SYSTEMS AND METHODS FOR SECURING AND RESTORING VIRTUAL MACHINES

• US 20130268931A1
• Filed: 03/14/2013
• Published: 10/10/2013
• Est. Priority Date: 04/06/2012
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L.
• Granted Patent: US 9,916,456 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence

Abstract

Systems and methods are provided for securing a virtual machine by causing a plurality of shares of virtual machine files to be separately stored in response to a stop command. Systems and methods are also provided for restoring a data set with a cryptographic restoration application in response to a series of user inputs received when no visual indicator of the cryptographic restoration algorithm is displayed, and for restoring a data set with data shares received from another computer device in response to detecting a communication link with the device.

Claims

1. A method for securing a virtual machine, comprising:

executing a virtual machine on a host device, the virtual machine comprising virtual machine files;

generating data parsing information, wherein the data parsing information is usable to determine into which of a plurality of shares a portion of the virtual machine files will be placed and how the portion will be encrypted;

in response to receiving a command to stop the virtual machine;

generating the plurality of shares based on the data parsing information;

causing each of the plurality of shares to be stored in respective separate storage locations;

wherein the virtual machine files are restorable by accessing a threshold number of the plurality of shares.

2. The method of claim 1, wherein the host device is a handheld computing device.

3. The method of claim 1, wherein the virtual machine files comprise at least one of a log file, a virtual machine BIOS status file, a virtual disk file, a paging file, a snapshot state file, a suspended state file, and a configuration file.

4. The method of claim 1, wherein the command to stop the virtual machine comprises at least one of a save command, a shut down command, a suspend command, and a pause command.

5. The method of claim 1, wherein the command to stop the virtual machine is issued by a user of the host device.

6. The method of claim 1, wherein the command to stop the virtual machine is issued by a processor of the host device without a substantially contemporaneous command from a user of the host device.

7. The method of claim 1, wherein generating the plurality of shares based on the data parsing information comprises:

identifying a plurality of portions of the virtual machine files; and

encrypting each of the plurality of portions to form the plurality of shares.

8. The method of claim 1, wherein generating the plurality of shares based on the data parsing information comprises:

encrypting the virtual machine files; and

identifying a plurality of portions of the encrypted virtual machine files to form the plurality of shares.

9. The method of claim 1, wherein the data parsing information specifies a deterministic technique for determining into which of the plurality of shares the portion of the virtual machine files will be placed.

10. The method of claim 1, wherein the data parsing information specifies a deterministic technique for determining into which position within each of the plurality of shares the portion of the virtual machine files will be placed.

11. The method of claim 1, wherein the data parsing information specifies a substantially random technique for determining into which of the plurality of shares the portion of the virtual machine files will be placed.

12. The method of claim 1, wherein the data parsing information specifies a substantially random technique for determining into which position within each of the plurality of shares the portion of the virtual machine files will be placed.

13. The method of claim 1, wherein the separate storage locations include a plurality of separate storage locations on the host device.

14. The method of claim 1, wherein the separate storage locations include a plurality of separate storage locations on one or more devices remote from the host device.

15. The method of claim 1, wherein the separate storage locations include at least one storage location on the host device and at least one storage location on a device remote from the host device.

16. The method of claim 1, further comprising:

prior to executing the virtual machine on the host device;

receiving a second plurality of shares; and

restoring the virtual machine files from the second plurality of shares using data restoring information that determines how to decrypt and arrange portions from the plurality of shares to form the virtual machine files.

17. The method of claim 16, wherein the second plurality of shares is received from one or more devices remote from the host device.

18. The method of claim 17, wherein the one or more devices remote from the host device include one or more data servers.

19. The method of claim 17, wherein the separate storage locations in which the plurality of shares are respectively stored are located on the one or more devices remote from the host device from which the second plurality of shares is received.

20. The method of claim 1, further comprising:

prior to generating data parsing information;

receiving a third plurality of shares; and

restoring an executable parsing application from the third plurality of shares;

wherein the data parsing information is generated by the executable parsing application.

21. The method of claim 20, wherein the third plurality of shares is received from one or more devices remote from the host device.

22. The method of claim 21, wherein the one or more devices remote from the host device include one or more data servers.

23. The method of claim 20, wherein restoring the executable splitting application from the third plurality of shares comprises assembling the third plurality of shares according to a technique stored in and executable by the host device.

24. The method of claim 20, wherein restoring the executable parsing application from the third plurality of shares comprises assembling the third plurality of shares according to a technique specified in the third plurality of shares and executable by the host device.

25. The method of claim 1, wherein the threshold number is less than a total number of the plurality of shares.

26. The method of claim 1, wherein the data parsing information determines the size of each of the shares, wherein the size of at least one share is different from the size of at least one other share.

