System, method and computer program product for performing a security or maintenance operation in association with virtual disk data

• US 8,352,939 B1
• Filed: 12/03/2007
• Issued: 01/08/2013
• Est. Priority Date: 12/03/2007
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edwards, Jonathan L., Teddy, John D., Camp, Tracy E.
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): Labud, Jonathan R
• Application Number:
  US11/949,609
• Time in Patent Office: 1,863 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 16/11 File system administration, e.g. details of archiving or snapshots file system backup G06F11/14
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors

Abstract

A system, method and computer program product are provided for performing a security or maintenance operation in association with virtual disk data accessed independent of a virtual machine. In use, data stored on a virtual disk is accessed at least in part independent of a virtual machine. Further, a security or maintenance operation is performed in association with the accessed data.

Claims

1. A method comprising the steps of:

identifying a virtual disk that is associated with a virtual machine, without employing the virtual machine;

parsing the virtual disk without employing the virtual machine;

providing read and write access to the virtual disk at a file level or sector level;

identifying one or more registry files on the virtual disk, where one or more of the identified registry files are associated with the virtual machine;

providing read and write access to one or more of the identified registry files that are associated with the virtual machine, such read and write access to a registry file being provided to software outside of the virtual machine; and

using the read or write access to a registry file in order to perform security operations for the benefit of the virtual machine without employing the virtual machine.

2. The method of claim 1 wherein the parsing step includes parsing files on the virtual disk and encoding the files for encapsulating an image of the virtual disk.

3. The method of claim 2 wherein the encoding uses VMDK or VHD.

4. The method of claim 1 further comprising the step of identifying partitions of the virtual disk.

5. The method of claim 4 further comprising the step of determining the file systems used by the identified partitions.

6. The method of claim 4 wherein the virtual machine and virtual disk are resident upon a physical computer having an operating system that is not part of the virtual machine.

7. The method of claim 6 further comprising the step of using the operating system to determine the file systems used by the identified partitions.

8. The method of claim 4 wherein the partitions are determined during the parsing step.

9. The method of claim 1 wherein the virtual machine and virtual disk are resident upon a physical computer having an operating system that is not part of the virtual machine.

10. The method of claim 9 wherein virtual machine registry information is incorporated in a registry file outside of both the virtual machine and virtual disk.

11. The method of claim 1 wherein access to registry files is allowed after a successful security check associated with the software receiving such access.

12. In a computer system comprising a virtual machine and virtual disk associated with an operating system that is not part of the virtual machine, a method comprising the steps of:

Employing a security application, associated with the operating system and not part of the virtual machine, to pack sectors of the virtual disk into a container file;

Causing data in the container file to appear as a disk full of sectors to enable display of such data as part of a hierarchical file system; and

Using the security application to construct a virtual registry and cause the virtual registry and the hierarchical file system to appear local on the virtual disk from the perspective of the virtual machine.

13. A computer system for performing security operation:

a virtual computer;

a scanner residing on a first computer platform and not part of the virtual computer, the scanner capable of performing security scanning on data;

a physical disk comprising a virtual disk in a partition of the physical disk, which resides on a second computer platform;

the virtual computer being coupled to the virtual disk; and

a communicative coupling between the scanner and the physical disk, such communicative coupling providing access to the virtual disk without employing the virtual computer.

14. The computer system of claim 13 wherein the first computer platform and the second computer platform are the same.

15. The computer system of claim 13 wherein the first computer platform comprises a security application and the scanner is a part of the security application.

16. The computer system of claim 13 wherein the virtual computer uses the virtual disk as a repository for data.

17. The computer system of claim 16 wherein the virtual disk comprises registry information regarding the virtual computer.

18. The computer system of claim 17 wherein the scanner is part of an application that accesses the registry information for purpose of a security operation.

19. The computer of claim 16 wherein the registry information is identified during a parsing operation of the physical disk.