Encrypting and decrypting virtual disk content using a single user sign-on

A mechanism for automatically encrypting and decrypting virtual disk content using a single user sign-on is disclosed. A method of embodiments of the invention includes receiving credentials of a user of a virtual machine (VM) provided as part of a single sign-on process to access the VM, referencing a configuration database with the received credentials of the user, determining encryption and decryption policy settings for the VM from the configuration database, and at least one of encrypting or decrypting, by the VM, files of the VM based on the determined encryption and decryption policy settings.

TECHNICAL FIELD

The embodiments of the invention relate generally to virtualization systems and, more specifically, relate to automatically encrypting and decrypting virtual disk content using a single user sign-on.

BACKGROUND

Generally, the concept of virtualization in information processing systems allows multiple instances of one or more operating systems to run on a single system, even though each operating system (OS) is designed to have complete, direct control over the system and its resources. Virtualization is typically implemented by using software (e.g., a VM monitor, or a “VMM”) to present to each OS a “VM” (“VM”) having virtual resources, including one or more virtual processors, that the OS may completely and directly control, while the VMM maintains a system environment for implementing virtualization policies such as sharing and/or allocating the physical resources among the VMs (the “virtualization environment”). Each OS, and any other software, that runs on a VM is referred to as a “guest” or as “guest software,” while a “host” or “host software” is software, such as a VMM, that runs outside of the virtualization machines.

The virtualization technologies have wide applications in the computer field with the development of computer systems. For example, such virtualization technologies can be used to implement a virtual desktop application which runs within a VM of a host and accessed from a client over a network, such as, for example, RHEV-M available from Red Hat, Inc. of Raleigh, N.C.

Typically, in such a configuration, after a client machine starts up, a user has to log onto a Web portal via a Web browser to select a VM (e.g., a virtual desktop) to be launched and accessed by the client. That is, the user needs to be authenticated both against the web portal to get a list of Vms, and afterward against the VM logon process. Usually on enterprise installations, both the web portal and the VM credential are kept in a centralized directory service. However, mechanisms exist today that allow for a single sign-on procedure for the user of a VM. The single sign-on procedure allows a user of the VM to be authenticated at a controller managing the VM and subsequently having the user's credentials passed on to an active directory server for use in further authentication procedures for the user without the user's knowledge and having to participate in additional sign-on procedures.

Currently, single sign-on mechanisms do not encompass additional security features that a VM may want to implement to protect the files of the VM. For instance, if additional security for the files of the VM, such as encryption and decryption of those files is desired, then additional time may be spent providing credentials for that security and managing the security process. As such, a mechanism to integrate security features for files of a VM, such as encryption and decryption of such files, with the single sign-on process for the VM would be beneficial.

DETAILED DESCRIPTION

Embodiments of the invention provide a mechanism for automatically encrypting and decrypting virtual disk content using a single user sign-on. A method of embodiments of the invention includes receiving credentials of a user of a virtual machine (VM) provided as part of a single sign-on process to access the VM, referencing a configuration database with the received credentials of the user, determining encryption and decryption policy settings for the VM from the configuration database, and at least one of encrypting or decrypting, by the VM, files of the VM based on the determined encryption and decryption policy settings.

Embodiments of the invention provide a mechanism for automatically encrypting and decrypting virtual disk content using a single user sign-on. Embodiments of the invention extend the single sign-on process to include and automate the additional security of encryption and decryption of files associated with a VM. Specifically, embodiments of the invention bootstrap onto the existing single sign-on process another process to authenticate for and automatically perform encryption and decryption according to configurations established beforehand at a controller.

FIG. 1is a block diagram illustrating an example of a network configuration according to one embodiment of the invention. Referring toFIG. 1, network configuration100includes, but is not limited to, one or more clients101communicatively coupled to a remote server or a cluster of host machines104over a network103. Network103may be a local area network (LAN) or a wide area network (WAN) and may be a combination of one or more networks. Client101can be any computer system in communication with host machine104for remote execution of applications at host machine104.

