Automated provisioning of secure virtual execution environment using virtual machine templates based on requested activity

• US 9,116,733 B2
• Filed: 01/30/2015
• Issued: 08/25/2015
• Est. Priority Date: 05/28/2010
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Bromium Inc (HP Inc.)
• Inventors: Banga, Gaurav, Bondalapati, Kiran, Pratt, Ian, Kapoor, Vikram
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): WU, BENJAMIN C
• Application Number:
  US14/610,282
• Publication Number:
  US 20150143374A1
• Time in Patent Office: 207 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2209/5018 Thread allocation
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Approaches for executing untrusted software on a client without compromising the client using micro-virtualization to execute untrusted software in isolated contexts. A template for instantiating a virtual machine on a client is identified in response to receiving a request to execute an application. After the template is identified, without human intervention, a virtual machine is instantiated, using the template, in which the application is to be executed. The template may be selected from a plurality of templates based on the nature of the request, as each template describe characteristics of a virtual machine suitable for a different type of activity. When the client determines that the application has ceased to execute, the client ceases execution of the virtual machine without human intervention.

Claims

1. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and the provenance of the executable code for said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

2. The non-transitory computer readable storage medium of claim 1, wherein execution of the one or more sequences of instructions further causes:

determining a particular set of hardware resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of hardware resources without providing access to any other hardware resources.

3. The non-transitory computer readable storage medium of claim 1, wherein execution of the one or more sequences of instructions further causes:

determining a particular set of network resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of network resources without providing access to any other network resources.

4. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine,

wherein a firewall virtual machine provides said virtual machine access to a particular set of network resources available to said virtual machine, and wherein said firewall virtual machine implements a network access policy for a plurality of virtual machines on a physical device.

5. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and user input accompanying the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

6. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and a reputation of said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

7. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution of said application in said virtual machine; and

customizing at least one of the one or more templates based on the behavior of said application during execution of said application in said virtual machine.

8. A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution; and

updating the policy based on the behavior of said application during execution of said application.

9. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and the provenance of the executable code for said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

10. The apparatus of claim 9, wherein execution of the one or more sequences of instructions further causes:

determining a particular set of hardware resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of hardware resources without providing access to any other hardware resources.

11. The apparatus of claim 9, wherein execution of the one or more sequences of instructions further causes:

determining a particular set of network resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of network resources without providing access to any other network resources.

12. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine,

wherein a firewall virtual machine provides said virtual machine access to a particular set of network resources available to said virtual machine, and wherein said firewall virtual machine implements a network access policy for a plurality of virtual machines on a physical device.

13. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and user input accompanying the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

14. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and a reputation of said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

15. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution of said application in said virtual machine; and

customizing at least one of the one or more templates based on the behavior of said application during execution of said application in said virtual machine.

16. An apparatus, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution; and

updating the policy based on the behavior of said application during execution of said application.

17. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and the provenance of the executable code for said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

18. The method of claim 17, further comprising:

determining a particular set of hardware resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of hardware resources without providing access to any other hardware resources.

19. The method of claim 17, further comprising:

determining a particular set of network resources to make available to the virtual machine; and

providing the virtual machine access to the particular set of network resources without providing access to any other network resources.

20. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine,

wherein a firewall virtual machine provides said virtual machine access to a particular set of network resources available to said virtual machine, and wherein said firewall virtual machine implements a network access policy for a plurality of virtual machines on a physical device.

21. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and user input accompanying the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

22. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request and a reputation of said application, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates; and

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine.

23. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution of said application in said virtual machine; and

customizing at least one of the one or more templates based on the behavior of said application during execution of said application in said virtual machine.

24. A method, comprising:

in response to receiving a request to execute an application, instantiating a virtual machine in which the application is to be executed, wherein instantiating said virtual machine is performed without receiving an explicit user instruction to instantiate said virtual machine, and wherein instantiating said virtual machine further comprises;

identifying one or more templates for use in instantiating said virtual machine based on a policy that considers a type of activity whose execution is being requested by the request, wherein the one or more templates describe virtual machine characteristics configured for different types of activity, and

wherein the one or more templates each reference a shared operating system image used to instantiate a plurality of operating system instances to each run in virtual machines created using the one or more templates;

after instantiating said virtual machine using said one or more templates, executing said application in said virtual machine;

monitoring the behavior of said application during execution; and

updating the policy based on the behavior of said application during execution of said application.