Encrypted Swap-File Snapshots for Bare-Metal Host Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current datacenter snapshot management systems are inadequate for bare-metal machines lacking virtualized system management components, as they cannot employ secure snapshot management due to security concerns with safeguarding snapshots generated by these machines.
Innovation Solution
Employing data processing units (DPUs) at edge locations in the network to facilitate snapshotting for bare-metal host devices, which interface with cloud-based servers to manage and secure snapshots, ensuring separation from untrusted nodes and providing snapshot functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hypervisors are used for snapshot management, then secure snapshot management is achieved, but bare-metal machines cannot use this solution due to lack of virtualized system management components
Solution Approach 1:
The patent introduces a DPU as an intermediary device between bare-metal host devices and the infrastructure control plane. The DPU receives snapshot requests from the control plane, performs the actual snapshot operations on bare-metal machines, and returns results to the control plane, thereby enabling secure snapshot management without requiring hypervisors on the host devices.
2Adaptability or versatility
If DPUs are deployed at edge locations to facilitate snapshotting, then snapshot functionality is provided for bare-metal machines, but system complexity increases
Solution Approach 1:
The DPU is designed to autonomously perform snapshot operations by receiving requests from the infrastructure control plane and independently executing the snapshot creation, management, and security operations on bare-metal host devices without requiring additional manual configuration or intervention.
3Reliability
If snapshots are stored remotely on network storage devices, then data security is improved, but access time and transfer speed may be reduced
Solution Approach 1:
The patent replaces traditional mechanical storage systems with remote network storage devices, substituting physical proximity-based access with network-based access. This enables secure remote storage of snapshots while maintaining accessibility through the network infrastructure.
Data Source
AI summary
An integrated circuit includes a host interface coupled to a host device executing a tenant operating system (OS) on bare metal and hardware accelerator(s) coupled to the host interface and a network interface. The hardware accelerator(s) receive, over the host interface, a snapshot request relating to a snapshot of tenant OS. Snapshot request includes a location, in a physical memory of the host device, of a swap file having contents of random access memory of the host device. The hardware accelerator(s) encrypt the swap file and initiate transfer of the encrypted swap file to a network storage device coupled to a cloud-based server. The hardware accelerator(s) send, over the network interface, to a snapshot manager hosted by the cloud-based server, metadata associated with storing the encrypted swap file in the cloud-based server, to allow the snapshot manager to manage the snapshot of the tenant OS.