INTELLIGENT SECURITY CONTROL SYSTEM FOR VIRTUALIZED ECOSYSTEMS

• US 20130138971A1
• Filed: 12/17/2012
• Published: 05/30/2013
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Entrust Corp.
• Original Assignee: HyTrust, Inc. (Entrust Corp.)
• Inventors: Budko, Renata, Prafullchandra, Hemma, Chiu, Eric Ming, Strongin, Boris
• Granted Patent: US 8,832,784 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Resources of a virtualized ecosystem are intelligently secured by defining and analyzing object handling security control information for one or more logical resources in the virtualized ecosystem and deriving therefrom object properties for each of the logical resources involved in the execution of a virtual machine in any given context within the virtualized ecosystem.

Claims

1. A method, comprising, in response to an attempt to manipulate logical assets of a virtualized ecosystem, evaluating, by a computer-based control system communicatively coupled to an underlying physical, computer-based environment abstracted by the virtualized ecosystem, controls for the manipulation being attempted according to a context within which the attempted manipulation is being performed and properties of the logical assets, the controls being embedded within the logical assets and including contextual, behavioral and environmental attributes of the logical assets;

and enforcing the controls by permitting or denying the attempted manipulation according to an outcome of the evaluation.

2. The method of claim 1, wherein the manipulation being attempted comprises bringing an un-protected virtual machine under control of the control system prior to said virtual machine being placed at rest, the method further comprising:

determining a required level of protection for the virtual machine and encryption tuning parameters;

selecting a cipher algorithm and generating encryption keys according to the encryption tuning parameters;

applying re-formatting changes, if needed;

encrypting sectors of data based on the determined level of protection;

encrypting a symmetric encryption key with an asymmetric public key; and

adding metadata along with the encrypted symmetric key into the virtual machine.

3. The method of claim 1, wherein the manipulation being attempted comprises un-protecting a protected virtual machine in a state of rest, the method further comprising retrieving metadata from a protected virtual machine disk file;

retrieving identity and/or location information of an associated asymmetric private key;

decrypting a symmetric encryption key using the asymmetric private key; and

decrypting the protected virtual machine disk file with the symmetric encryption key.

4. The method of claim 1, wherein the controls include entitlements, access policies and use policies for the logical assets.

5. The method of claim 1, comprising further taking actions according to results of the evaluation of the controls.

6. The method of claim 5, wherein the actions include log, quarantine, lock, scan and remediate.

7. The method of claim 1, wherein the controls are logically embedded within the logical assets.

8. The method of claim 1, wherein the controls are literally embedded within the logical assets.

9. The method of claim 1, wherein the logical assets are categorized so that logical assets with similar properties are grouped together.

10. The method of claim 9, wherein groupings of the logical assets are subject to a taxonomy of allowed relationships of the groupings into higher classes.

11. The method of claim 10, wherein the classes and taxonomies are independent of other definitions for the logical assets.

12. The method of claim 10, wherein the classes and taxonomies augment existing definitions for the logical assets.

13. The method of claim 10, wherein the controls are attached to the logical assets.

14. The method of claim 10, wherein if a subject control is not defined for a particular class, that class inherits the subject control from one of the higher classes.

15. The method of claim 10, wherein precedence order for controls within the taxonomy is given to classes at deeper layers.

16. The method of claim 9, wherein each grouping is identified through an associated label.

17. The method of claim 9, wherein groupings are defined according to a metric and controls are propagated among the logical assets based on a distance determined according to said metric.

18. The method of claim 17, wherein the distance is derived by assigning different weights to various properties of the logical assets.

19. The method of claim 17, wherein the metric comprises a weighted sum of logical asset classification characteristics.

20. The method of claim 9, wherein information regarding the physical environment on which the virtual ecosystem is instantiated is automatically obtained from external services regarding the physical environment.

21. The method of claim 1, wherein the embedded controls prescribe where, when, how and/or using what resources of the virtualized ecosystem or a physical environment which it abstracts the logical assets in which the controls are embedded can operate.

22. The method of claim 1, wherein at least some of the embedded controls define intents of respective ones of the logical assets.

23. The method of claim 1, wherein at least some of the embedded controls are compliance-related controls.

24. The method of claim 1, wherein at least some of the controls are logically embedded within at least some of the logical assets and comprise links to actual controls that are stored in a central repository.

25. The method of claim 1, wherein at least some of the controls are active controls and comprise executable code that executes when corresponding ones of the logical assets in which the active controls are embedded are instantiated.

26. The method of claim 25, wherein at least some of the active controls are used to operationally regulate behavior of corresponding ones of the logical assets based on environmental conditions.

27. The method of claim 25, wherein at least some of the active controls are used to decrypt/unprotect an associated disk file.

28. The method of claim 1, wherein the controls are assigned to virtual objects according to groupings of the logical assets.

29. The method of claim 1, wherein the controls are updated along with updates to corresponding logical assets to which they pertain and are protected through the use of digital signatures which are verified prior to updating of the controls.

30. The method of claim 1, wherein at least some of the controls concern prevention or restriction of operations that might result in unintended access of the virtualized ecosystem or data used thereby.

31. The method of claim 30, wherein the prevention or restriction of operations is provided by selective, full or minimal encryption of associated virtual machine disk files.

32. The method of claim 1, wherein the controls are verified prior to being enforced.

33. The method of claim 32, wherein enforcement of the controls is achieved by evaluating intentions specified in the controls and their context.

34. The method of claim 33, wherein the context of the controls includes operations being performed on the logical assets, the nature of the virtualized ecosystem in which the operations are being performed, date and time, resources available, and/or whether the attempted manipulations are customary for the logical assets or not.

35. The method of claim 33, wherein evaluation of the controls given the context comprises dynamically assembling control information to produce dynamically generated control maps.

36. The method of claim 35, wherein concrete control maps are developed from the dynamically generated control maps and subsequently persisted for later reference.