Redirection of Information from Secure Virtual Machines to Unsecure Virtual Machines

• US 20120054744A1
• Filed: 05/09/2011
• Published: 03/01/2012
• Est. Priority Date: 05/10/2010
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Pratt, Ian, Singh, Manbinder Pal, Mohammad, Imtiaz
• Granted Patent: US 8,869,300 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

The present invention is directed towards methods and systems for redirecting an access request to an unsecure virtual machine. A computing device may execute a hypervisor hosting a secure virtual machine and an unsecure virtual machine. A control virtual machine, hosted by a hypervisor executing on the computing device, may intercept a request to access an unsecure resource. The unsecure resource may include one of: a file, an application and an uniform resource locator (URL). The control virtual machine may further determine that the request originates from a secure virtual machine executing on the computing device. The control virtual machine may redirect, responsive to the determination, the request to an unsecure virtual machine executing on the computing device, whereupon the unsecure virtual machine may provide access to the requested unsecure resource.

Claims

1. In a computing device executing a hypervisor hosting a secure virtual machine and an unsecure virtual machine, a method for redirecting an access request to an unsecure virtual machine, comprising:

intercepting, by a control virtual machine hosted by a hypervisor executing on a computing device, a request to access an unsecure resource, the unsecure resource comprising one of;

a file, an application and an uniform resource locator (URL);

determining, by the control virtual machine, that the request originates from a secure virtual machine executing on the computing device;

redirecting, by the control virtual machine responsive to the determination, the request to an unsecure virtual machine executing on the computing device; and

accessing, via the unsecure virtual machine, the requested unsecure resource.

2. The method of claim 1, wherein intercepting the request comprises intercepting the request by a control program of the control virtual machine, the control program executing on a processor of the computing device.

3. The method of claim 1, wherein intercepting by the control virtual machine comprises intercepting, by a control virtual machine hosted by a type 1 hypervisor executing on the computing device, the request.

4. The method of claim 1, further comprising initiating, by an application executing on the secure virtual machine, the request for the unsecure resource.

5. The method of claim 1, further comprising determining whether a virtual machine is secure based on one of:

an application executing on the virtual machine, an identity of a user accessing the virtual machine, a level of access granted to the virtual machine for accessing one or more resources, and a risk level assigned to the virtual machine.

6. The method of claim 1, further comprising determining whether a requested resource is secure based on one of:

file-type association between a requested file and an application, a configuration file of resources, a security setting of the requested resource, an identity of a website corresponding to the requested resource, an identity of a location corresponding to the requested resource, and an identity of a host corresponding to the requested resource.

7. The method of claim 1, wherein redirecting the request further comprises redirecting one of:

a cookie and a security token with the request.

8. The method of claim 1, wherein accessing the requested resource comprises one of:

downloading a requested file to the unsecure virtual machine, opening a requested file on the unsecure virtual machine, executing a requested application on the unsecure virtual machine, and navigating to a website identified by a requested URL from the unsecure virtual machine.

9. The method of claim 1, wherein accessing the requested resource further comprises displaying the requested resource on the secure virtual machine via a window executing on the unsecure virtual machine.

10. The method of claim 1, wherein accessing the requested resource further comprises displaying the requested resource on the unsecure virtual machine.

11. In a computing device executing a hypervisor hosting a secure virtual machine and an unsecure virtual machine, a system for redirecting an access request to an unsecure virtual machine, comprising:

a hypervisor executing on a computing device and hosting a control virtual machine, a secure virtual machine and an unsecure virtual machine,

wherein the control virtual machine is configured to;

intercept a request for access to an unsecure resource, the unsecure resource comprising one of;

a file, an application and an uniform resource locator (URL),

determine if the request originates from the secure virtual machine, and

redirecting, responsive to a determination that the request originates from the secure virtual machine, the request to the unsecure virtual machine executing on the computing device, whereupon the unsecure virtual machine provides access to the requested unsecure resource.

12. The system of claim 11, wherein the control virtual machine comprises a control program for intercepting the request, the control program executing on a processor of the computing device.

13. The system of claim 11, wherein the hypervisor comprises a type 1 hypervisor.

14. The system of claim 11, further comprising an application executing on the secure virtual machine, initiating the request for the unsecure resource.

15. The system of claim 11, wherein the control virtual machine identifies a virtual machine as secure or unsecure based on one of:

an application executing on the virtual machine, an identity of a user accessing the virtual machine, a level of access granted to the virtual machine for accessing one or more resources, and a risk level assigned to the virtual machine.

16. The system of claim 11, wherein the control virtual machine identifies a requested resource as secure or unsecure based on one of:

file-type association between a requested file and an application, a configuration file of resources, a security setting of the requested resource, an identity of a website corresponding to the requested resource, an identity of a location corresponding to the requested resource, and an identity of a host corresponding to the requested resource.

17. The system of claim 11, wherein the control virtual machine further redirects one of:

a cookie and a security token with the request.

18. The system of claim 11, wherein the unsecure virtual machine provides access to the requested resource by one of:

downloading a requested file to the unsecure virtual machine, opening a requested file on the unsecure virtual machine, executing a requested application on the unsecure virtual machine, and navigating to a website identified by a requested URL from the unsecure virtual machine.

19. The system of claim 11, wherein the secure virtual machine displays the requested resource via a window that executes on the unsecure virtual machine.

20. In a computing device executing a hypervisor hosting a secure virtual machine and an unsecure virtual machine, a method for redirecting an access request to an unsecure virtual machine, comprising:

intercepting, by a control virtual machine hosted by a hypervisor executing on a computing device, a request to access an secure resource, the secure resource comprising one of;

a file, an application and an uniform resource locator (URL);

determining, by the control virtual machine, that the request originates from a unsecure virtual machine executing on the computing device;

redirecting, by the control virtual machine responsive to the determination, the request to an secure virtual machine executing on the computing device; and

accessing, via the secure virtual machine, the requested unsecure resource.