27. The method of claim 1, wherein the host device comprises one or more computers in a distributed architecture.

28. The method of claim 1, wherein the host device comprises one or more computers in a cloud computing environment.

29. A computer system for securing a virtual machine, comprising:

processing circuitry in communication with one or more storage locations, the processing circuitry being associated with communications circuitry for receiving communications, the processing circuitry being configured to;

execute a virtual machine on a host device, the virtual machine comprising virtual machine files;

generate data parsing information, wherein the data parsing information is usable to determine into which of a plurality of shares a portion of the virtual machine files will be placed and how the portion will be encrypted;

in response to receiving a command to stop the virtual machine;

generate the plurality of shares based on the data parsing information;

cause each of the plurality of shares to be stored in respective separate storage locations;

wherein the virtual machine files are restorable by accessing a threshold number of the plurality of shares.

30. The system of claim 29, wherein the host device is a handheld computing device.

31. The system of claim 29 wherein the virtual machine files comprise at least one of a log file, a virtual machine BIOS status file, a virtual disk file, a paging file, a snapshot state file, a suspended state file, and a configuration file.

32. The system of claim 29, wherein the command to stop the virtual machine comprises at least one of a save command, a shut down command, a suspend command, and a pause command.

33. The system of claim 29, wherein the command to stop the virtual machine is issued by a user of the host device.

34. The system of claim 29, wherein the command to stop the virtual machine is issued by a processor of the host device without a substantially contemporaneous command from a user of the host device.

35. The system of claim 29, wherein generating the plurality of shares based on the data parsing information comprises:

identifying a plurality of portions of the virtual machine files; and

encrypting each of the plurality of portions to form the plurality of shares.

36. The system of claim 29, wherein generating the plurality of shares based on the data parsing information comprises:

encrypting the virtual machine files; and

identifying a plurality of portions of the encrypted virtual machine files to form the plurality of shares.

37. The system of claim 29, wherein the data parsing information specifies a deterministic technique for determining into which of the plurality of shares the portion of the virtual machine files will be placed.

38. The system of claim 29, wherein the data parsing information specifies a deterministic technique for determining into which position within each of the plurality of shares the portion of the virtual machine files will be placed.

39. The system of claim 29, wherein the data parsing information specifies a substantially random technique for determining into which of the plurality of shares the portion of the virtual machine files will be placed.

40. The system of claim 29, wherein the data parsing information specifies a substantially random technique for determining into which position within each of the plurality of shares the portion of the virtual machine files will be placed.

41. The system of claim 29, wherein the separate storage locations include a plurality of separate storage locations on the host device.

42. The system of claim 29, wherein the separate storage locations include a plurality of separate storage locations on one or more devices remote from the host device.

43. The system of claim 29, wherein the separate storage locations include at least one storage location on the host device and at least one storage location on a device remote from the host device.

44. The system of claim 29, wherein the processing circuitry is further configured to:

prior to executing the virtual machine on the host device;

receive a second plurality of shares; and

restore the virtual machine files from the second plurality of shares using data restoring information that determines how to decrypt and arrange portion from the plurality of shares to form the virtual machine files.

45. The system of claim 44, wherein the second plurality of shares is received from one or more devices remote from the host device.

46. The system of claim 45, wherein the one or more devices remote from the host device include one or more data servers.

47. The system of claim 45, wherein the separate storage locations in which the plurality of shares are respectively stored are located on the one or more devices remote from the host device from which the second plurality of shares is received.

48. The system of claim 29, wherein the processing circuitry is configured to:

prior to generating data parsing information;

receive a third plurality of shares; and

restore an executable parsing application from the third plurality of shares;

wherein the data parsing information is generated by the executable parsing application.

49. The system of claim 48, wherein the third plurality of shares is received from one or more devices remote from the host device.

50. The system of claim 49, wherein the one or more devices remote from the host device include one or more data servers.

51. The system of claim 48, wherein restoring the executable parsing application from the third plurality of shares comprises assembling the third plurality of shares according to a technique stored in and executable by the host device.

52. The system of claim 48, wherein restoring the executable parsing application from the third plurality of shares comprises assembling the third plurality of shares according to a technique specified in the third plurality of shares and executable by the host device.

53. The system of claim 29, wherein the threshold number is less than a total number of the plurality of shares.

54. The system of claim 29, wherein the data parsing information determines the size of each of the shares, wherein the size of at least one share is different from the size of at least one other share.

55. The system of claim 29, wherein the processing circuitry comprises one or more computers in a distributed architecture.

56. The system of claim 29, wherein the processing circuitry comprises one or more computers in a cloud computing environment.