TECHNIQUES FOR SECURING A CHECKED-OUT VIRTUAL MACHINE IN A VIRTUAL DESKTOP INFRASTRUCTURE

• US 20120240181A1
• Filed: 03/16/2011
• Published: 09/20/2012
• Est. Priority Date: 03/16/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Sobel, William E., Barnes, Matthew R.
• Granted Patent: US 8,566,899 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Techniques for securing checked-out virtual machines in a virtual desktop infrastructure (VDI) are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for securing a checked-out guest virtual machine including receiving a request for checking-out a guest virtual machine hosted by a server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element. The method for securing a checked-out guest virtual machines may also include configuring a security module for the guest virtual machine in order to secure the guest virtual machine and providing the security module to the guest virtual machine when the guest virtual machine is checked-out.

Claims

1. A method for securing a checked-out guest virtual machine comprising:

receiving a request for checking-out a guest virtual machine hosted by a server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element;

configuring a security module for the guest virtual machine in order to secure the guest virtual machine; and

providing the security module to the guest virtual machine when the guest virtual machine is checked-out.

2. The method of claim 1, further comprising transmitting a probe packet to the client network element to gather information associated with the client network element.

3. The method of claim 2, wherein the security module for the guest virtual machine is configured based at least in part on the information associated with the client network element.

4. The method of claim 2, wherein the information associated with the client network element comprise at least one of virtualization platform, hypervisor, security information, vulnerability, rights, storage, CPU utilization, memory, and network Input/Output (I/O).

5. The method of claim 4, wherein the security information associated with the client network element comprises at least one of security application, manufacturer, version, date, history, antivirus, antispam, antimalware, and interface.

6. The method of claim 1, further comprising determining whether a security application is associated with the client network element.

7. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an interface for the security module to interact with the client network element.

8. The method of claim 7, wherein the interface for the security module is configured to interact with a security application associated with the client network element.

9. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an interface for the security module to interact with the server network element.

10. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring a full version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

11. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring a partial version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

12. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an updated version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

13. The method of claim 2, further comprising determining rights associated with the client network element based at least in part on the information associated with the client network element.

14. The method of claim 13, further comprising displaying a check-out error message based at least in part on the determination that the client network element does not have rights.

15. At least one non-transitory processor readable storage medium for storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1.

16. A system for securing a checked-out guest virtual machine comprising:

one or more processors communicatively coupled to a network;

wherein the one or more processors are configured to;

receive a request for checking-out a guest virtual machine hosted by a server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element;

configure a security module for the guest virtual machine in order to secure the guest virtual machine; and

providing the security module to the guest virtual machine when the guest virtual machine is checked-out.

17. The system of claim 16, wherein the one or more processors are further configured to:

transmit a probe packet to the client network element to gather information associated with the client network element.

18. The system of claim 17, wherein the security module is configured based at least in part on the information associated with the client network element.

19. The system of claim 16, wherein the one or more processors are further configured to:

determine whether a security application is associated with the client network element.

20. The system of claim 17, wherein the one or more processors are further configured to:

determining rights associated with the client network element based at least in part on the information associated with the client network element.