On-demand disposable virtual work system

• US 8,856,782 B2
• Filed: 02/26/2008
• Issued: 10/07/2014
• Est. Priority Date: 03/01/2007
• Status: Active Grant

• Current Assignee: George Mason Research Foundation Inc.
• Original Assignee: George Mason Research Foundation Inc.
• Inventors: Ghosh, Anup K, Jajodia, Sushil, Huang, Yih, Wang, Jiang
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): Labud, Jonathan R
• Application Number:
  US12/037,412
• Publication Number:
  US 20090125902A1
• Time in Patent Office: 2,415 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

An on-demand disposable virtual work system that includes: a virtual machine monitor to host virtual machines, a virtual machine pool manager, a host operating system, a host program permissions list, and a request handler module. The virtual machine pool manager manages virtual machine resources. The host operating system interfaces with a user and virtual machines created with an image of a reference operating system. The host program permissions list may be a black list and/or a white list used to indicate allowable programs. The request handler module allows execution of the program if the program is allowable. If the program is not allowable, the host request handler module: denies program execution and urges a virtual machine specified by the virtual machine pool manager to execute the program. The virtual machine is terminated when the program closes.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a program execution request to run a program on a host operating system;

permit the program to execute on the host operating system and outside a virtual machine if a program permissions list, associated with the host operating system, indicates that the program has permission to execute on the host operating system and outside a virtual machine; and

if the program permissions list indicates that the program does not have permission to execute on the host operating system and outside a virtual machine;

deny execution of the program on the host operating system outside a virtual machine;

associate a guest virtual machine with the program based on a type of the program; and

send the program execution request to the guest virtual machine associated with the program such that the guest virtual machine executes the program;

authenticate a file access system call received from the program, using an authentication module within the guest virtual machine; and

redirect the file access system call to a secure virtual file access server, if the file access system call is authenticated.

2. The non-transitory processor-readable medium of claim 1, wherein the guest virtual machine is from a plurality of guest virtual machines, the program permissions list includes at least one of:

a white list including one or more identifiers associated with one or more programs allowed to execute on the host operating system and outside a virtual machine;

or

a black list including one or more identifiers associated with one or more programs not allowed to execute on the host operating system and outside a virtual machine, the black list associates each program from the one or more programs not allowed to execute on the host operating system and outside a virtual machine with a guest virtual machine from the plurality of guest virtual machines.

3. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to terminate the guest virtual machine after at least one of:

the program being closed;

a user request to terminate the guest virtual machine;

or

expiration of a preset time period.

4. The non-transitory processor-readable medium of claim 1, wherein the program is a first program, the code further comprising code to cause the processor to define the guest virtual machine associated with the first program when there is no preexisting available guest virtual machine associated with the first program, the guest virtual machine having a pristine operating system that is at least one of:

an image of a pristine reference operating system;

a snapshot of a currently executing pristine operating system;

or

a snapshot of a currently executing pristine operating system that is running a second program.

5. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to define the guest virtual machine associated with the program in anticipation of the program execution request.

6. The non-transitory processor-readable medium of claim 1, wherein the guest virtual machine is configured to only execute one program at a time.

7. The non-transitory processor-readable medium of claim 1, wherein:

the guest virtual machine is configured to execute a plurality of programs at a time; and

the guest virtual machine is only terminated after each program from the plurality of programs is closed.

8. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to save data, from the program, to a limited access persistent file server external to the guest virtual machine.

9. The non-transitory processor-readable medium of claim 1, wherein the guest virtual machine is a first guest virtual machine, the program execution request is a first program execution request and the program is a first program, the code further comprising code to cause the processor to send a second program execution request to a second guest virtual machine associated with a second program such that the second guest virtual machine executes the second program.

10. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

dispose the guest virtual machine associated with the program by reverting the guest virtual machine associated with the program back to its initial state, or by terminating the guest virtual machine associated with the program, after the program is closed.

11. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

store data associated with the program in a persistent cache prior to termination of the guest virtual machine.

12. The non-transitory processor-readable medium of claim 1, wherein the associating the guest virtual machine with the program is configurable by a user.

13. An apparatus, comprising:

a virtual machine monitor implemented in at least one of a memory or a processing device, the virtual machine monitor configured to host a plurality of virtual machines on a physical computing machine;

a program permissions list, associated with a host operating system, configured to store a list of program identifiers;

a request handler module configured to;

receive a program execution request to run a program on the host operating system;

permit the program to execute on the host operating system and outside a virtual machine if the program permissions list, associated with the host operating system, indicates that the program has permission to execute on the host operating system and outside a virtual machine; and

if the program permissions list indicates that the program does not have permission to execute on the host operating system and outside a virtual machine;

deny program execution on the host operating system outside a virtual machine; and

send the program execution request to a guest virtual machine from the plurality of virtual machines and associated with the program such that the guest virtual machine executes the program; and

a virtual machine pool manager configured to associate the guest virtual machine from the plurality of virtual machines with the program based on a type of the program if the program permissions list indicates that the program does not have permission to execute on the host operating system and outside a virtual machine, the virtual machine pool manager configured to perform at least one of;

define at least one virtual machine from the plurality of virtual machines;

put at least one virtual machine from the plurality of virtual machines to sleep;

assign a program execution request to at least one virtual machine from the plurality of virtual machines;

terminate at least one virtual machine from the plurality of virtual machines;

wake-up at least one virtual machine from the plurality of virtual machines;

receive program execution requests from the request handler module;

respond to a program execution request from the request handler module;

receive a program execution request from at least one guest virtual machine from the plurality of virtual machines;

or

respond to a program execution request from a guest request handler module.

