Patent ID: 8868908

Claim:
A method for protecting a guest operating system (OS) image within a virtualized computing environment with a network device that is operative to perform actions, comprising: employing at least one hypervisor to trap at least one privileged action associated with each guest OS image; and if a guest OS image associated with the trapped at least one privileged action is also designated for protection, performing further actions, comprising: if at least one cryptographic key is absent for performing a cryptographic operation on data associated with the at least one privileged action, retrieving the at least one cryptographic key from at least one remotely located cryptographic service provider; storing the at least one cryptographic key in at least one cache; if at least one cryptographic module is operative to perform the cryptographic operation on the data associated with the at least one privileged action and also the cryptographic operation is valid, enabling a cryptographic module to employ the at least one cryptographic key to perform the cryptographic operation on the data associated with the at least one privileged action; and if memory storing at least an inactive portion of the guest OS image associated with the trapped at least one privileged action is determined to be dirty, encrypting the at least inactive portion of the guest OS image stored in memory, wherein the hypervisor stores the at least encrypted inactive portion of the guest OS image.