OPTIMIZABLE FULL-PATH ENCRYPTION IN A VIRTUALIZATION ENVIRONMENT

摘要

An approach for full-path data encryption, where user virtualized computers (e.g., user VMs) are configured to communicate with other virtualized computers or VMs using IPsec protocol encryption standards. The user VMs may send a first encryption or authorization key to the other VMs, which the other VMs may use to authenticate the user VMs and encrypt and decrypt data stored to storage devices using a second encryption key. In some approaches, the other VMs may interpret or decrypt the data sent via IPsec and then perform data optimizations (e.g., compression, deduplication) on the data before decrypting/encrypting with the second key.

主权项

1. A method for optimizable full-path encryption in a virtualization environment, comprising:
receiving a network communication encrypted via an internet layer security protocol, the network communication structured as a data storage access request, the network communication comprising a first key; decrypting the network communication via the internet layer security protocol; decrypting a second key using the first key; performing one or more data optimization operations on the decrypted network communication; encrypting the network communication using the second key; and storing the encrypted network communication as encrypted data in one or more data storage devices.