Securing A Virtual Environment And Virtual Machines

• US 20120054486A1
• Filed: 10/12/2010
• Published: 03/01/2012
• Est. Priority Date: 08/31/2010
• Status: Abandoned Application

• Current Assignee: Mindtree Limited (Larsen & Toubro Limited)
• Original Assignee: Mindtree Limited (Larsen & Toubro Limited)
• Inventors: Lakkavalli, Giridhar Vishwanath, Krishna, Raghuveer, Byrapura Rajanna, Kiran Kumar
• Application Number:
  US12/902,152
• Publication Number:
  US 20120054486A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A computer implemented method and system for securing a virtual environment and virtual machines in the virtual environment is provided. A credential authority server is provided for managing environment credentials of the virtual environment. A virtual machine shim is associated with each of the virtual machines, and one or more hypervisor shims are associated with one or more hypervisors. The credential authority server provides, on request, environment credentials to each of the virtual machines and the hypervisors on authorization of each of the virtual machines and the hypervisors. Each virtual machine shim associated with each of the virtual machines communicates the provided environment credentials to the hypervisor shims for validation. The hypervisors associated with the hypervisor shims validate each of the virtual machines associated with each virtual machine shim based on the communicated environment credentials to allow instantiation of each of the virtual machines in the virtual environment.

Claims

1. A computer implemented method for securing a virtual environment and virtual machines in said virtual environment, comprising:

providing a credential authority server for managing environment credentials of said virtual environment;

associating a virtual machine shim with each of said virtual machines and associating one or more hypervisor shims with one or more hypervisors, wherein each of said one or more hypervisors is configured to host and monitor one or more of said virtual machines in said virtual environment;

providing, on request, environment credentials to each of said virtual machines and said one or more hypervisors by said credential authority server on authorization of said each of said virtual machines and said one or more hypervisors by said credential authority server;

communicating said environment credentials provided to said each of said virtual machines, by each said virtual machine shim to said one or more hypervisor shims; and

validating said each of said virtual machines associated with each said virtual machine shim by said one or more hypervisors associated with said one or more hypervisor shims based on said communicated environment credentials to allow instantiation of said each of said virtual machines in said virtual environment.

2. The computer implemented method of claim 1, wherein providing said environment credentials to said each of said virtual machines and said one or more hypervisors, comprises:

receiving requests for said environment credentials from said each of said virtual machines and said one or more hypervisors by said credential authority server upon unavailability of pre-stored environment credentials in said each of said virtual machines and said one or more hypervisors respectively, wherein said credential authority server receives said requests from said each of said virtual machines and said one or more hypervisors periodically and during boot-up of said each of said virtual machines and said one or more hypervisors; and

providing said environment credentials to said each of said virtual machines and said one or more hypervisors on said authorization of said each of said virtual machines and said one or more hypervisors by said credential authority server based on one or more authorization parameters associated with said requests.

3. The computer implemented method of claim 2, wherein said one or more authorization parameters comprise a single internet protocol address associated with said requests, a range of internet protocol addresses associated with said requests, a subnet associated with said requests, a media access control address, a domain name, a hostname, and any other unique identifier.

4. The computer implemented method of claim 1, further comprising restricting said instantiation of said virtual machines by said one or more hypervisors if said one or more hypervisors fail to validate said each of said virtual machines based on said communicated environment credentials.

5. The computer implemented method of claim 1, further comprising forcefully terminating an unauthorized virtual machine from said virtual machines by said one or more hypervisors, if said virtual machine shim associated with said unauthorized virtual machine fails to communicate said environment credentials to said one or more hypervisor shims for said validation within a preconfigured period of time from instantiation of said unauthorized virtual machine.

6. The computer implemented method of claim 1, wherein said environment credentials comprise a digital certificate, a security key, and a security name and password, wherein said validation of said each of said virtual machines by said one or more hypervisors to instantiate said each of said virtual machines is based on validation of said digital certificate, said security key, and said security name and said password by said one or more hypervisor shims.

7. The computer implemented method of claim 1, wherein said credential authority server manages said environment credentials of said virtual environment locally within said virtual environment.

8. The computer implemented method of claim 1, wherein said credential authority server manages said environment credentials of said virtual environment remotely as a virtualization security service over a public network.

