Secure Server on a System with Virtual Machines

• US 20150039891A1
• Filed: 08/01/2014
• Published: 02/05/2015
• Est. Priority Date: 08/02/2013
• Status: Active Grant

• Current Assignee: OLogN Technologies AG
• Original Assignee: OLogN Technologies AG
• Inventors: IGNATCHENKO, Sergey, IVANCHYKHIN, Dmytro
• Granted Patent: US 9,948,640 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A system, an apparatus and a method for providing a secure computing environment may be provided. In one aspect, an apparatus may comprise a communication port and a computer processor coupled to the communication port. The computer processor may be configured to initialize a hypervisor, establish a first virtual machine under control of the hypervisor and execute code for a secure zone on the first virtual machine. To execute code for the secure zone, the computer processor may be further configured to verify an administrative task and execute the administrative task, which may include: establish a connection with an administrator device, ensure that the administrator device is one of a set of intended administrator devices, receive a command through the connection with the administrator device and establish a second virtual machine under control of the hypervisor. The command may relate to executing a task on the second virtual machine.

Claims

1. A computer-implemented method for providing secure computing environment on a computer processor, comprising:

initializing a hypervisor on the computer processor;

establishing a first virtual machine under control of the hypervisor; and

executing code for a secure zone on the first virtual machine, including;

verifying an administrative task, and

executing the administrative task, wherein the executing comprises;

establishing a connection with an administrator device;

ensuring that the administrator device is one of a set of intended administrator devices;

receiving a command through the connection with the administrator device, wherein the command relates to executing a task on a second virtual machine;

wherein executing the task on the second virtual machine comprises establishing the second virtual machine under control of the hypervisor.

2. The computer-implemented method of claim 1, wherein ensuring that the administrator device is one of a set of intended administrator devices comprises verifying that the administrator device contains a private key that corresponds to a public key of a set of public keys.

3. The computer-implemented method of claim 2, wherein the set of public keys are stored within data of the first virtual machine.

4. The computer-implemented method of claim 1, wherein ensuring that the administrator device is one of a set of intended administrator devices comprises attesting legitimacy of the administrator device by:

requesting an attestation certificate from the administrator device; and

verifying that the attestation certificate is issued by a trusted attestation service provider.

5. The computer-implemented method of claim 1, wherein executing the administrative task further comprises ensuring that a client administrative task running on the administrator device is one of a set of valid client administrative tasks.

6. The computer-implemented method of claim 5, wherein ensuring the client administrative task running on the administrator device is one of a set of valid client administrative tasks comprises:

receiving a hash value of the client administrative task running on the administrator device; and

checking the received hash value against a list of hash values of valid client administrative tasks.

7. The computer-implemented method of claim 1, wherein the computer processor is coupled to a non-volatile storage exclusively accessible by the secure zone, and verifying the administrative task comprises calculating a checksum of the administrative task and verifying the calculated checksum using information from the non-volatile storage.

8. The computer-implemented method of claim 7, wherein the checksum is a secure hash.

9. The computer-implemented method of claim 1, wherein the computer processor is coupled to a non-volatile storage exclusively accessible by the secure zone, and executing the administrative task further comprises generating and permanently saving information about a system configuration in the non-volatile storage and using this information on system start.

10. The computer-implemented method of claim 1, wherein executing the code for the secure zone on the first virtual machine further comprises:

establishing a connection to a client device;

verifying that the client device is allowed to establish a connection to the task being executed on the second virtual machine; and

passing the established connection to the client device to the task being executed on the second virtual machine.

11. The computer-implemented method of claim 1, wherein verifying the administrative task further comprises:

verifying that the administrative task is signed by a signature as an administrator task; and

verifying the signature of the administrative task.

12. An apparatus for providing a secure computing environment, comprising:

a communication port; and

a computer processor coupled to the communication port and configured to;

initialize a hypervisor;

establish a first virtual machine under control of the hypervisor; and

execute code for a secure zone on the first virtual machine, including;

verify an administrative task, and

execute the administrative task, wherein to execute the administrative task the computer processor is further configured to;

establish a connection with an administrator device;

ensure that the administrator device is one of a set of intended administrator devices;

receive a command through the connection with the administrator device, wherein the command relates to executing a task on a second virtual machine; and

establish the second virtual machine under control of the hypervisor.

13. The apparatus of claim 12, wherein to ensure that the administrator device is one of a set of intended administrator devices, the computer processor is further configured to verify that the administrator device contains a private key that corresponds to a public key of a set of public keys.

