Search

DE-102025126195-A1 - AUTHENTICATION FOR NETWORK-BASED REPLICATION OF VIRTUAL MACHINES

DE102025126195A1DE 102025126195 A1DE102025126195 A1DE 102025126195A1DE-102025126195-A1

Abstract

A procedure and system for configuring a data change filter in a virtualized environment are provided. The data change filter is installed in a hypervisor on a virtualization host, where the hypervisor runs a virtual machine. The data change filter intercepts data change operations from the virtual machine. The hypervisor includes a certificate management service that stores a private certificate for the data change filter and a public certificate for a replication processing service. The data change filter retrieves the certificates from the certificate management service, establishes an authenticated network connection with the replication processing service using these certificates, and sends the intercepted data change operations to the replication processing service over this authenticated connection. This system enables secure replication of data changes in virtualized environments.

Inventors

  • Omer Uretzky
  • Gil Barash
  • Bar-Hai Asulin
  • Roi Romy

Assignees

  • HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Dates

Publication Date
20260513
Application Date
20250704
Priority Date
20241111

Claims (20)

  1. A method comprising: Installing a data change filter in a hypervisor of a virtualization host, wherein the hypervisor runs a virtual machine, the data change filter intercepting data change operations from the virtual machine, the hypervisor comprising a certificate management service that stores a private certificate for the data change filter and a public certificate for a replication processing service; and instructing the data change filter to: retrieve the private certificate and the public certificate from the certificate management service; establish an authenticated network connection with the replication processing service using the private certificate and the public certificate; and send data change operations to the replication processing service over the authenticated network connection.
  2. Procedure according to Claim 1 , wherein instructing the data modification filter to establish the authenticated network connection includes instructing the data modification filter to: encrypt requests to the replication processing service using the private certificate; and decrypt responses from the replication processing service using the public certificate.
  3. Procedure according to Claim 1 , where the data change filter is one of several data change filters installed in the hypervisor, and each of the data change filters is instructed to retrieve the private certificate and the public certificate from the certificate management service.
  4. Procedure according to Claim 1 , which further includes: installing the certificate management service in the hypervisor of the virtualization host; and loading the private certificate and the public certificate into the certificate management service.
  5. Procedure according to Claim 4 , wherein loading the private certificate and the public certificate into the certificate management service includes instructing the certificate management service to store the private certificate and the public certificate in a file on the hypervisor, and wherein the certificate management service provides the private certificate and the public certificate from the file to the data change filter.
  6. Procedure according to Claim 1 , wherein instructing the data change filter to retrieve the private certificate and the public certificate includes instructing the data change filter to establish an interprocess communication channel between the data change filter and the certificate management service; and to transmit the certificates via the interprocess communication channel.
  7. Procedure according to Claim 1 , wherein the virtualization host is located at an active site and the procedure further comprises: instructing the replication processing service to replicate the data change operations to a backup site.
  8. Procedure according to Claim 1 , wherein the data modification operations include input/output operations for a virtual storage disk, and each of the input/output operations includes an offset of the virtual storage disk and binary data.
  9. The procedure according Claim 1 , wherein the data modification operations include input/output operations for a virtual storage disk and the data modification filter intercepts the data modification operations by asynchronously copying the input/output operations without preventing the input/output operations from being forwarded to the virtual storage disk.
  10. Device comprising: a processor; and a non-transitory, machine-readable medium storing instructions which, when executed by the processor, cause the processor to: install a data modification filter in a hypervisor, the hypervisor running a virtual machine, the data modification filter intercepting data modification operations from the virtual machine; generate an initial private certificate for the data modification filter and an initial public certificate for a replication processing service; and provide the initial private certificate and the initial public certificate for the data modification filter after the data modification filter has been installed in the hypervisor.
  11. The device according to Claim 10 , wherein the instructions further cause the processor to: generate a second public certificate for the data change filter and a second private certificate for the replication processing service; and provide the second private certificate and the second public certificate to the replication processing service.
  12. A system comprising: a first replication host located at an active site; and a virtualization host located at the active site, wherein the virtualization host includes a hypervisor, the hypervisor including a certificate management service, and wherein the virtualization host is configured to: install a first data change filter in the hypervisor, the first data change filter being configured to intercept first data change operations from a first virtual machine running on the hypervisor; provide a private certificate and a public certificate for the first data change filter from the certificate management service; establish an authenticated network connection with the first replication host using the private certificate and the public certificate; and send the first data change operations to the first replication host over the authenticated network connection.
  13. The system according to Claim 12 , where the virtualization host is configured to establish the authenticated network connection with the first replication host by asymmetric encryption of the communication with the first replication host.
  14. The system according to Claim 12 , wherein the virtualization host is further configured to: install a second data change filter in the hypervisor, wherein the second data change filter is configured to intercept second data change operations from a second virtual machine running on the hypervisor; and provide the private certificate and public certificate for the second data change filter from the certificate management service.
  15. The system according to Claim 12 , which further includes: a management host configured to: install the certificate management service in the hypervisor of the virtualization host; and load the private certificate and the public certificate into the certificate management service.
  16. The system according to Claim 12 , wherein the first data change filter includes a first process running in the hypervisor, the certificate management service includes a second process running in the hypervisor, and the virtualization host is configured to provide the private certificate and the public certificate to the first data change filter by sending the private certificate and the public certificate from the second process to the first process.
  17. The system according to Claim 12 , which further includes: a second replication host located at a backup site, the backup site being different from the active site, the first replication host being configured to replicate the initial data change operations to the second replication host.
  18. The system according to Claim 17 , which further includes: a data store located at the backup site, with the second replication host configured to log the first data change operations in the data store.
  19. The system according to Claim 12 , where the first replication host is virtual.
  20. The system according to Claim 12 , where the first replication host is physical.

