer, the header may be re-encrypted to affect the transfer of security.

主权项

1. A non-transitory computer-readable medium storing instructions that, when executed by a processor of an apparatus, cause the apparatus to:
encrypt a storage area provisioned for a virtual or actual machine with a first encryption key, the storage area storing data; store the first encryption key in a header of the storage area, wherein the header and the data stored in the storage area are logically separate from one another; generate a second encryption key and store the second encryption key in the header; encrypt the header and the first encryption key stored therein with the second encryption key; and migrate the storage area, including:
decrypting the first encryption key with the second encryption key;encrypting the first encryption key with a third encryption key; andremoving the second encryption key from the header after encrypting the first encryption key with the third encryption key.