Generally, a client, such as client101, can be a computer system in communication with host machine104for remote execution of applications hosted by host machine104. Thus, input data (e.g., mouse and keyboard input) representing application commands is received at the client and transferred over network103to host machine104. In response to client side data, an application (e.g., desktop application108) can generate output display commands in the form of executable instructions. The output display commands can then be transmitted with an optional compression back to the remote client and a remote display driver of the remote client can collect the commands and generate corresponding commands for rendering at a display device of the client. Note that a desktop application is utilized herein as an example; however, any other application may also be applied.

In one embodiment, host machine104is configured to host one or more VMs (VMs)107, each having one or more desktop applications108(e.g., desktop operating system). Desktop application108may be executed and hosted by an operating system within a VM107. Such an operating system in VM107is also referred to as a guest operating system. Multiple guest operating systems and the associated VMs may be controlled by another operating system (also referred to as a host OS). Typically, a host OS represents a VM monitor (VMM) (also referred to as a hypervisor) for managing the hosted VMs. A guest OS may be of the same or different type with respect to the host OS. For example, a guest OS may be a Windows™ operating system from Microsoft and a host OS may be a Linux operating system available from Red Hat.

VM107can be any type of VM, such as, for example, hardware emulation, full virtualization, para-virtualization, and operating system-level virtualization VMs. Different VMs107hosted by host machine104may have the same or different privilege levels for accessing different resources.

In some embodiments, system100may be implemented as part of a server or a cluster of servers within a data center of an enterprise entity. It allows enterprises the benefit of centralized desktops without the need to change their applications or infrastructure. Enterprises benefit from an improvement in the manageability, security and policy enforcement for their desktop environment, and consequently, realize a significant reduction in the desktop TCO (total cost of ownership). In other embodiments, system100may be implemented in a single machine, which both controls and hosts VMs107.

In one embodiment, host machine104and client101may be managed by a control machine102(also referred to as a management server or system). For example, in one embodiment, host machine104may be implemented as a VDS (virtual desktop server) while control machine102may be implemented as a VDC (virtual desktop controller) server.

Referring back toFIG. 1according to one embodiment, prior to launching a VM107, the VM is defined and configured within control machine102, for example, by an administrator. For example, a VM107may be defined and configured to be associated with client101and/or a user of client101. Such configuration information may be stored in a configuration database111of control machine102. An example of the configuration database is shown inFIG. 2.

When client101is registered with control machine102, client101may be identified via its IP address, name, UUID (universally unique identifier), or other stronger mechanisms (e.g., a locally installed agent with a certificate). Note that a client101does not have to be specifically registered with the system. Rather, a client101can be identified by a range definition or a wildcard, etc. that represents one or more groups of clients. That is, a client101may register as a member of one or more groups of clients (e.g., a member of a particular domain). Each group of clients may be associated with one or more VMs or a pool of VMs.

During initialization of a VM107, a single sign-on process for the VM107may be implemented so that an user of the VM107at client101does not have to provide credentials multiple times in order to access and use the VM107. The sign-on by a user is necessary to verify the authenticity of a user wanting to access a VM107. The sign-on procedure provides security for system100. Before the implementation of the single sign-on process, an user may have been required to provide their credentials multiple times to authenticate at the client101, the control machine102, and at the logon process running inside the VM OS (e.g., Microsoft™ Windows™ logon process), to name a few examples. However, with the advent of the single sign-on process, the credentials of the user, once provided and authenticated, are automatically passed between these components so that the user can experience improved performance and less interruption from system100.