14. The apparatus of claim 13, wherein the program permissions list includes at least one of:

a white list including one or more identifiers associated with one or more programs allowed to execute on the host operating system and outside a virtual machine;

or

a black list including one or more identifiers associated with one or more programs not allowed to execute on the host operating system and outside a virtual machine, the black list associates each program from the one or more programs not allowed to execute on the host operating system outside a virtual machine, with a guest virtual machine from the plurality of virtual machines.

15. The apparatus of claim 13, wherein the request handler module is configured to:

receive a file access request from the program;

if the file access request is directed to a local storage within the guest virtual machine, direct the file access request to the local storage; and

if the file access request is directed to a persistent storage, forward the file access request to the persistent storage if the program is authenticated to interact with the persistent storage.

16. The apparatus of claim 13, wherein the request handler module is configured to:

intercept system calls; and

allow execution of the program by forwarding program execution requests to the host operating system.

17. The apparatus of claim 13, further including a persistent file server module configured to allow controlled access to a persistent file storage external to the guest virtual machine associated with the program.

18. The apparatus of claim 13, wherein the program is a first program, the apparatus further comprising at least one image of a reference operating system accessible by the host operating system, the at least one image of the reference operating system is at least one of:

an image of a pristine reference operating system;

a snapshot of a currently executing pristine operating system;

or

a snapshot of a currently executing pristine operating system that is running a second program.

19. The apparatus of claim 13, wherein the list of program identifiers is a first list of program identifiers, and the program is a first program the guest virtual machine includes:

a guest program permissions list configured to store a second list of program identifiers; and

a guest request handler module configured to;

receive a program execution request to run a second program on the guest virtual machine;

allow execution of the second program on the guest virtual machine, if the guest program permissions list indicates that the second program has permission to execute on the guest virtual machine; and

deny execution of the second program if the guest program permissions list indicates that the second program does not have permission to execute on the guest virtual machine.

20. The apparatus of claim 13, wherein the virtual machine pool manager is configured to terminate the guest virtual machine after at least one of:

the program being closed;

a user request to terminate the guest virtual machine;

or

expiration of a preset time period.

21. The apparatus of claim 13, further comprising a persistent cache configured to store data associated with the program.

22. The apparatus of claim 13, wherein the request handler module is configured to:

authenticate a file access system call received from the program, using an authentication module within the guest virtual machine; and

redirect the file access system call to a secure virtual file access server, if the file access system call is authenticated.

23. The apparatus of claim 13, wherein the associating the guest virtual machine to the program is configurable by a user.

24. An apparatus, comprising:

a virtual machine monitor implemented in at least one of a memory or a processing device, the virtual machine monitor configured to host a plurality of virtual machines on a physical computing machine;

a program permissions list, associated with a host operating system, configured to store a first list of program identifiers; and

a request handler module configured to;

receive a program execution request to run a first program on the host operating system;

permit the first program to execute on the host operating system and outside a virtual machine if the program permissions list, associated with the host operating system, indicates that the first program has permission to execute on the host operating system and outside a virtual machine; and

if the program permissions list indicates that the first program does not have permission to execute on the host operating system and outside a virtual machine;

deny program execution on the host operating system outside a virtual machine;

associate a guest virtual machine from the plurality of virtual machines with the first program, based on a type of the first program; and

send the program execution request to the guest virtual machine associated with the first program such that the guest virtual machine executes the first program, the guest virtual machine including;

a guest program permissions list configured to store a second list of program identifiers;

a guest request handler module configured to;

receive a program execution request to run a second program on the guest virtual machine;

allow execution of the second program on the guest virtual machine, if the guest program permissions list indicates that the second program has permission to execute on the guest virtual machine; and

deny execution of the second program if the guest program permissions list indicates that the program does not have permission to execute on the guest virtual machine.

25. The apparatus of claim 24, wherein the program permissions list includes at least one of:

a white list including one or more identifiers associated with one or more programs allowed to execute on the host operating system and outside a virtual machine;

or

a black list including one or more identifiers associated with one or more programs not allowed to execute on the host operating system and outside a virtual machine, the black list associates each program from the one or more programs not allowed to execute on the host operating system outside a virtual machine, with a guest virtual machine from the plurality of virtual machines.

26. The apparatus of claim 24, wherein the request handler module is configured to:

receive a file access request from the first program;

if the file access request is directed to a local storage within the guest virtual machine, direct the file access request to the local storage; and

if the file access request is directed to a persistent storage, forward the file access request to the persistent storage if the first program is authenticated to interact with the persistent storage.

27. The apparatus of claim 24, wherein the request handler module is configured to:

intercept system calls; and

allow execution of the first program by forwarding program execution requests to the host operating system.

28. The apparatus of claim 24, further including a persistent file server module configured to allow controlled access to a persistent file storage external to the guest virtual machine associated with the first program.

29. The apparatus of claim 24, further comprising at least one image of a reference operating system accessible by the host operating system, the at least one image of the reference operating system is at least one of:

an image of a pristine reference operating system;

a snapshot of a currently executing pristine operating system;

or

a snapshot of a currently executing pristine operating system that is running the second program.