Securing anti-virus software with virtualization

• US 8,307,443 B2
• Filed: 09/28/2007
• Issued: 11/06/2012
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Jiahe Helen, Lorch, Jacob R., Parno, Bryan Jeffrey
• Primary Examiner(s): Gelagay, Shewaye
• Application Number:
  US11/863,870
• Publication Number:
  US 20090089879A1
• Time in Patent Office: 1,866 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

The subject disclosure relates to systems and methods that secure anti-virus software through virtualization. Anti-virus systems can be maintained separate from user applications and operating system through virtualization. The user applications and operating system run in a guest virtual machine while anti-virus systems are isolated in a secure virtual machine. The virtual machines are partially interdependent such that the anti-virus systems can monitor user applications and operating systems while the anti-virus systems remain free from possible malicious attack originating from a user environment. Further, the anti-virus system is secured against zero-day attacks so that detection and recovery may occur post zero-day.

Claims

1. A secured anti-virus system comprising:

a processor; and

a memory, the memory coupled to the processor, the memory having stored thereon instructions that when run on the processor cause the processor to;

run a first virtual machine that supports an anti-virus scanning component; and

run a second virtual machine that supports a user environment, the second virtual machine interdepending upon the first virtual machine such that the anti-virus component securely protects the integrity of the user environment, the first virtual machine including an append only log file that retains entries related to file system operations performed by the second virtual machine, the append only log file being configured as a persistent file, the append only log file configured to be scanned by the anti-virus scanning component a plurality of times, the anti-virus component of the first virtual machine configured to observe file system activity in the user environment in the second virtual machine, and the first virtual machine including file system employed by the user environment in the second virtual machine and the second virtual machine includes a stub interface to the file system.

2. The system of claim 1, wherein the first virtual machine is isolated from the second virtual machine such that the anti-virus component is free from interference by components in the user environment.

3. The system of claim 1, further comprising a virtual machine monitor that supports and controls the first and second virtual machines.

4. The system of claim 3, wherein the virtual machine monitor permits the first virtual machine to access the second virtual machine and passes messages therebetween.

5. The system of claim 1, further comprising a replay component that employs the append only log file to generate files created by the operations logged.

6. The system of claim 1, further comprising a checker component that periodically obtains snapshots of a disk of the second virtual machine, wherein the checker component replays operations entered in the append only log file on a previous snapshot and compares the resultant disk to a most recent snapshot to verify consistency of the disk of the second virtual machine with the append only log file.

7. The system of claim 1, wherein the append only log file is append-only to prevent edits or deletions by a compromised user environment of the second virtual machine.

8. The system of claim 1, wherein the second virtual machine includes a filter driver component that intercepts file system operations and provides operational information to the first virtual machine.

9. The system of claim 8, wherein the anti-virus component monitors the operational information in real time to detect malicious activity.

10. The system of claim 1, wherein the stub interface defines a set of commands the file system recognizes.

11. The system of claim 1, wherein file system commands invoked via the stub interface are forwarded to the first virtual machine to perform on the file system.

12. The system of claim 11, wherein the first virtual machine logs the performed operations.

13. A system for safeguarding anti-virus software integrity, comprising:

means for isolating user applications in a first virtualized environment;

means for supporting an anti-virus scanning component in a second virtualized environment;

means for retaining entries in the second virtualized environment, said entries relating to file system operations in the first virtualized environment, wherein the anti-virus scanning component scans each entry in the means for retaining entries a plurality of times, the means for retaining entries being append only and persistent; and

means for enabling the anti-virus scanning component to verify the security of the user applications in the second virtualized environment, the anti-virus component of the first virtualized environment configured to observe file system activity in the user environment in the second virtualized environment, and the first virtualized environment including a file system employed by the user environment in the second virtualized environment and the second virtualized environment includes a stub interface to the file system.

14. A computer readable storage medium device having stored thereon instructions the instructions comprising instruction for:

running a first virtual machine that supports an anti-virus scanning component; and

running a second virtual machine that supports a user environment, the second virtual machine interdepending upon the first virtual machine such that the anti-virus component securely protects the integrity of the user environment, wherein the first virtual machine includes an append only log file that retains entries related to file system operations performed by the second virtual machine, the append only log file being configured as a persistent file, each entry on the append only log file being configured to be scanned by the anti-virus scanning component a plurality of times, the anti-virus component of the first virtual machine configured to observe file system activity in the user environment in the second virtual machine, and the first virtual machine including a file system employed by the user environment in the second virtual machine and the second virtual machine includes a stub interface to the file system.

15. The computer readable storage device of claim 14, wherein the first virtual machine is isolated from the second virtual machine such that the anti-virus component is free from interference by components in the user environment.

16. The computer readable storage device of claim 14, further comprising a virtual machine monitor that supports and controls the first and second virtual machines.

17. The computer readable storage device of claim 16, wherein the virtual machine monitor permits the first virtual machine to access the second virtual machine and passes messages therebetween.