NIC-Encrypted Flow Key Management for Live VM Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The migration of virtual machine guests from a host server to a target server disrupts connectivity and encryption processes, requiring synchronization of encryption keys across servers and computing devices, which can lead to performance pauses and inefficiencies.
Innovation Solution
A computer-implemented system and method that uses flow keys and receive/send tokens, encrypted with master keys, to manage the migration of virtual machine guests, ensuring seamless encryption and decryption across servers, reducing latency by optimizing token handling and storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are synchronized across servers during migration, then security is maintained, but migration latency increases
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing encrypted flow keys (as receive tokens) on the target server before migration begins. When migration occurs, the target server already has the decryption capability, eliminating the need for real-time key synchronization and reducing migration latency while maintaining security.
Solution Approach 2:
The patent introduces receive tokens as an intermediary mechanism that bridges the security requirement and latency reduction. These tokens contain encrypted flow keys that act as a mediator, allowing the target server to decrypt traffic without direct real-time communication with the source server, thus maintaining security while minimizing migration disruption.
2Reliability
If guest migration is performed with encryption enabled, then security is maintained, but connectivity disruption increases
Solution Approach 1:
The target server performs preliminary actions by pre-receiving and storing receive tokens (encrypted flow keys) before the migration begins. This allows the target server to immediately decrypt incoming traffic once the guest is migrated, maintaining connectivity continuity without security compromise.
Solution Approach 2:
The system ensures continuity of useful action by enabling the target server to continuously decrypt and process traffic throughout the migration process. The pre-configured receive tokens allow uninterrupted decryption capability, maintaining productivity and connectivity even during the migration transition.
Data Source
AI summary
An example of a system and method implementing a live migration of a guest on a virtual machine of a host server to a target server is provided. For example, a host server may utilize a flow key to encrypt and decrypt communications with a target server. This flow key may be encrypted using a receive master key, which may result in a receive token. The receive token may be sent to the Network Interface Controller of the host server, which will then encrypt the data packet and forward the information to the target server. Multiple sender schemes may be employed on the host server, and various updates may take place on the target server as a result of the new location of the migrating guest from the host server to the target server.