Description

BACKGROUND Virtualization technology enables the execution of multiple virtual machines on a single physical host, thereby improving resource utilization and flexibility in computing environments. These virtual machines function as independent systems, each with its own operating system and applications. By abstracting the hardware resources of a physical machine, virtualization allows the creation of multiple isolated virtual environments on a single physical server. This technology has revolutionized data centers and cloud computing, enabling more efficient use of computing resources and greater scalability. The concept of virtualization has gained considerable importance in recent years due to advances in hardware and software capabilities. Modern virtualization platforms use a hypervisor, also known as a virtual machine monitor, to manage the allocation of physical resources to virtual machines. This layer of abstraction allows multiple operating systems and applications to utilize the same physical hardware without interfering with each other. Virtualization can be applied to various components of IT infrastructure, including servers, storage, and networks, thus forming the basis for flexible computing environments. Virtualization offers numerous advantages for businesses, including reduced hardware costs, improved energy efficiency, and simplified IT management. It enables the rapid deployment of new virtual machines, facilitates test and development environments, and supports legacy applications on modern hardware. Furthermore, virtualization improves business continuity by enabling easier migration of virtual machines between physical hosts. In a virtualized infrastructure, data backup and disaster recovery are crucial to protect against data loss and system failures. BRIEF DESCRIPTION OF THE DRAWINGS For a better understanding of this revelation and its benefits, reference is now made to the following descriptions in conjunction with the accompanying drawings. 1 is a block diagram of a virtualized environment according to some implementations. The 2A-2F These are block diagrams of intermediate steps in a setup process for a data change filter according to some implementations. 3 This is a flowchart of a filter setup procedure according to some embodiments. 4 This is a flowchart of a filter setup procedure according to some embodiments. The corresponding numbers and symbols in the various figures generally refer to corresponding parts, unless otherwise stated. DETAILED DESCRIPTION The following disclosure contains many different examples of the implementation of various functions. To simplify the present disclosure, specific examples of components and arrangements are described below. These are, of course, only examples and are not intended to represent a limitation. Backup systems for virtualized environments often replicate virtual machines from one location to another for disaster recovery purposes. For example, a backup system replicates a virtual machine by continuously capturing data change operations performed on the virtual machine and sending these data change operations to a backup location. Data change operations can be captured using a filter operating within the virtualization host's hypervisor. This filter, also known as a data change filter, is a software component of the hypervisor that intercepts and copies the changes made to the virtual machine's data. For instance, the data change operations might be I/O operations, and the data change filter could be an input/output (I/O) filter that intercepts the I/O operations from the protected virtual machine. By operating within the hypervisor, the filter can capture data change operations with minimal impact on the virtual machine's performance. A replication processing service retrieves the captured data change events from the filter and replicates them to the backup location. The data change events can be received from the filter via any suitable communication channel, such as a network. A replication management service monitors the backup system, including its configuration and data coordination. erungsfilters and the replication processing service. One challenge with such backup systems is ensuring that the filter capturing virtual machine data modifications can authenticate the replication processing service. The data modification filter operates at the hypervisor level and can access sensitive information from virtual machines. It must verify that it is sending data to a trusted replication processing service and not to a potentially malicious party. Without proper authentication between the data modification filter and the replication processing service, there is a risk that sensitive data could be sent to an unauthorized recipient. The backup system uses asymmetric cryptography to authenticate replication components. In asymmetric cryptography, the components use certificate pairs for communication, with each component possessing