Embodiments of the invention extend the single sign-on process to include and automate the additional security of encryption and decryption of files associated with a VM107. Previously, to enable the additional security of encrypting and decrypting individual files associated with a VM107, additional authentication steps were required, as well as cumbersome management responsibilities, to identify and configure the particular files to be encrypted and/or decrypted. However, embodiments of the invention bootstrap, onto the existing single sign-on process, another process to authenticate for and automatically perform encryption and decryption per user according to configurations established beforehand at a controller.

Referring back toFIG. 1, when client101starts up, a management module106running within client101may communicate with control machine102, indicating that the client101is starting up. For example, management module106may be implemented as a part of communication stack, such as a SPICE™ agent. In one embodiment, management module106may optionally be configured to subsequently launch a remote access program such as a SPICE session to access a VM. Alternatively, controller110may periodically poll (e.g., ping) client101in order to determine whether client101is starting up.

For example, a management system such as control machine102can periodically ping a client to detect whether the client is starting up. Typically, a communication stack of a client such as a TCP/IP stack usually can start responding to the ping before the client finishes the entire startup process and is available for a user to start working at the client. Alternatively, the management system may be notified by a local agent (e.g., manager106of client101) installed on the client (and configured to start as early as possible) that the client is going up (or the management system periodically polls the agent for such an indication).

When a user initially attempts to start a VM107, they are provided with a connection to control machine102. Over this connection, the controller110requests the user's identification and password for authentication with directory server115. In one embodiment, the directory server115may be a Kerberos server, a Microsoft™ Active Directory server, or any other standard means of authentication. The directory server115authenticates the user via a supplied ID and password from the user, and informs the controller110of this authentication. As part of a single sign-on process, the controller110allows the user to proceed with starting the VM107and, in some cases, provides the user with a list of VMs107, which the user is authenticated against, to select for start up. At this point, the authenticated credentials are automatically passed from the controller110to the host machine104that runs the selected VM107, as well as to the hypervisor (not shown) managing that VM107for use in future authentications.

Embodiments of the invention then utilize the provided credentials for encryption and decryption purposes. In one embodiment, the VM may be automatically configured, with reference to configuration database111, to decrypt encrypted files associated with the VM when the VM is detected starting up (e.g., having an “auto decrypt” flag or option enabled as shown inFIG. 2). Alternatively, during operations, if it is detected that a VM is down or suspended, the VM may be automatically configured to encrypt files associated with the VM. Embodiments of the invention utilize the credentials passed through from the single sign-on process to authenticate and enable this automated decryption and encryption processes.

An agent114on the VM automatically goes to the virtual disk or directories in the virtual disk and decrypts the disk or directories120,125using the credentials or key that was supplied in the log-on process and subsequently supplied by the organization directory server115. This automated encryption and decryption may be configured via policy settings at the controller110. An administrator can set a policy dictating that every user has his/her own private directory encrypted and subsequently this will happen every time the user is logged into the VM107, without the user even knowing. The files that are encrypted/decrypted in embodiments of the invention may be dependent on established policy. For instance, the encryption/decryption may apply to the entire disk120,125or just portions of the disk. In some cases, the user may dictate which files are encrypted and decrypted. Note that the credentials for the encryption/decryption process might be different than the ones needed for authenticating against the directory server115. The guest agent114and the configuration DB111are able to manage these different credentials themselves.

In embodiments of the invention, every time a user is logged into a VM107, the VM's107directories or virtual hard disks will be decrypted and each time a user disconnects from the VM, all of the data will be encrypted again. For example, today every time a user is disconnected, we automatically lock up the screen of the VM (this is implemented).

The automated encryption and decryption of embodiments of the invention based on the provided user credentials allows all data inside a virtual disk to be automatically encrypted so that no one can access data even if they gain access to the physical files and the information itself. Without the utilization of the single sign-on process, such automated encryption/decryption becomes difficult due to the additional passwords and knowledge required to accomplish the encryption/decryption process.

