Computing instance migration

Patent metadata

Field	Value
Publication number	US-9712503-B1
Application number	US-201514666225-A
Country	US
Kind code	B1
Filing date	Mar 23, 2015
Priority date	Mar 23, 2015
Publication date	Jul 18, 2017
Grant date	Jul 18, 2017

Abstract

Technology for migration of a computing instance is provided. In one example, a method may include receiving instructions to initiate migration of the computing instance from a first host to a second host. A first message for sending to the first host may be generated which includes instructions to send data representing the computing instance to the second host. The first message may further include encryption information for use in deriving at least one key for encrypting communications to the second host from the first host. A second message for sending to the second host may be generated which includes instructions to receive the data representing the computing instance from the first host. The second message may further include information for use in deriving at least one key for decrypting communications from the first host. The first and second messages may be sent to the respective first and second hosts.

First claim

What is claimed is:

1. A computing device for secured migration of a computing instance, comprising:
a processor;
a memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable by the processor to:
receive instructions at a migration authority to initiate migration of the computing instance from a first host to a second host, the instructions identifying the first and second hosts;
generate a first message at the migration authority for transmission to the first host, the first message including instructions to send data representing the computing instance to the second host, the first message further including a nonce and a derivation function for deriving at least one key for encrypting communications from the first host to the second host;
generate a second message at the migration authority for transmission to the second host, the second message including instructions to receive the data representing the computing instance from the first host, the second message further including a nonce and a derivation function for deriving at least one key for decrypting communications from the first host to the second host;
encrypt the first message with a public key of the first host and the second message with a public key of the second host; and
send the first and second messages to the first and second hosts to complete a three-way handshake between the first host, the second host, and the migration authority wherein the three-way handshake is configured to initiate transactions and establish a connection between the first host and the second host.

2. The computing device of claim 1 , wherein the instructions included in the first and second messages further instruct the first and second hosts to use the nonce in generating a symmetric key for encrypting and decrypting the data representing the computing instance to be sent between the first and second hosts.

3. The computing device of claim 1 , wherein the derivation function uses the nonce in combination with one or more identifiers associated with the first or second hosts to generate public and private keys to encrypt and decrypt the data representing the computing instance.

4. The computing device of claim 1 , wherein the first message further instructs the first host to encrypt the data at a transport layer.

5. The computing device of claim 1 , wherein the first message further instructs the first host to individually and separately encrypt each message of the data to be sent to the second host with a different key as derived using the derivation function and the nonce.

6. A computer implemented method for migration of a computing instance using a processor of the computer, the method comprising:
identifying instructions to initiate migration of the computing instance from a first host to a second host;
generating a first message, using the processor, for sending to the first host, the first message including instructions to send data representing the computing instance to the second host, the first message further including encryption information for use by the first host in deriving at least one key for encrypting communications to the second host from the first host wherein the encryption information comprises a nonce and a derivation function;
generating a second message, using the processor, for sending to the second host, the second message including instructions to receive the data representing the computing instance from the first host, the second message further including encryption information for use by the second host in deriving at least one key for decrypting communications from the first host wherein the encryption information comprises a nonce and a derivation function;
encrypt the first message with a public key of the first host and the second message with a public key of the second host; and
sending the first and second messages to the respective first and second hosts to complete a three-way handshake between the first host, the second host, and a migration authority wherein the three-way handshake is configured to initiate transactions and establish a connection between the first host and the second host.

7. The method of claim 6 , wherein:
generating the first and second messages further comprises generating the nonce for use in deriving a plurality of keys for encrypting and decrypting the data according to a key derivation function known at and common to the first and second hosts, and
sending the first and second messages comprises: signing and encrypting the first and second messages; and sending the first and second messages independently of one another.

8. The method of claim 7 , further comprising instructing the first host to use the nonce in combination with an identifier associated with the second host to derive the at least one key to encrypt the data, the combination including a concatenation of the identifier with the nonce and a time stamp.

9. The method of claim 7 , further comprising instructing the second host to use the nonce in combination with a first host public key to derive the at least one key to decrypt the data, the combination including a concatenation of the first host public key with the nonce and a time stamp.

10. The method of claim 7 , wherein the first message further includes instructions to use the nonce in a key derivation sequence to generate a series of unique keys for individually and separately encrypting each message of the data at the first host, and wherein the second message further includes instructions to use the nonce to generate the series of unique keys for individually and separately decrypting each message of the data from the first host at the second host.

11. The method of claim 6 , wherein the encryption information for use in encrypting communications to the second host from the first host included in the first message comprises a nonce, and the encryption information for use in decrypting communications from the first host also comprises the nonce.

12. The method of claim 11 , wherein the first message further comprises a public key of the second host and the second message further comprises a public key of the first host.

13. The method of claim 12 , wherein the public keys of the first and second hosts are public keys of private-public asymmetric key pairs for use in secure exchange of symmetric keys which protect the data representing the computing instance.

14. The method of claim 6 , further comprising instructing: the first host to send the data representing the computing instance to the second host; the second host to receive the data representing the computing instance from the first host; and the first and second hosts to refrain from sending or receiving the data representing the computing instance in an absence of instructions from a migration authority, and wherein the instructions from the migration authority are idempotent, non-replayable instructions.

15. A system for migration of a computing instance, comprising:
a first processor and memory with instructions to execute a first host configured to:
receive instructions from a migration authority to initiate migration of the computing instance to a second host;
receive a message from the migration authority, the message including instructions to send data representing the computing instance to the second host, the message including a nonce and a derivation function for use in generating at least one key for encrypting the data to be sent in a communication from the first host to the second host;
establish a communication link with the second host;
encrypt

Assignees

• Amazon Tech Inc

Inventors

• Ahmed Khaja Ehteshamuddin
• Gupta Diwakar
• Wilson Matthew Shawn

Classifications

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title