SYSTEM AND METHOD FOR SECURITY AND PRIVACY AWARE VIRTUAL MACHINE CHECKPOINTING

• US 20140095821A1
• Filed: 09/30/2013
• Published: 04/03/2014
• Est. Priority Date: 10/01/2012
• Status: Active Grant

• Current Assignee: The Research Foundation for The State University of New York (State University of New York)
• Original Assignee: The Research Foundation for The State University of New York (State University of New York)
• Inventors: Gopalan, Kartik, Yang, Ping
• Granted Patent: US 9,069,782 B2
• Time in Patent Office: Days
• US Class Current: 711/162
• CPC Class Codes: G06F 11/1407 Checkpointing the instruction stream
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A checkpointing method for creating a file representing a restorable state of a virtual machine in a computing system, comprising identifying processes executing within the virtual machine that may store confidential data, and marking memory pages and files that potentially contain data stored by the identified processes; or providing an application programming interface for marking memory regions and files within the virtual machine that contain confidential data stored by processes; and creating a checkpoint file, by capturing memory pages and files representing a current state of the computing system, which excludes information from all of the marked memory pages and files.

Claims

1. A checkpointing method for creating a file representing a restorable state of a virtual machine in a computing system, comprising:

at least one of;

(a) identifying processes executing within the virtual machine that may store confidential data; and

marking memory pages and files that potentially contain data stored by the identified processes; and

(b) providing an application programming interface for marking memory regions and files within the virtual machine that contain confidential data stored by processes; and

creating a checkpoint file, by capturing memory pages and files representing a current state of the computing system, which excludes information from all of the marked memory pages and files.

2. The method according to claim 1, wherein information in the identified memory pages and files is removed, and the marked memory pages and files with the information removed are included within the checkpoint file.

3. The method according to claim 1, wherein all user space processes within the virtual machine are frozen, except a guest checkpoint process, while the checkpoint file is created.

4. The method according to claim 1, wherein the memory pages and files comprise:

process memory, deallocated pages, TTY buffers, the socket buffers, pipe buffers, and FIFO buffers.

5. The method according to claim 1, wherein a process container is provided to encapsulate all memory pages and files associated with a respective process, wherein the memory pages and files within the process container are excluded from the checkpoint file.

6. The method according to claim 1, wherein a process container is provided to encapsulate all memory pages and files associated with a respective process, wherein the memory pages and files within the process container are separately stored within a respective checkpoint file.

7. The method according to claim 1, wherein a process container is provided to encapsulate all marked memory pages and files associated with a respective process that may store confidential information, wherein the memory pages and files within the process container are separately stored as part of an encrypted checkpoint file.

8. The method according to claim 1, further comprising determining inter-process dependencies for a plurality of processes executing within the virtual machine by monitoring inter-process communications.

9. The method according to claim 1, further comprising determining inter-process dependencies for a plurality of processes executing within the virtual machine by a static analysis.

10. The method according to claim 1, further comprising determining inter-process dependencies for a plurality of processes executing within the virtual machine by static analysis and dynamic analysis.

11. The method according to claim 1, further comprising determining a status of a memory or file operation of a process executing on the virtual machine, and deferring creation of the checkpoint file with respect to the process until completion of the memory or file operation.

12. The method according to claim 1, further comprising restoring operation of a process within the virtual machine based on the checkpoint file, without restoring confidential data.

13. The method according to claim 1, wherein a message is communicated to a process prior to creating the checkpoint file, the process assumes a safe state in which confidential information is removed from the memory pages and files which are captured within the checkpoint file, the checkpoint file is captured, and the process reverts to a normal operation state.

14. The method according to claim 1, further comprising restoring an operation state of the virtual machine from the checkpoint file, and informing processes that the virtual machine is restored from a checkpoint file.

15. The method according to claim 1, wherein the memory pages comprise user space memory and kernel space memory.

16. The method according to claim 15, further comprising:

initiating a checkpointing process;

sanitizing kernel space memory by pausing system calls and I/O requests from an application by the kernel, completing or flushing any pending I/O operations, and removing data from all I/O buffers after the completion of the I/O operations; and

subsequently capturing a checkpoint file;

17. A checkpointing system, adapted to create a file representing a restorable state of a virtual machine in a computing system, comprising an automated processor configured to at least one of:

(a) identify processes executing within the virtual machine that may store confidential data; and

marking memory pages and files that potentially contain data stored by the identified processes; and

(b) provide an application programming interface for marking memory regions and files within the virtual machine that contain confidential data stored by processes; and

to create a checkpoint file, by capturing memory pages and files representing a current state of the computing system, which excludes information from all of the marked memory pages and files; and

a memory configured to store the checkpoint file.

18. A nontransitory computer readable medium which stores instructions to control a programmable processor to creating a checkpoint file representing a restorable state of a virtual machine in a computing system, comprising

instructions to control the automated processor to at least one of:

(a) identifying processes executing within the virtual machine that may store confidential data; and

marking memory pages and files that potentially contain data stored by the identified processes; and

(b) providing an application programming interface for marking memory regions and files within the virtual machine that contain confidential data stored by processes; and

instructions to control the automated processor to create a checkpoint file, by capturing memory pages and files representing a current state of the computing system, which excludes information from all of the marked memory pages and files.