Techniques for securing a checked-out virtual machine in a virtual desktop infrastructure

• US 8,566,899 B2
• Filed: 03/16/2011
• Issued: 10/22/2013
• Est. Priority Date: 03/16/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Sobel, William E., Barnes, Matthew R.
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US13/049,480
• Publication Number:
  US 20120240181A1
• Time in Patent Office: 951 Days
• Field of Search: 726/1, 726/2, 726 11- 15, 726 22- 27, 709217-228
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Techniques for securing checked-out virtual machines in a virtual desktop infrastructure (VDI) are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for securing a checked-out guest virtual machine including receiving a request for checking-out a guest virtual machine hosted by a server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element. The method for securing a checked-out guest virtual machines may also include configuring a security module for the guest virtual machine in order to secure the guest virtual machine and providing the security module to the guest virtual machine when the guest virtual machine is checked-out.

Claims

1. A method for securing a checked-out guest virtual machine comprising:

hosting a security virtual machine on a server network element, wherein the security virtual machine provides security services to a guest virtual machine hosted by the server network element;

receiving a request for checking-out the guest virtual machine hosted by the server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element;

configuring a security module for the guest virtual machine in order to secure the guest virtual machine, wherein the security module is optimized by the security virtual machine for use on the guest virtual machine hosted by the client network element; and

providing the security module to the guest virtual machine when the guest virtual machine is checked-out.

2. The method of claim 1, further comprising transmitting a probe packet to the client network element to gather information associated with the client network element.

3. The method of claim 2, further comprising determining rights associated with the client network element based at least in part on the information associated with the client network element.

4. The method of claim 3, further comprising displaying a check-out error message based at least in part on the determination that the client network element does not have rights.

5. The method of claim 2, wherein the security module for the guest virtual machine is configured based at least in part on the information associated with the client network element.

6. The method of claim 2, wherein the information associated with the client network element comprises at least one of virtualization platform, hypervisor, security information, vulnerability, rights, storage, CPU utilization, memory, and network Input/Output (I/O).

7. The method of claim 6, wherein the security information associated with the client network element comprises at least one of security application, manufacturer, version, date, history, antivirus, antispam, antimalware, and interface.

8. The method of claim 1, further comprising determining whether a security application is associated with the client network element.

9. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an interface for the security module to interact with the client network element.

10. The method of claim 9, wherein the interface for the security module is configured to interact with a security application associated with the client network element.

11. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an interface for the security module to interact with the server network element.

12. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring a full version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

13. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring a partial version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

14. The method of claim 1, wherein configuring the security module for the guest virtual machine comprises configuring an updated version of at least one of antivirus software, antimalware software, firewall software, intrusion prevention software, and data leakage prevention software for the security module.

15. At least one non-transitory processor readable storage medium storing a computer program of instructions, which, when executed by at least one processor, perform the method as recited in claim 1.

16. A system for securing a checked-out guest virtual machine comprising:

one or more processors communicatively coupled to a network;

wherein the one or more processors are configured to;

host a security virtual machine on a server network element, wherein the security virtual machine provides security services to a guest virtual machine hosted by the server network element;

receive a request for checking-out the guest virtual machine hosted by the server network element, wherein checking-out the guest virtual machine comprises transferring hosting of the guest virtual machine from the server network element to a client network element;

configure a security module for the guest virtual machine in order to secure the guest virtual machine, wherein the security module is optimized by the security virtual machine for use on the guest virtual machine hosted by the client network element; and

provide the security module to the guest virtual machine when the guest virtual machine is checked-out.

17. The system of claim 16, wherein the one or more processors are further configured to:

transmit a probe packet to the client network element to gather information associated with the client network element.

18. The system of claim 17, wherein the security module is configured based at least in part on the information associated with the client network element.

19. The system of claim 16, wherein the one or more processors are further configured to:

determine whether a security application is associated with the client network element.

20. The system of claim 17, wherein the one or more processors are further configured to:

determine rights associated with the client network element based at least in part on the information associated with the client network element.