9. The computer implemented method of claim 1, wherein each of said one or more hypervisors is one of a native hypervisor and a hosted hypervisor, wherein said environment credentials certify said native hypervisor when said one or more hypervisors is said native hypervisor, and wherein said environment credentials certify a host operating system hosting said one or more hypervisors when said one or more hypervisors is said hosted hypervisor.

10. The computer implemented method of claim 1, further comprising storing said environment credentials in a secure data store within each of said virtual machines and said one or more hypervisors.

11. The computer implemented method of claim 1, wherein said one or more hypervisor shims manage said instantiation of said virtual machines locally from within said hypervisors in said virtual environment.

12. The computer implemented method of claim 1, wherein said one or more hypervisor shims manage said instantiation of said virtual machines on a management virtual appliance that hosts said one or more hypervisor shims in said virtual environment.

13. The computer implemented method of claim 1, further comprising:

reinstantiating one or more of said validated virtual machines in said virtual environment;

verifying whether said virtual environment is certified by each said virtual machine shim associated with each of said reinstantiated one or more virtual machines; and

terminating said reinstantiated one or more virtual machines by each said virtual machine shim if said virtual environment is uncertified.

14. The computer implemented method of claim 1, further comprising:

migrating one or more of said validated virtual machines from one of said one or more hypervisors to another one of said one or more hypervisors across said virtual environment;

verifying whether said virtual environment is certified by each said virtual machine shim associated with each of said migrated one or more virtual machines; and

terminating said migrated one or more virtual machines by each said virtual machine shim if said virtual environment is uncertified.

15. The computer implemented method of claim 1, further comprising:

migrating one or more virtual machines from a first certified hypervisor among said one or more hypervisors to a second certified hypervisor among said one or more hypervisors across said virtual environment; and

restricting instantiation of said migrated one or more virtual machines by said second certified hypervisor if said second certified hypervisor fails to validate said communicated environment credentials of said migrated one or more virtual machines.

16. The computer implemented method of claim 1, further comprising:

migrating one or more virtual machines from one of said one or more hypervisors to another one of said one or more hypervisors across said virtual environment;

verifying whether a host operating system hosting said another one of said one or more hypervisors is certified by each said virtual machine shim associated with each of said migrated one or more virtual machines; and

terminating said migrated one or more virtual machines by each said virtual machine shim if said host operating system is uncertified.

17. The computer implemented method of claim 1, further comprising:

migrating one or more virtual machines from a first host operating system hosting a first certified hypervisor among said one or more hypervisors to a second host operating system hosting a second certified hypervisor among said one or more hypervisors across said virtual environment; and

restricting instantiation of said migrated one or more virtual machines by said second host operating system hosting said second certified hypervisor if said second host operating system fails to validate said communicated environment credentials of said migrated one or more virtual machines.

18. The computer implemented method of claim 1, wherein each said virtual machine shim and said one or more hypervisor shims periodically contact said credential authority server at predetermined intervals of time for renewing said environment credentials stored in said each of said virtual machines and said one or more hypervisors.

19. The computer implemented method of claim 1, further comprising:

detecting duplication of one or more of said virtual machines in said virtual environment; and

restricting instantiation of said duplicated one or more virtual machines by said one or more hypervisors when each said virtual machine shim associated with each of said duplicated one or more virtual machines fails to send requests for said environment credentials from said duplicated one or more virtual machines to said credential authority server and/or fails to communicate said environment credentials to said one or more hypervisor shims for said validation.

20. A computer implemented system for securing a virtual environment and virtual machines in said virtual environment, comprising:

a credential authority server that manages environment credentials of said virtual environment, said credential authority server comprising a secure communication server module that receives and responds to requests for said environment credentials from said virtual machines and one or more hypervisors on authorization of each of said virtual machines and said one or more hypervisors, over secured network connections;

a virtual machine shim associated with each of said virtual machines, each of said virtual machines comprising a secure communication client that transmits said requests for said environment credentials to said credential authority server and communicates said environment credentials to one or more hypervisor shims associated with said one or more hypervisors via said virtual machine shim for validation; and

said one or more hypervisor shims associated with said one or more hypervisors, wherein each of said one or more hypervisors is configured to host and monitor one or more of said virtual machines in said virtual environment and to validate said virtual machines based on said communicated environment credentials, wherein said each of said one or more hypervisors comprises;

a secure communication client that transmits said requests for said environment credentials to said credential authority server; and

a validation module within each of said one or more hypervisor shims, wherein said validation module receives and validates said communicated environment credentials and enables said one or more hypervisors to validate said each of said virtual machines associated with each said virtual machine shim based on the communicated environment credentials to allow instantiation of said each of said virtual machines in said virtual environment.

