Hypervisor enforcement of cryptographic policy
First Claim
1. A computer-implemented method for enforcing policy on a virtual machine, comprising:
- under the control of one or more computer systems configured with executable instructions,collecting a plurality of execution traces, each execution trace comprising one or more items of information corresponding to execution of a computer executable instruction executed on the virtual machine;
constructing a representation of one or more of the plurality of execution traces that is usable to reconstruct a sequential order of execution of the one or more of the plurality of execution traces;
grouping one or more of the plurality of execution traces into a set of groups of execution traces based at least in part on identifying one or more loop structures, based at least in part on the representation;
selecting a subset of the set of groups of execution traces based at least in part on one or more data elements shared in common between one or more members of the subset of the set of groups;
computing one or more likelihood scores based at least in part on comparing a first set of execution traces comprising the execution traces contained in one or more of the groups of execution traces in the subset of the set of groups against a second set of execution traces comprised of one or more execution traces in a reference algorithm, the one or more likelihood scores based at least in part on one or more similarity measurements between the first set of execution traces and the second set of execution traces;
evaluating whether the execution of one or more of the plurality of execution traces is disallowed based at least in part on a subset of the one or more likelihood scores and based at least in part on one or more policies, and wherein the one or more policies are based at least in part on one or more likelihood score conditions; and
as a result of determining that the execution of the one or more of the plurality of execution traces is disallowed, performing one or more actions to restrict the virtual machine.
1 Assignment
0 Petitions
Accused Products
Abstract
Techniques for restricting the execution of algorithms contained in applications executing on virtual machines executing within a computer system are described herein. A first sampled set of computer executable instructions is gathered from a virtual machine by a controlling domain and compared against a reference set of computer executable instructions. If the first set is similar to the reference set, and if the execution of the algorithm corresponding to the reference set is restricted by one or more computer system polices, one or more operations limiting the execution of the restricted algorithm are performed, thus ensuring conformance with the computer system policies.
-
Citations
20 Claims
-
1. A computer-implemented method for enforcing policy on a virtual machine, comprising:
under the control of one or more computer systems configured with executable instructions, collecting a plurality of execution traces, each execution trace comprising one or more items of information corresponding to execution of a computer executable instruction executed on the virtual machine; constructing a representation of one or more of the plurality of execution traces that is usable to reconstruct a sequential order of execution of the one or more of the plurality of execution traces; grouping one or more of the plurality of execution traces into a set of groups of execution traces based at least in part on identifying one or more loop structures, based at least in part on the representation; selecting a subset of the set of groups of execution traces based at least in part on one or more data elements shared in common between one or more members of the subset of the set of groups; computing one or more likelihood scores based at least in part on comparing a first set of execution traces comprising the execution traces contained in one or more of the groups of execution traces in the subset of the set of groups against a second set of execution traces comprised of one or more execution traces in a reference algorithm, the one or more likelihood scores based at least in part on one or more similarity measurements between the first set of execution traces and the second set of execution traces; evaluating whether the execution of one or more of the plurality of execution traces is disallowed based at least in part on a subset of the one or more likelihood scores and based at least in part on one or more policies, and wherein the one or more policies are based at least in part on one or more likelihood score conditions; and as a result of determining that the execution of the one or more of the plurality of execution traces is disallowed, performing one or more actions to restrict the virtual machine. - View Dependent Claims (2, 3, 4, 5, 6)
-
7. A system, comprising:
at least one computing device configured to implement one or more services, the one or more services configured to; obtain a first representation of a first subset of execution traces, the first subset of execution traces comprising execution traces selected, based at least in part on one or more common data elements shared between execution traces, from a set of execution traces comprising samples of execution of one or more computer executable instructions executed on a virtual machine; determine, based at least in part on comparing the first representation to a second representation of a second subset of execution traces, the second subset of execution traces comprising execution traces selected from a set of execution traces comprising traces of execution of one or more reference algorithm implementations, whether one or more of the first subset of execution traces is disallowed by one or more policies; and provide information indicating whether the one or more of the first subset of execution traces is disallowed by the one or more polices to a controlling domain of the virtual machine, based at least in part on whether the one or more of the first subset of execution traces is disallowed by the one or more policies. - View Dependent Claims (8, 9, 10, 11, 12, 13)
-
14. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
-
obtain a first subset of execution traces from one or more sampled applications, the first subset of execution traces comprising execution traces selected from a set of execution traces comprising samples of execution of one or more computer executable instructions from the one or more sampled applications executed on a machine; compare the first subset of execution traces to a second subset of execution traces comprising execution traces selected from a set of execution traces comprising samples of execution of one or more restricted algorithms to determine a similarity measurement between the first subset of execution traces and the second subset of execution traces; and as a result of the similarity measurement exceeding a threshold value, cause the computer system to execute one or more instructions that invoke one or more computer system policies corresponding to the one or more restricted algorithms. - View Dependent Claims (15, 16, 17, 18, 19, 20)
-
Specification