SECURITY MANAGEMENT DEVICE AND METHOD

• US 20110047541A1
• Filed: 03/06/2009
• Published: 02/24/2011
• Est. Priority Date: 03/06/2009
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Beniyama, Nobuo, Hatakeyama, Atsushi, Yamaguchi, Akihiko, Saito, Kota
• Granted Patent: US 8,321,863 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In a case where a master virtual machine, which is constructed on the basis of master information for configuring either part or all of a virtual machine, and an individual virtual machine, which is constructed on the basis of individual information that is configured partially or entirely in accordance with the master information, exist as the types of virtual machines that a physical client provides to a user terminal, a security check of a plurality of virtual machines is selectively executed, with respect to each check item, for a virtual machine of the type corresponding to the contents of the check item.

Claims

1. A security management device for managing the security of a plurality of virtual machines, which is a virtual computer environment that a physical client provides to a user terminal, the security management device comprising:

a storage device for storing a check policy prescribing either one or a plurality of check items related to a security check for the plurality of virtual machines, and a security check program; and

a Central Processing Unit (CPU) for executing, on the basis of the security check program, a security check for the plurality of virtual machines in accordance with the check policy,

wherein the CPU manages, as types of the virtual machines, a master virtual machine, which is constructed on the basis of master information for configuring either part or all of a virtual machine, and an individual virtual machine, which is constructed on the basis of individual information that is configured partially or entirely in accordance with the master information, and

wherein the CPU selectively executes the security check for each of the check items for the type of the virtual machine in accordance with contents of the check items.

2. A security management device according to claim 1,

wherein a change in the master information is reflected in the individual virtual machine subsequent to rebooting, and

wherein the CPU checks whether or not the individual virtual machine has been rebooted subsequent to the master information change.

3. A security management device according to claim 1,

wherein a priority is set beforehand in the check policy for each of the check items, and

wherein the CPU determines whether or not a security check of the check item is to be executed in accordance with the priority set for the check item.

4. A security management device according to claim 1,

wherein a check period, during which a security check is to be executed for each check item, is set beforehand in the check policy, and

wherein the CPU preferentially executes a security check for a check item, for which a security check has not been executed within the preceding check period.

5. A security management device according to claim 1,

wherein the type of the virtual machine constituting a check target of the security check is prescribed by a user beforehand in the check policy for each of the check items.

6. A security management device according to claim 1,

wherein the CPU selects the type of the virtual machine constituting the check target for the check item, for which a setting for automatically selecting the check target of the security check has been made, in the check policy, on the basis of whether or not customization can be made for each the individual virtual machine related to the check item.

7. A security management device according to claim 1,

wherein, when operation of the virtual machine targeted for a check is suspended, the CPU decides the check item of a security check to be executed for the virtual machine in accordance with a free resource capacity in the physical client.

15. A security management device according to claim 1, wherein the security check is consequent upon starting up of part of a plurality of virtual machines using another physical client with a free resource, besides the physical client.

8. A security management method for managing the security of a plurality of virtual machines, which is a virtual computer environment that a physical client provides to a user terminal, the security management method comprising:

a first step for storing a check policy prescribing either one or a plurality of check items related to a security check for the plurality of virtual machines, and a security check program; and

a second step for executing, on the basis of the security check program, a security check for the plurality of virtual machines in accordance with the check policy,

wherein a master virtual machine, which is constructed on the basis of master information for configuring either part or all of a virtual machine, and an individual virtual machine, which is constructed on the basis of individual information that is configured partially or entirely in accordance with the master information, exist as the types of the virtual machines, and

wherein, in the second step, the security check is selectively executed, for each of the check items, for the virtual machine of the type corresponding to contents of the check item.

9. A security management method according to claim 8,

wherein a change in the master information is reflected in the individual virtual machine subsequent to rebooting, and

wherein, in the second step, a check is carried out as to whether or not the individual virtual machine has been rebooted subsequent to the master information change.

10. A security management method according to claim 8,

wherein a priority is set beforehand in the check policy for each of the check items, and

wherein, in the second step, a determination is made as to whether or not a security check of the check item is to be executed in accordance with the priority set for the check item.

11. A security management method according to claim 8,

wherein a check period, during which a security check is to be executed for each check item is set beforehand, in the check policy, and

wherein, in the second step, a security check is preferentially executed for the check item, for which a security check has not been executed within the preceding check period.

12. A security management method according to claim 8, wherein the type of the virtual machine constituting the check target of the security check is prescribed for each the check item by a user beforehand in the check policy.

13. A security management method according to claim 8, wherein, in the second step, the type of the virtual machine constituting the check target is selected for the check item, for which a setting for automatically selecting the check target of the security check has been made, in the check policy, on the basis of whether or not customization can be made for each the individual virtual machine related to the check item.

14. A security management method according to claim 8, wherein, in the second step, when operation of the virtual machine targeted for a check is suspended, the check item of the security check to be executed for the virtual machine is decided in accordance with a free resource capacity in the physical client.