21. The computer implemented system of claim 20, wherein said each of said virtual machines and each of said one or more hypervisors comprises a secure data store that stores said environment credentials provided by said credential authority server.

22. The computer implemented system of claim 20, wherein said credential authority server provides said environment credentials to said each of said virtual machines and said one or more hypervisors on said authorization of said each of said virtual machines and said one or more hypervisors based on one or more authorization parameters associated with said requests, wherein said one or more authorization parameters comprise a single internet protocol address associated with said requests, a range of internet protocol addresses associated with said requests, a subnet associated with said requests, a media access control address, a domain name, a hostname, and any other unique identifier, and wherein said credential authority server receives said requests from said each of said virtual machines and said one or more hypervisors periodically and during boot-up of said each of said virtual machines and said one or more hypervisors.

23. The computer implemented system of claim 20, wherein said one or more hypervisors restrict said instantiation of said virtual machines if said one or more hypervisors fail to validate said each of said virtual machines based on said communicated environment credentials.

24. The computer implemented system of claim 20, wherein said one or more hypervisors forcefully terminate an unauthorized virtual machine from said virtual machines, if said virtual machine shim associated with said unauthorized virtual machine fails to communicate said environment credentials to said one or more hypervisor shims for said validation within a preconfigured period of time from instantiation of said unauthorized virtual machine.

25. The computer implemented system of claim 20, wherein said one or more hypervisors validate said each of said virtual machines to instantiate said each of said virtual machines based on validation of said environment credentials comprising a digital certificate, a security key, and a security name and password by said one or more hypervisor shims.

26. The computer implemented system of claim 20, wherein said credential authority server manages said environment credentials of said virtual environment locally within said virtual environment.

27. The computer implemented system of claim 20, wherein said credential authority server manages said environment credentials of said virtual environment remotely as a virtualization security service over a public network.

28. The computer implemented system of claim 20, wherein each of said one or more hypervisors is one of a native hypervisor and a hosted hypervisor, wherein said environment credentials certify said native hypervisor when said one or more hypervisors is said native hypervisor, and wherein said environment credentials certify a host operating system hosting said one or more hypervisors when said one or more hypervisors is said hosted hypervisor.

29. The computer implemented system of claim 20, wherein said one or more hypervisor shims manage said instantiation of said virtual machines locally from within said hypervisors in said virtual environment.

30. The computer implemented system of claim 20, wherein said one or more hypervisor shims manage said instantiation of said virtual machines on a management virtual appliance that hosts said one or more hypervisor shims in said virtual environment.

31. The computer implemented system of claim 20, wherein each said virtual machine shim and said one or more hypervisor shims periodically contact said credential authority server at predetermined intervals of time for renewing said environment credentials stored in said each of said virtual machines and said one or more hypervisors.

32. A computer program product comprising computer executable instructions embodied in a non-transitory computer readable storage medium, wherein said computer program product comprises:

a first computer program code for providing a credential authority server for managing environment credentials of a virtual environment;

a second computer program code for associating a virtual machine shim with each of a plurality of virtual machines and for associating one or more hypervisor shims with one or more hypervisors;

a third computer program code for providing, on request, environment credentials to each of said virtual machines and said one or more hypervisors on authorization of said each of said virtual machines and said one or more hypervisors;

a fourth computer program code for communicating said environment credentials provided to said each of said virtual machines, by each said virtual machine shim to said one or more hypervisor shims; and

a fifth computer program code for validating said each of said virtual machines associated with each said virtual machine shim by said one or more hypervisors associated with said one or more hypervisor shims based on said communicated environment credentials to allow instantiation of said each of said virtual machines in said virtual environment.