--- name: vpc-hpcs_deprec title: Secure data migration for Hyper Protect Virtual Servers from VPC to on-premises description: This comprehensive guide walks you through the process of securely migrating data from your Hyper Protect Virtual Servers instance that is running on IBM Cloud VPC to an on-premises environment. last-updated: 2026-08-06 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Secure data migration for Hyper Protect Virtual Servers from VPC to on-premises {: #migration_guide} This comprehensive guide walks you through the process of securely migrating data from your Hyper Protect Virtual Servers instance that is running on IBM Cloud VPC to an on-premises environment. Hyper Protect Virtual Servers cloud data volumes are fully encrypted using user‑provided seed values, ensuring that the data can be decrypted only by the originating user. These encrypted volumes can be transferred to an on‑premises environment preserving complete confidentiality. Decryption of the transferred volumes is only possible within a [IBM Confidential Computing Container Runtime](https://www.ibm.com/docs/en/ccrt) or [IBM Confidential Computing Container Runtime for Red Hat Virtualization Solutions](https://www.ibm.com/docs/en/ccrv/1.1.x) on‑premises deployment, because the [LUKS decryption passphrase](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-mng-data&format=markdown) is generated exclusively inside the Secure Execution boundary of the HPVS instance. The Secure Execution boundary is designed to protect in‑memory secrets from tampering and inspection, including memory dumping or access attempts by system administrators or the hypervisor. As a result, encryption keys and passphrases remain isolated and protected throughout the lifecycle of the HPVS instance. The migration steps that are described in this guide are valid only until the End of Service (EOS) window. For more information, see the [Service deprecation announcement](https://cloud.ibm.com/docs/vpc?topic=vpc-ichpcs_deprecated_anmt&format=markdown). {: important} ## Prerequisites {: #migration_prereq} Make sure that you have the following: - [VPC SE VSI]{: tag-purple} Active IBM Cloud account with HPVS instance - [VPC NON SE VSI]{: tag-green} A virtual server instance running on IBM Cloud with `qemu-utils` package installed - [VPC NON SE VSI]{: tag-green} Sufficient storage space to accommodate the volume snapshots in the machine from which you do `ssh` to the VSI - [VPC NON SE VSI]{: tag-green} [VPC SE VSI]{: tag-purple} Administrative access to both cloud and on-premises environments - Original contract and seed files that are used for HPVS deployment on IBM Cloud - Backup verification: Confirm that you have recent backups of your data on the HPVS instance (IBM Cloud deployment) - Downtime planning: It is recommended to schedule a maintenance window and avoid modification to the volume during migration. - Network connectivity: Ensure secure transfer mechanism (VPN, direct Link, or secure file transfer) between the machine for volume snapshot to the on-prem machine - Required tools: Install `qemu-utils` on your virtual server instance: - For Ubuntu or Debian: ```bash sudo apt-get update && sudo apt-get install -y qemu-utils ``` {: codeblock} - For RHEL or CentOS: ```bash sudo yum install -y qemu-img ``` {: codeblock} ## Migration workflow diagram {: #migration_guide_diagram} ![Migration workflow diagram](images/migration_workflow_hpvs.svg "Migration workflow diagram"){: caption="Migration workflow diagram" caption-side="bottom"} ## Procedure {: #migration_guide_procedure} ### Step 1: Taking the snapshot of the encrypted disk volume {: #step1_snapshot_volume} Take a volume snapshot of the encrypted disk volume that is attached to the HPVS instance. For more information, see [Creating Block Storage for VPC snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-create&interface=ui&format=markdown). ### Step 2: Creating a virtual server instance with QEMU using the snapshot {: #step2_create_vsi} Create a virtual server instance by importing the snapshot. For more information, see [Creating a virtual server instance in the console](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=ui&format=markdown). ### Step 3: Identify the volume location {: #step3_identify_volume} 1. SSH into your virtual server instance: ```bash ssh -i /path/to/private_key user@ ``` {: codeblock} 1. Run the `lsblk` command to list all block devices: ```bash lsblk ``` {: codeblock} 1. Identify your volume in the output: **See the following output example:** ```text NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS vda 254:0 0 100G 0 disk ├─vda1 254:1 0 99.9G 0 part / ├─vda14 254:14 0 3M 0 part └─vda15 254:15 0 124M 0 part /boot/efi vdb 254:16 0 368K 0 disk vdc 254:32 0 44K 0 disk vdd 254:48 0 10G 0 disk ← new volume ├─vdd1 254:49 0 99M 0 part └─vdd2 254:50 0 9.9G 0 part ``` {: screen} The new volume is typically the last device listed (`vdd` in this example). {: tip} 4. Note the device path (example: `/dev/vdd`) for use in the next step. ### Step 4: Create a volume snapshot {: #step4_create_snapshot} Use QEMU tools to create a compressed snapshot of the volume. 1. Create a directory for storing the snapshot: ```bash sudo mkdir -p /var/lib/libvirt/images/hpvs/snap-image cd /var/lib/libvirt/images/hpvs/snap-image ``` {: codeblock} 1. Create the snapshot by using `qemu-img`: ```bash sudo qemu-img convert -p -f raw -O qcow2 /dev/vdd vdd.qcow2 ``` {: codeblock} **Command parameters**: - `-p`: Show progress during conversion - `-f raw`: Source format (raw block device) - `-O qcow2`: Output format (QCOW2 compressed image) - `/dev/vdd`: Source device (replace with your device path) - `vdd.qcow2`: Output file name This process can take considerable time depending on the volume size. A 10 GB volume typically takes 5-15 minutes. {: note} 1. Verify that the snapshot was created successfully: ```bash ls -lh vdd.qcow2 qemu-img info vdd.qcow2 ``` {: codeblock} **Expected output**: ```text image: vdd.qcow2 file format: qcow2 virtual size: 10 GiB (10737418240 bytes) disk size: 2.5 GiB cluster_size: 65536 ``` {: screen} ### Step 5: Transfer snapshot to on-premises {: #step5_transfer_snapshot} Securely transfer the snapshot file to your on-premises environment. ```bash scp vdd.qcow2 user@on-premises-host:/var/lib/libvirt/images/hpvs/snap-image/ ``` {: codeblock} ### Step 6: Configure on-premises virtual server {: #step6_configure_onprem} Update your on-premises virtual server configuration to use the migrated volume. 1. Locate your domain XML configuration file: - For HPVS: `hpvsnew.xml` - For HPCR: `hpcrnew.xml` 1. Edit the XML file to add or update the disk configuration: **For HPVS (`hpvsnew.xml`):** ```xml hpvs-migrated
``` {: codeblock} **For HPCR (`hpcrnew.xml`):** ```xml hpcr-migrated
``` {: codeblock} **Configuration parameters**: - `type='file'`: Disk source is a file - `device='disk'`: Device type is a disk - `driver name='qemu' type='qcow2'`: Use QEMU driver with QCOW2 format - `cache='none'`: Disable caching for better data integrity - `iommu='on'`: Enable IOMMU for security - `target dev='vdb'`: Device name inside the guest - `bus='virtio'`: Use VirtIO for better performance 1. Ensure that you have the original contract and seed files used during the initial HPVS deployment.