Virtual machine system, system for forcing policy, method for forcing policy, and virtual machine control program

• US 8,468,522 B2
• Filed: 12/10/2008
• Issued: 06/18/2013
• Est. Priority Date: 12/26/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Terasaki, Hiroshi
• Primary Examiner(s): Singh, Gurkanwaljit
• Application Number:
  US12/809,285
• Publication Number:
  US 20110154325A1
• Time in Patent Office: 1,651 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A virtual machine system that builds one or more virtual machines on a real machine has a hypervisor for realizing access to virtualized hardware by a guest OS that is an operating system running on the virtual machines or an application running on the guest OS by means of a physical device that the real machine has. The hypervisor includes a setting item information holding unit that holds setting item information in which a security policy is indicated by the setting value of a setting item; a setting detecting unit that monitors an instruction executed by the guest OS and the output of the physical device to detect the setting value that is set in the setting item of the setting item information holding unit or a setting value that is about to be changed therein; and a setting applying unit that, when the detected setting value and the setting value indicated by the setting item information differ from each other, applies the setting value indicated by the setting item information to the guest OS or application that is the setting target of the setting item.

Claims

1. A virtual machine system that builds one or more virtual machines on a real machine, comprising

a hypervisor that realizes access to virtualized hardware by a guest OS that is an operating system running on said virtual machines or an application running on said guest OS by means of a physical device that said real machine has,

said hypervisor including:

a setting item information holding unit that holds setting item information in which a security policy to be applied to said virtual machine system is indicated as a setting value of a setting item corresponding to a type of said guest OS or a type of said application;

a setting detecting unit that monitors an instruction executed by said guest OS and an output of said physical device, and detects a candidate value, which corresponds to a setting item in the setting item information, and which is used by the instruction of the guest OS or is the output of said physical device that said real machine, on which the guest OS runs, has; and

a setting applying unit that, when the candidate value detected by said setting detecting unit and the setting value corresponding to the same setting item, in said setting item information, as the candidate value differ from each other, applies not the candidate value but the setting value to said guest OS or said application that is a setting target of said setting item, using hardware access from said guest OS or said application.

2. The virtual machine system as claimed in claim 1, wherein said hypervisor includes:

an association information holding unit that holds association information indicating associations between an item defined by said security policy, and setting items of the respective types of said guest OS corresponding to the item and said application; and

a setting item information generating unit that generates setting item information by receiving information about said security policy to be applied to said virtual machine system from a management system that manages said security policy, and developing setting contents of said item of said received security policy into one or more setting values of setting items corresponding to the type of said guest OS and the type of said application, based on said held association information.

3. The virtual machine system as claimed in claim 1, wherein

said setting applying unit rewrites a candidate value, which is included in a response to a hardware access instruction related to reference to or updating of the setting item, to the setting value corresponding to the same setting from the setting value but, and thereby applies not the candidate value but the setting value to said guest OS or said application that is the target of said setting item.

4. The virtual machine system as claimed in claim 1, wherein

said setting applying unit makes a notification with the use of a function of said guest OS or said application that is the target of the setting item when the difference between the candidate value and the setting value, which correspond to the same setting item information, is detected, and thereby applies not the candidate value but the setting value to said guest OS or said application that is the target of said setting item.

5. The virtual machine system as claimed in claim 1, wherein

said setting applying unit performs writing in a physical device holding the setting value of the setting item when the difference between the candidate value and the setting value, which correspond to the same setting item in said setting item information, is detected, and thereby applies not the candidate value but the setting value to said guest OS or said application that is the target of said setting item.

6. The virtual machine system as claimed in claim 1, wherein

said setting applying unit generates an interrupt to be received by said guest OS or said application, as a notification made with the use of a function of said guest OS or said application that is the target of the setting item when the difference between the candidate value and the setting value, which correspond to the same setting item in said setting item information, is detected.

7. The virtual machine system as claimed in claim 6, wherein

said setting applying unit generates said interrupt via said guest OS on which said application is running.

8. The virtual machine system as claimed in claim 1, wherein,

when performing writing in said physical device, said setting applying unit performs the writing in a corresponding hardware region allotted as a hardware resource to said guest OS or said application that is the target of the corresponding target item.

9. A policy forcing system that forces a security policy on a virtual machine system that builds one or more virtual machines on a real machine, comprising:

said virtual machine system; and

a management system that manages said security policy to be applied to said virtual machine system,

said virtual machine system including a hypervisor that realizes access to virtualized hardware by a guest OS that is an operating system running on said virtual machines or an application running on said guest OS by means of a physical device that said real machine has,

said hypervisor including;

a setting item information holding unit that holds setting item information in which said security policy to be applied to said virtual machine system is indicated as a setting value of a setting item corresponding to a type of said guest OS or a type of said application;

a setting detecting unit that monitors an instruction executed by said guest OS and an output of said physical device, and detects a candidate value, which corresponds to a setting item in the setting item information, and which is used by the instruction of the guest OS or is the output of said physical device that said real machine, on which the guest OS runs, has; and

a setting applying unit that, when the candidate value detected by said setting detecting unit and the setting value corresponding to the same setting item, in said setting item information, as the candidate value differ from each other, applies not the candidate value but the setting value to said guest OS or said application that is a setting target of said setting item, using hardware access from said guest OS or said application.

10. The policy forcing system as claimed in claim 9, wherein said hypervisor includes:

an association information holding unit that holds association information indicating associations between an item defined by said security policy and setting items of the respective types of said guest OS corresponding to the item and said application; and

a setting item information generating unit that generates setting item information by receiving information about said security policy to be applied to said virtual machine system from said management system that manages said security policy, and developing setting contents of said item of said received security policy into one or more setting values of setting items corresponding to the type of said guest OS and the type of said application, based on said held association information.

11. A policy forcing method for forcing a security policy on a virtual machine system that builds one or more virtual machines on a real machine,

said virtual machine system including a hypervisor that realizes access to virtualized hardware by a guest OS that is an operating system running on said virtual machines or an application running on said guest OS by means of a physical device that said real machine has,

said policy forcing method, which is performed by said hypervisor, comprising:

holding setting item information in which said security policy to be applied to said virtual machine system is indicated as a setting value of a setting item corresponding to a type of said guest OS or a type of said application;

monitoring an instruction executed by said guest OS and an output of said physical device

detecting a candidate value, which corresponds to a setting item in the setting item information, and which is used by the instruction of the guest OS or is the output of said physical device that said real machine, on which the guest OS runs, has; and

when the candidate value detected by said setting detecting unit and the setting value corresponding to the same setting item, in said setting item information, as the candidate value differ from each other, applying not the candidate value but the setting value to said guest OS or said application that is a setting target of said setting item, using hardware access from said guest OS or said application.

12. The policy forcing method as claimed in claim 11, further comprising:

holding association information indicating associations between an item defined by said security policy and setting items of the respective types of said guest OS corresponding to the item and said application; and

generating setting item information by receiving information about said security policy to be applied to said virtual machine system from a management system that manages said security policy, and developing setting contents of said item of said received security policy into one or more setting values of setting items corresponding to the type of said guest OS and the type of said application, based on said held association information.