System and method for enforcing security policies in a virtual environment

• US 8,381,284 B2
• Filed: 08/21/2009
• Issued: 02/19/2013
• Est. Priority Date: 08/21/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dang, Amit, Mohinder, Preet
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): ELAHI, SHAN E
• Application Number:
  US12/545,609
• Publication Number:
  US 20110047542A1
• Time in Patent Office: 1,278 Days
• Field of Search: 718/1, 726/17, 726/4, 726/16, 726/18, 726/21
• US Class Current: 726/17
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method in one example implementation includes intercepting a request associated with an execution of an object (e.g., a kernel module or a binary) in a computer configured to operate in a virtual machine environment. The request is associated with a privileged domain of the computer that operates logically below one or more operating systems. The method also includes verifying an authorization of the object by computing a checksum for the object and comparing the checksum to a plurality of stored checksums in a memory element. The execution of the object is denied if it is not authorized. In other embodiments, the method can include evaluating a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules. In other embodiments, the method can include intercepting an attempt from a remote computer to execute code from a previously authorized binary.

Claims

1. A method, comprising:

inserting a security layer in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment, wherein the privileged domain of the computer manages a virtual machine monitor (VMM) and operates logically below one or more guest operating systems;

storing a snapshot of authorized objects in a user space of the privileged domain;

intercepting, by the security layer, a request for an execution of an object in the computer wherein the request for the execution is from a user space of the privileged domain;

verifying an authorization of the object by linking a particular module into a kernel space associated with the privileged domain, wherein the particular module is configured to compute a checksum for the object, access an inventory of a plurality of stored checksums in a memory element, and compare the checksum to the plurality of stored checksums; and

denying the execution of the object if it is not authorized.

2. The method of claim 1, further comprising:

evaluating a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules.

3. The method of claim 1, further comprising:

intercepting an attempt from a remote computer to execute code from a previously authorized binary; and

evaluating an origination address of a hypercall associated with the code before executing the code.

4. The method of claim 1, wherein the object is a kernel module or a binary.

5. The method of claim 1, wherein the verifying of the authorization of the object includes comparing the object to an inventory of authorized objects stored in a user space of the computer, and wherein a log is created if the execution of the object is not authorized.

6. The method of claim 1, further comprising:

allowing the object to be executed if its corresponding checksum is found as matching one of the plurality of stored checksums in the memory element.

7. The method of claim 1, wherein the object is a kernel module that is interacting with a hypercall, which attempts to access one or more privileged domain areas within the computer.

8. A logic encoded in one or more tangible non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

inserting a security layer in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment, wherein the privileged domain of the computer manages a virtual machine monitor (VMM) and operates logically below one or more guest operating systems;

storing a snapshot of authorized objects in a user space of the privileged domain;

intercepting, by the security layer, a request for an execution of an object in the computer wherein the request for the execution is from a user space of the privileged domain;

verifying an authorization of the object by linking a particular module into a kernel space associated with the privileged domain, wherein the particular module is configured to compute a checksum for the object, access an inventory of a plurality of stored checksums in a memory element, and compare the checksum to the plurality of stored checksums; and

denying the execution of the object if it is not authorized.

9. The logic of claim 8, the processor being operable to perform operations comprising:

evaluating a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules.

10. The logic of claim 8, the processor being operable to perform operations comprising:

intercepting an attempt from a remote computer to execute code from a previously authorized binary; and

evaluating an origination address of a hypercall associated with the code before executing the code.

11. The logic of claim 8, wherein the object is a kernel module or a binary.

12. The logic of claim 8, wherein the object is a kernel module that is interacting with a hypercall, which attempts to access one or more privileged domain areas within the computer.

13. The logic of claim 8, wherein the verifying of the authorization of the object includes comparing the object to an inventory of authorized objects stored in a user space of the computer, and wherein a log is created if the execution of the object is not authorized.

14. The logic of claim 8, the processor being operable to perform operations comprising:

allowing the object to be executed if its corresponding checksum is found as matching one of the plurality of stored checksums in the memory element.

15. An apparatus, comprising:

a virtual machine element;

a memory element configured to store data; and

a processor operable to execute instructions associated with the data, wherein the virtual machine element is configured to;

insert a security layer in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment, wherein the privileged domain of the computer manages a virtual machine monitor (VMM) and operates logically below one or more guest operating systems;

store a snapshot of authorized objects in a user space of the privileged domain;

intercept, by the security layer, a request for an execution of an object in the computer wherein the request for the execution is from a user space of the privileged domain;

verify an authorization of the object by linking a particular module into a kernel space associated with the privileged domain, wherein the particular module is configured to compute a checksum for the object, access an inventory of a plurality of stored checksums in a memory element, and compare the checksum to the plurality of stored checksums; and

deny the execution of the object if it is not authorized.

16. The apparatus of claim 15, wherein the virtual machine element is further configured to:

evaluate a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules.

17. The apparatus of claim 15, wherein the virtual machine element is further configured to:

intercept an attempt from a remote computer to execute code from a previously authorized binary; and

evaluate an origination address of a hypercall associated with the code before executing the code.

18. The apparatus of claim 15, wherein the object is a kernel module or a binary.

19. The apparatus of claim 15, wherein the object is a kernel module that is interacting with a hypercall, which attempts to access one or more privileged domain areas within the computer.

20. The apparatus of claim 15, wherein the object is allowed to be executed if its corresponding checksum is found as matching one of the plurality of stored checksums in the memory element.