FIG. 2is a block diagram illustrating an example of a control machine200according to one embodiment. For example, controller200may be implemented as part of controller110ofFIG. 1and configuration database205may be implemented as part of database111ofFIG. 1. Note that some or all of the components as shown inFIG. 2may be implemented in software, hardware, or a combination of both. In one embodiment, controller200includes, but is not limited to, a registration unit201, a client detection unit202, and a management unit203.

In one embodiment, management unit203is configured to automatically provide a log-in screen for a user of the client. When credentials are received from the user at the control machine, the management unit203communicates with directory server210to accomplish authentication of the user.

Directory server210utilizes an authentication unit212to perform authentication logic that references a credentials database215to authenticate the user's provided credentials. Once the user has selected a VM to initialize, the controller is further responsible for enabling the auto-encryption and auto-decryption of embodiments of the invention. The controller passes along the provided user credentials to the VM selected by the user for initialization. Utilizing these credentials, as well as directives from the controller, the VM automatically decrypts virtual disk content associated with the selected VM. The directives from the controller include indications whether the VM is to be auto-decrypted and auto-encrypted, as well as which files should be auto-decrypted and auto-encrypted. In one embodiment, this information is stored in a configuration database205of controller200. As previously mentioned this information may be specified by the user or set via an administrative policy at the controller200.

FIG. 3is a flow diagram illustrating a method300for automatically decrypting virtual disk content using a single user sign-on according to an embodiment of the invention. Method300may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (such as instructions run on a processing device), or a combination thereof. In one embodiment, method300is performed by control machine102ofFIG. 1.

Method300begins at block310where user credentials are received at a VM as part of a single sign-on process. In one embodiment, the VM receives the credentials as part of its initialization process on a host machine. Then, at block320, the VM references a configuration database utilizing the received credentials. The configuration database is referenced to determine a decryption policy settings for the VM. In one embodiment, the policy settings may include options such as auto-encrypt, auto-decrypt, the files to be encrypted and/or decrypted, and the events that can trigger an auto-encrypt or auto-decrypt.

Subsequently, at block330, the VM is monitored for events that trigger an auto-decryption operation. In one embodiment, such events may include an initial authenticated login, an awakening from a shutdown operation, an awakening from a hibernation operation, or a return from an idle state for a predetermined period of time. Then, at block340, if an auto-decryption event is triggered, then all indicated files on the VM are decrypted based on the determined decryption policy settings.

FIG. 4is a flow diagram illustrating a method400for automatically encrypting virtual disk content using a single user sign-on according to an embodiment of the invention. Method400may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (such as instructions run on a processing device), or a combination thereof. In one embodiment, method400is performed by control machine102ofFIG. 1.

Method400begins at block410where user credentials are received at a VM as part of a single sign-on process. In one embodiment, the VM receives the credentials as part of its initialization process on a host machine. Then, at block420, the VM references a configuration database utilizing the received credentials. The configuration database is referenced to determine encryption policy settings for the VM. In one embodiment, the policy settings may include options such as auto-encrypt, auto-decrypt, the files to be encrypted and/or decrypted, and the events that can trigger an auto-encrypt or auto-decrypt.

Subsequently, at block430, the VM is monitored for events that trigger an auto-encryption operation. In one embodiment, such events may include a shutdown operation, a hibernation operation, or an idle state for a predetermined period of time. Lastly, at block440, if an auto-encryption event is triggered, then all indicated files of the VM are encrypted based on the determined policy settings for the VM utilizing the provided credentials.

The data storage device518may include a machine-accessible storage medium528on which is stored one or more set of instructions (e.g., software522) embodying any one or more of the methodologies of functions described herein. For example, software522may store instructions to perform automatically encrypting and decrypting virtual disk content using a single user sign-on by virtual machine107described with respect toFIG. 1. The software522may also reside, completely or at least partially, within the main memory504and/or within the processing device502during execution thereof by the computer system500; the main memory504and the processing device502also constituting machine-accessible storage media. The software522may further be transmitted or received over a network520via the network interface device508.