Monitoring execution environments for approved configurations

• US 9,805,190 B1
• Filed: 03/16/2017
• Issued: 10/31/2017
• Est. Priority Date: 09/03/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Bowen, Peter Zachary
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/461,136
• Time in Patent Office: 229 Days
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Functionality is disclosed herein for monitoring an execution environment to determine if the execution environment is in an approved configuration. Memory used by the execution environment may be scanned from outside of the execution environment to determine whether the execution environment is in an unapproved configuration. The scanning may include examining the memory for abnormalities or other irregular or unapproved data. When the execution environment is in the unapproved configuration, actions may be performed that change how the execution environment accesses resources or performing other types of functionality.

Claims

1. A non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

perform a scan of a memory associated with a virtual machine instance in a service provider network, wherein the virtual machine instance includes a virtual processor configured to run instructions obtained from the memory, and wherein the scan of the memory is performed by a processor that is different from the virtual processor and wherein the scan is operative to detect that the virtual machine instance is in an unapproved configuration, wherein the unapproved configuration indicates one or more of an anomaly of the execution environment, or unexpected data within memory associated with the execution environment; and

in response to determining that the virtual machine instance is in the unapproved configuration, perform one or more actions that changes an access by the virtual machine instance to one or more resources associated with the service provider network, wherein the one or more actions comprise one or more of terminating the virtual machine instance, isolating the virtual machine instance in a sandbox, or placing the virtual machine instance into a forensics mode of operation.

2. The non-transitory computer-readable storage medium of claim 1, wherein performing the scan comprises identifying a subset of the memory for inspection and determining that instructions that are contained within the subset are approved instructions.

3. The non-transitory computer-readable storage medium of claim 1, further comprising in response to detecting that the virtual machine instance is in an approved configuration, allowing the virtual machine instance to exit a sandbox that changes how the virtual machine instance accesses the one or more resources.

4. The non-transitory computer-readable storage medium of claim 1, wherein performing the scan of the memory occurs in response to a request to load a page of memory used by the virtual machine instance.

5. A system, comprising:

one or more processors configured to;

detect an execution environment executing on a first processor associated with a memory;

run a monitoring environment that is coupled to the execution environment, wherein the monitoring environment is configured to monitor the execution environment to determine that the execution environment is in an unapproved configuration, wherein the unapproved configuration indicates one or more of an anomaly of the execution environment, or unexpected data within the memory, wherein the monitoring includes scanning, from outside of the execution environment, the memory to detect abnormalities associated with the memory; and

in response to determining that the execution environment is in the unapproved configuration, changing access to one or more resources by the execution environment.

6. The system of claim 5, wherein the execution environment is a first virtual machine instance.

7. The system of claim 5, wherein the monitoring environment is a second virtual machine instance configured to read the memory.

8. The system of claim 5, wherein changing the access to the one or more resources by the execution environment comprises terminating a virtual machine instance, changing an access by the virtual machine instance to the one or more resources, or causing the virtual machine instance to be executed in a sandbox.

9. The system of claim 5, wherein the scanning comprises identifying a portion of the memory for inspection and determining that the instructions contained in the portion are approved.

10. The system of claim 5, wherein the monitoring environment is configured to intercept from the execution environment a read to an address in the memory not previously scanned and scan the memory not previously scanned before it is read by the execution environment.

11. The system of claim 5, further comprising one or more servers including one or more memories and one or more processors configured to run a configuration environment, wherein the configuration environment is configured to receive a request from a customer of a service provider network indicating software to run in the execution environment and instantiating a virtual machine instance to provide the execution environment.

12. The system of claim 5, further comprising one or more servers including one or more memories and one or more processors configured to run a configuration environment, wherein the configuration environment is configured to receive a request from a customer of a service provider network that indicates a configuration associated with the one or more resources.

13. The system of claim 5, wherein changing the access to the one or more resources comprises changing an access to a virtual network and allowing access to the configuration environment.

14. The system of claim 5, further comprising one or more servers including one or more memories and one or more processors configured to run a configuration environment, wherein the configuration environment is configured to examine an access policy to determine an approved configuration to access at least one of the one or more resources.

15. The system of claim 5, wherein at least one of the one or more computing devices of the execution environment are further operative to buffer a portion of past network traffic flowing to the execution environment and storing at least a portion of the past network traffic in response to determining that the execution environment is in the unapproved configuration.

16. The system of claim 5, wherein the scanning is performed by at least one of a hypervisor or a second virtual machine instance.

17. A computer-implemented method, comprising:

detecting an execution environment executing on a first computing device;

monitoring the execution environment to determine that the execution environment is in an unapproved configuration, wherein the unapproved configuration indicates one or more of an anomaly of the execution environment, or unexpected data within memory associated with the execution environment, wherein the monitoring includes scanning, from outside of the execution environment, a memory of the first computing device to detect abnormalities in the memory associated with the execution of the execution environment; and

in response to determining that the execution environment is in the unapproved configuration, changing access to one or more resources by the execution environment.

18. The computer-implemented method of claim 17, wherein the execution environment is a first virtual machine instance.

19. The computer-implemented method of claim 17, wherein scanning the memory is performed by a second virtual machine instance that has access to the memory.

20. The computer-implemented method of claim 17, further comprising allowing the execution environment to access a configuration server in response to determining that the execution environment is in the unapproved configuration.