SYSTEMS AND METHODS FOR SECURING VIRTUAL MACHINE COMPUTING ENVIRONMENTS

• US 20120179916A1
• Filed: 08/18/2011
• Published: 07/12/2012
• Est. Priority Date: 08/18/2010
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Staker, Matt, O'Hare, Mark S., Orsini, Rick L., Mumaugh, John R.
• Granted Patent: US 9,165,137 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Systems and methods are provided for securing data in virtual machine computing environments. A request is received for a security operation from a first virtual machine operating in a host operating system of a first device. In response to receiving the request, a first security module executes the security operation, the first security module implemented in a kernel of the host operating system. The result of the security operation is provided to the first virtual machine.

Claims

1. A method for securing data, comprising:

receiving a request for a security operation from a first virtual machine operating in a host operating system of a first device;

in response to receiving the request, executing the security operation at a first security module implemented in a kernel of the host operating system; and

providing a result of the security operation to the first virtual machine.

2. The method of claim 1, wherein the request from the first virtual machine is a request from an application running in the first virtual machine.

3. The method of claim 2, wherein the request from the application running in the first virtual machine is a request for a security operation to be executed by the first security module.

4. The method of claim 1, wherein executing the security operation at the first security module comprises generating a plurality of shares, wherein each of the plurality of shares contains a distribution of data from a data set.

5. The method of claim 4, wherein executing the security operation at the first security module further comprises encrypting the data set.

6. The method of claim 1, wherein the request for the security operation from the first virtual machine is a request for a security operation to be executed by a second security module implemented in a kernel of an operating system of the first virtual machine.

7. The method of claim 6, wherein executing the security operation at the first security module comprises determining that the second security module is unable to execute the requested security operation.

8. The method of claim 7, wherein executing the security operation at the first security module comprises receiving a request, at the first security module from the second security module, to execute the requested operation.

9. The method of claim 6, wherein executing the security operation at the first security module comprises determining that the first security module is able to execute the requested security operation.

10. The method of claim 1, wherein the request from the first virtual machine is a request to secure a communication between the first virtual and a second virtual machine.

11. The method of claim 10, wherein the second virtual machine is operating in the host operating system of the first device.

12. The method of claim 1, wherein executing this security operation of the first security module comprises calling a hardware accelerator from the kernel of the host operating system.

13. The method of claim 1, wherein the first security module includes a secure parser.

14. A system for securing virtual machines, comprising:

a processor configured to;

execute a host operating system having a kernel;

receive a request for a security operation from a first virtual machine operating in the host operating system;

in response to receiving the request execute the security operation at the first security module implemented in the kernel of the host operating system; and

provide a result of the security operation to the first virtual machine.

15. The system of claim 14, wherein the request from the first virtual machine is a request from an application running in the first virtual machine.

16. The system of claim 15, wherein the request from the application running in the first virtual machine is a request for a security operation to be executed by the first security module.

17. The system of claim 14, wherein executing the security operation at the first security module comprises generating a plurality of shares, wherein each of the plurality of shares contains a distribution of data from a data set.

18. The system of claim 17, wherein executing the security operation at the first security module further comprises encrypting the data set.

19. The system of claim 14, wherein the request for the security operation from the first virtual machine is a request for a security operation to be executed by a second security module implemented in a kernel of an operating system of the first virtual machine.

20. The system of claim 19, wherein executing the security operation of the first security module comprises determining that the second security module is unable to execute the requested security operation.

21. The system of claim 20, wherein executing the security operation at the first security module comprises receiving a request, at the first security module from the second security module, to execute the requested operation.

22. The system of claim 19, wherein in executing the security operation at the first security module comprises determining that the first security module is able to execute the requested security operation.

23. The system of claim 14, wherein the request from the first virtual machine if a request to secure a communication between the first virtual machine and the second virtual machine.

24. The system of claim 23, wherein the second virtual machine is operating in the host operating system.

25. The system of claim 14, wherein executing the security operation at the first security module comprises calling a hardware accelerator from the kernel of the host operating system.

26. The system of claim 14, wherein the security module includes a secure parser.