14. The apparatus of claim 13, wherein the set of public keys are stored within data of the first virtual machine.

15. The apparatus of claim 12, wherein to ensure that the administrator device is one of a set of intended administrator devices, the computer processor is further configured to attest legitimacy of the administrator device by:

requesting an attestation certificate from the administrator device; and

verifying that the attestation certificate is issued by a trusted attestation service provider.

16. The apparatus of claim 12, wherein to execute the administrative task the computer processor is further configured to ensure that a client administrative task running on the administrator device is one of a set of valid client administrative tasks.

17. The apparatus of claim 16, wherein to ensure that the client administrative task running on the administrator device is one of a set of valid client administrative tasks, the computer processor is further configured to:

receive a hash value of the client administrative task running on the administrator device; and

check the received hash value against a list of hash values of valid client administrative tasks.

18. The apparatus of claim 12, wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to verify the administrative task the computer processor is further configured to calculate a checksum of the administrative task and to verify the calculated checksum using information from the non-volatile storage.

19. The apparatus of claim 18, wherein the checksum is a secure hash.

20. The apparatus of claim 12, wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to execute the administrative task the computer processor is further configured to generate and permanently save information about a system configuration in the non-volatile storage and use this information on system start.

21. The apparatus of claim 12, wherein to execute the code for the secure zone on the first virtual machine, the computer processor is further configured to:

establish a connection to a client device;

verify that the client device is allowed to establish a connection to the task being executed on the second virtual machine; and

pass the established connection to the client device to the task being executed on the second virtual machine.

22. The apparatus of claim 12, wherein to verify the administrative task the computer processor is further configured to:

verify that the administrative task is signed by a signature as an administrator task; and

verify the signature of the administrative task.

23. A system for providing a secure computing environment, comprising:

an administrator device comprising a secure zone configured to execute a client administrative task;

an apparatus, comprising;

a communication port; and

a computer processor coupled to the communication port and configured to;

initialize a hypervisor;

establish a first virtual machine under control of the hypervisor; and

execute code for a secure zone on the first virtual machine, including;

verify an administrative task, and

execute the administrative task, wherein to execute the administrative task the computer processor is further configured to;

 

establish a connection with the administrator device;

 

ensure that the administrator device is one of a set of intended administrator devices;

 

receive a command through the connection with the administrator device, wherein the command relates to executing a task on a second virtual machine; and

 

establish the second virtual machine under control of the hypervisor;

wherein to execute the client administrative task, the secure zone of the administrator device is further configured to;

establish the connection with the apparatus; and

send the command through the connection with the apparatus.

24. The system of claim 23, wherein to ensure that the administrator device is one of a set of intended administrator devices, the computer processor is further configured to verify that the administrator device contains a private key that corresponds to a public key of a set of public keys.

25. The system of claim 24, wherein the set of public keys are stored within data of the first virtual machine.

26. The system of claim 23, wherein to ensure that the administrator device is one of a set of intended administrator devices, the administrator device is configured to communicate an attestation certificate and the computer processor is further configured to attest legitimacy of the administrator device by:

requesting the attestation certificate from the administrator device; and

verifying that the attestation certificate is issued by a trusted attestation service provider.

27. The system of claim 23, wherein to execute the administrative task the computer processor is further configured to ensure that the client administrative task being executed on the administrator device is one of a set of valid client administrative tasks.

28. The system of claim 27, wherein to ensure that the client administrative task being executed on the administrator device is a one of set of valid client administrative tasks, the administrator device is configured to report a hash value of the administrative task being executed on the administrator device and the computer processor is further configured to:

receive the hash value of the client administrative task being executed on the administrator device; and

check the received hash value against a list of hash values of valid client administrative tasks.

29. The system of claim 23, wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to verify the administrative task the computer processor is further configured to calculate a checksum of the administrative task and to verify the calculated checksum using information from the non-volatile storage.

30. The system of claim 29, wherein the checksum is a secure hash.

31. The system of claim 23, wherein the apparatus further comprises a non-volatile storage exclusively accessible by the secure zone, and to execute the administrative task the computer processor is further configured to generate and permanently save information about an apparatus configuration in the non-volatile storage and use this information on apparatus start.

32. The system of claim 23, wherein to execute the code for the secure zone on the first virtual machine, the computer processor is further configured to:

establish a connection to a client device;

verify that the client device is allowed to establish a connection to the task being executed on the second virtual machine; and

pass the established connection to the task being executed on the second virtual machine.

33. The system of claim 23, wherein to verify the administrative task the computer processor is further configured to:

verify that the administrative task is signed by a signature as an administrator task; and

verify the signature of the administrative task.