Internal storage in cloud disk to support encrypted hard drive and other stateful features

Patent metadata

Field	Value
Publication number	US-12443543-B2
Application number	US-202418656000-A
Country	US
Kind code	B2
Filing date	May 6, 2024
Priority date	Jan 4, 2018
Publication date	Oct 14, 2025
Grant date	Oct 14, 2025

Abstract

A cloud implementation of a persisted storage device, such as a disk, is provided. The implementation supports a variety of features and protocols, in full analogy with a physical storage device such as a disk drive. The present disclosure provides for implementing standard eDrive protocols in the cloud by designing internal disk storage, referred to as a “system area,” in a virtual disk instance that the virtual disk can potentially utilize for a multitude of disk features. This internal storage can be used to implement eDrive protocols, which use the system area to maintain the necessary internal virtual disk state.

First claim

The invention claimed is:

1. A method for supporting encrypted hard drives in memory, the method comprising:
instantiating, with a virtual machine, a virtual disk instance that supports encrypted hard drive protocols;
creating a disk storage area in the virtual disk instance used to implement the encrypted hard drive protocols;
encrypting the virtual disk instance via an encryption key stored internally to the disk storage area, wherein encryption is inaccessible to a host associated with the virtual disk instance;
receiving an input/output request from a guest operating system; and
skipping the disk storage area in processing the input/output request, wherein skipping the disk storage area comprises adjusting an input/output offset for the input/output request by incrementing the input/output offset by a size of the disk storage area.

2. The method of claim 1 , wherein the disk storage area is implemented as a block backend that exposes capability to perform system input/output operations to a header of a block device.

3. The method of claim 1 , wherein the disk storage area is implemented as a block backend, the block backend comprising a first backend for writing disk-internal data to the disk storage area and a second backend for implementing the encrypted hard drive protocols.

4. The method of claim 3 , wherein the second backend is stacked above the first backend.

5. The method of claim 3 , further comprising:
accepting a secure protocol request;
translating the secure protocol request into a logical request; and
providing the logical request to the first backend.

6. The method of claim 1 , wherein the disk storage area is not directly accessible by the guest operating system.

7. The method of claim 1 , wherein the size of the disk storage area is obtained from the virtual machine.

8. The method of claim 1 , further comprising storing band metadata in the disk storage area.

9. The method of claim 8 , further comprising modifying a state of a band of the disk storage area concurrently with input/output from the virtual disk instance.

10. A system comprising:
one or more processors; and
one or more storage devices coupled to the one or more processors and storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for supporting encrypted hard drives in memory, the operations comprising:
instantiating a virtual disk instance that supports encrypted hard drive protocols;
creating a disk storage area in the virtual disk instance used to implement the encrypted hard drive protocols;
encrypting the virtual disk instance via an encryption key stored internally to the disk storage area, wherein encryption is inaccessible to a host associated with the virtual disk instance;
receiving an input/output request from a guest operating system; and
skipping the disk storage area in processing the input/output request, wherein skipping the disk storage area comprises adjusting an input/output offset for the input/output request by incrementing the input/output offset by a size of the disk storage area.

11. The system of claim 10 , wherein the disk storage area is implemented as a block backend that exposes capability to perform system input/output operations to a header of a block device.

12. The system of claim 10 , wherein the disk storage area is implemented as a block backend, the block backend comprising a first backend for writing disk-internal data to the disk storage area and a second backend for implementing the encrypted hard drive protocols.

13. The system of claim 12 , wherein the second backend is stacked above the first backend.

14. The system of claim 12 , wherein the operations further comprise:
accepting a secure protocol request;
translating the secure protocol request into a logical request; and
providing the logical request to the first backend.

15. The system of claim 10 , wherein the disk storage area is not directly accessible by the guest operating system.

16. The system of claim 10 , wherein the size of the disk storage area is obtained from a virtual machine.

17. A non-transitory computer readable medium for storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for supporting encrypted hard drives in memory, the operations comprising:
instantiating a virtual disk instance that supports encrypted hard drive protocols;
creating a disk storage area in the virtual disk instance used to implement the encrypted hard drive protocols;
encrypting the virtual disk instance via an encryption key stored internally to the disk storage area, wherein encryption is inaccessible to a host associated with the virtual disk instance;
receiving an input/output request from a guest operating system; and
skipping the disk storage area in processing the input/output request, wherein skipping the disk storage area comprises adjusting an input/output offset for the input/output request by incrementing the input/output offset by a size of the disk storage area.

18. The non-transitory computer readable medium of claim 17 , wherein the disk storage area is implemented as a block backend, the block backend comprising a first backend for writing disk-internal data to the disk storage area and a second backend for implementing the encrypted hard drive protocols.

Assignees

• Google Llc

Inventors

• Richey Joseph
• Halcrow Michael
• Karamov Sergey

Classifications

• G06F2221/2107

  File encryption · CPC title

• G06F3/064

  Management of blocks · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F3/0676

  Magnetic disk device · CPC title