FACILITATED INTROSPECTION OF VIRTUALIZED ENVIRONMENTS

• US 20100251238A1
• Filed: 03/31/2009
• Published: 09/30/2010
• Est. Priority Date: 03/31/2009
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Schuba, Christoph L., Marsland, Tim P.
• Granted Patent: US 8,356,285 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Some embodiments provide a system that manages the execution of a software component in a virtualized environment. During operation, the system monitors the execution of the software component from an external location to the virtualized environment. Next, the system assesses an integrity of the software component by comparing the monitored execution to an expected operation of the software component, wherein the expected operation is determined based on source code for the software component. Finally, the system uses the assessed integrity of the software component to facilitate the execution of the software component.

Claims

1. A computer-implemented method for managing execution of a software component in a virtualized environment, comprising:

monitoring the execution of the software component from an external location to the virtualized environment;

assessing an integrity of the software component by comparing the monitored execution to an expected operation of the software component, wherein the expected operation is determined based on source code for the software component; and

using the assessed integrity of the software component to facilitate the execution of the software component.

2. The computer-implemented method of claim 1, further comprising:

additionally monitoring execution of an identical software component to the software component from the external location; and

further assessing the integrity of the software component by comparing the monitored execution of the software component to the additionally monitored execution of the identical software component.

3. The computer-implemented method of claim 1, wherein facilitating the execution of the software component involves at least one of:

validating the execution of the software component;

debugging the software component; and

responding to an exploit of the software component.

4. The computer-implemented method of claim 1, wherein assessing the integrity of the software component involves at least one of:

detecting a deviation of the monitored execution from the expected operation of the software component; and

determining a source of the deviation from the expected operation.

5. The computer-implemented method of claim 1, wherein the software component is closed source.

6. The computer-implemented method of claim 1, wherein the software component is at least one of an operating system and an application.

7. The computer-implemented method of claim 6, wherein the execution of the operating system is monitored through a hypervisor that executes the operating system in a virtual machine.

8. The computer-implemented method of claim 6, wherein the execution of the application is monitored through a kernel that executes the application in the virtualized environment.

9. The computer-implemented method of claim 1, wherein monitoring the execution of the software component involves monitoring at least one of:

memory pages;

network packets;

system calls;

domain ranges of variables;

code modules;

data structures;

hardware events; and

input/output (I/O) events.

10. The computer-implemented method of claim 1, wherein the execution of the software component is monitored periodically, randomly, or upon detecting an event associated with the software component.

11. A system for managing an execution of a virtual machine, comprising:

a hypervisor configured to execute the virtual machine and one or more introspection modules external to the virtual machine,

wherein the one or more introspection modules are configured to;

monitor the execution of the virtual machine; and

assess an integrity of the virtual machine by comparing the monitored execution to an expected operation of the virtual machine, wherein the expected operation is determined based on source code for the virtual machine.

12. The system of claim 11,

wherein the hypervisor is further configured to execute a set of identical virtual machines to the virtual machine, and

wherein the one or more introspection modules are further configured to:

additionally monitor execution of each of the identical virtual machines; and

further assess the integrity of the virtual machine by comparing the monitored execution of the virtual machine to the additionally monitored execution of the identical virtual machines.

13. The system of claim 11, wherein the assessed integrity of the virtual machine is used to facilitate the execution of the virtual machine by:

validating the execution of the virtual machine;

debugging the virtual machine; and

responding to an exploit of the virtual machine.

14. The system of claim 11, wherein assessing the integrity of the virtual machine involves at least one of:

detecting a deviation of the monitored execution from the expected operation of the virtual machine; and

determining a source of the deviation from the expected operation.

15. The system of claim 11, wherein the virtual machine comprises a closed source operating system.

16. The system of claim 11, wherein monitoring the execution of the virtual machine involves monitoring at least one of:

memory pages;

network packets;

system calls;

domain ranges of variables;

code modules;

data structures;

hardware events; and

input/output (I/O) events.

17. The system of claim 11, wherein the execution of the virtual machine is monitored periodically, randomly, or upon detecting an event associated with the virtual machine.

18. A system for managing an execution of an application in a virtualized environment, comprising:

a kernel configured to execute the application and one or more introspection modules external to the virtualized environment,

wherein the one or more introspection modules are configured to;

monitor the execution of the application; and

assess an integrity of the application by comparing the monitored execution to an expected operation of the application, wherein the expected operation is determined based on source code for the application,

wherein the assessed integrity of the application is used to enhance security for the application.

19. The system of claim 18, wherein assessing the integrity of the application involves at least one of:

detecting a deviation of the monitored execution from the expected operation of the application; and

determining a source of the deviation from the expected operation.

20. The system of claim 19, wherein enhancing security for the application involves responding to an exploit corresponding to the source of the deviation.