Selective encryption system and method for I/O operations
US7428636B1 · kind B1 · utility
Assignee
Inventors
Key dates
| Filing date | May 30, 2003 |
| Grant date | Sep 23, 2008 |
| Priority date | — |
| Expiry date | Mar 25, 2025 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/083
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.