Runtime Based Application Security and Regulatory Compliance in Cloud Environment

• US 20140137244A1
• Filed: 02/26/2013
• Published: 05/15/2014
• Est. Priority Date: 11/13/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banerjee, Pradipta K., Billore, Ashish
• Granted Patent: US 9,183,378 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/00 Arrangements for program control, e.g. control units program control for peripheral devices G06F13/10
• CPC Class Codes: G06F 9/4856 resumption being on a different machine, e.g. task migration, virtual machine migration G06F9/5088 takes precedence
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

A mechanism is provided in a data processing system for runtime based application security. The application runtime environment executing within a virtual machine on the data processing system receives notification of a change in execution environment for the virtual machine. Responsive to determining the virtual machine is being migrated to a virtualized environment based on the notification of a change in execution environment, the application runtime environment dynamically modifies execution of an application in the application runtime environment, wherein the application comprises a set of application modules.

Claims

1. A method, in a data processing system, for runtime based application security, the method comprising:

receiving, by an application runtime environment executing within a virtual machine on the data processing system, notification of a change in execution environment for the virtual machine; and

responsive to determining the virtual machine is being migrated to a virtualized environment based on the notification of a change in execution environment, dynamically modifying, by the application runtime environment, execution of an application in the application runtime environment, wherein the application comprises a set of application modules.

2. The method of claim 1, wherein modifying execution of applications in the application runtime environment comprises disabling functionality of at least one application module within the set of application modules.

3. The method of claim 1, wherein modifying execution of applications in the application runtime environment comprises disabling at least one module or service executing in the application runtime environment.

4. The method of claim 1, wherein modifying execution of applications in the application runtime environment comprises:

querying a service registry for an alternate version of a software module with enhanced security; and

deploying the alternate version of the software module in the application runtime environment.

5. The method of claim 1, wherein each software module in the set of software modules has a security attribute that indicates whether the software module can be run in a virtualized environment.

6. The method of claim 5, wherein modifying execution of applications in the application runtime environment comprises:

identifying a given software module in the set of software modules with a security attribute indicating the given software module cannot be rim in a virtualized environment;

querying a service registry for an alternate version of the given software module, wherein the alternate version of the given software module has a security attribute indicating the alternate version of the given software module can be run in a virtualized environment; and

deploying the alternate version of the given software module in place of the given software module.

7. The method of claim 1, further comprising:

responsive to determining the virtual machine has been migrated to a virtualized environment based on the notification of a change in execution environment, requesting, by the application runtime environment, enhanced data isolation from the execution environment.

8. The method of claim 1, further comprising:

responsive to determining the virtual machine has been migrated to a virtualized environment based on the notification of a change in execution environment, requesting, by the application runtime environment, additional security from the execution environment.

9. The method of claim 1, wherein determining the virtual machine is being migrated to a virtualized environment comprises determining the virtual machine is being migrated from a private cloud to a public cloud.

10. The method of claim 1, wherein determining the virtual machine is being migrated to a virtualized environment comprises determining the virtual machine is being migrated from a physical machine to a virtual environment.

11-32. -32. (canceled)