System and method for enforcement of security controls on virtual machines throughout life cycle state changes

• US 9,389,898 B2
• Filed: 10/02/2012
• Issued: 07/12/2016
• Est. Priority Date: 10/02/2012
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Barak, Nir, Jerbi, Amir, Hadar, Eitan, Kletskin, Michael
• Primary Examiner(s): Tang, Kenneth
• Application Number:
  US13/633,487
• Publication Number:
  US 20140096134A1
• Time in Patent Office: 1,379 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Systems and methods associated with virtual machine security are described herein. One example method includes instantiating a guest virtual machine in a virtual computing environment. The method also includes installing a life cycle agent on the guest virtual machine, assigning an identifying certificate, a set of policies, and an encryption key to the guest virtual machine, and providing the certificate, policies, and encryption key to the guest virtual machine. The certificate, policies, and encryption key may then be used by the guest virtual machine to authenticate itself within the virtual computing environment and to protect data stored on the guest virtual machine.

Claims

1. A computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to instantiate a guest virtual machine in a virtual computing environment;

computer readable program code configured to install a life cycle agent on the guest virtual machine;

computer readable program code configured to assign a certificate that identifies the virtual machine, a set of policies, and an encryption key to the guest virtual machine; and

computer readable program code configured to provide the identifying certificate, the set of policies, and the encryption key to the guest virtual machine for use of the identifying certificate, the set of policies or the encryption key, in conjunction with the life cycle agent.

2. The computer program product of claim 1, further comprising:

computer readable program code configured to detect an event associated with the guest virtual machine; and

computer readable program code configured to provide an authorization signal to the guest virtual machine, where the authorization signal controls the guest virtual machine to perform an action.

3. The computer program product of claim 2, where the event is a modification of data associated with the guest virtual machine, a modification of a policy associated with the guest virtual machine, an activation of the guest virtual machine, a signal received from the guest virtual machine, a modification of a state of the guest virtual machine, or a determination that integrity of the guest virtual machine has been compromised.

4. The computer program product of claim 2, where the action is permitting modification of data associated with the detected event, permitting modification of a program associated with the detected event to occur, permitting modification of a policy associated with the detected event, changing a state of the guest virtual machine, shutting down the guest virtual machine, restoring data to a previous state, restoring a policy to a previous state, or restoring the guest virtual machine to a previous state.

5. The computer program product of claim 2, where the computer readable program code configured to detect the event is further configured to receive a signal describing the event from the guest virtual machine.

6. The computer program product of claim 2, further comprising computer readable program code configured to generate a report describing the event.

7. The computer program product of claim 1, where the set of policies comprises a usage policy that indicates usage parameters for the guest virtual machine, an integrity policy that indicates integrity parameters for the guest virtual machine, a security policy that indicates data security parameters for the guest virtual machine, a repair policy that indicates repair parameters for the guest virtual machine, an encryption policy that indicates data encryption parameters for the guest virtual machine, or a snapshot policy that dictates backup parameters for the guest virtual machine.

8. The computer program product of claim 1, where the identifying certificate, the set of policies, and the encryption key are stored by the life cycle agent.

9. The computer program product of claim 8, where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to authenticate the guest virtual machine within the virtual computing environment, and where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to monitor integrity of the guest virtual machine.

10. The computer program product of claim 1, further comprising computer readable program code configured to put the guest virtual machine in a locked state and to prevent use of the guest virtual machine.

11. The computer program product of claim 1, further comprising computer readable program code configured to monitor movement of the guest virtual machine from the virtual computing environment to another environment.

12. The computer program product of claim 11, wherein the computer readable program code configured to monitor movement of the guest virtual machine is configured to prevent movement of the guest virtual machine from the virtual computing environment to another environment or to allow movement of the guest virtual machine from the virtual computing environment to another authorized environment.

13. The computer program product of claim 1, further comprising computer readable program code configured to identify or allow a clone of the guest virtual machine.

14. The computer program product of claim 13, wherein the computer readable program code configured to identify or allow a clone of the guest virtual machine is further configured to prevent concurrent running of the guest virtual machine and the clone of the guest virtual machine.

15. The computer program product of claim 1, wherein life cycle agent is configured to encrypt data of the guest virtual machine.

16. The computer program product of claim 1, further comprising computer readable program code configured to put the guest virtual machine in an out of sync state if there is a violation of the integrity of the guest virtual machine, the life cycle agent is missing from the guest virtual machine or there is a deviation in a policy associated with the guest virtual machine, and to correct an inconsistency of the guest virtual machine or revert the guest virtual machine to a previous state.

17. The computer program product of claim 1, further comprising computer readable program code configured to put the virtual machine in a disposed state and to prevent activation of the virtual machine.

18. A system, comprising:

a policy data store, comprising hardware, to store policies associated with a guest virtual machine operating in a virtual computing environment;

an agent deployment module to deploy a life cycle agent to a guest virtual machine;

a policy deployment module to transmit a set of the policies to the life cycle agent; and

a life cycle engine module to monitor state changes associated with the guest virtual machine based on the policies, and to take remedial action upon detecting an unauthorized state change.

19. The system of claim 18, further comprising an audit module to generate audit data in response to a remedial action taken by the life cycle engine module.

20. The system of claim 19, further comprising a report module to generate a report describing a status of the virtual computing environment based, at least in part, on the audit data.

21. The system of claim 18, further comprising an agent communicator to route signals between the life cycle agent and modules of the system.

22. The system of claim 18, further comprising a virtual machine integrity module to detect integrity of the guest virtual machine based on the policies, and to take remedial action upon detecting that integrity of the guest virtual machine has been compromised.

23. The system of claim 18, further comprising a virtual machine data store to store signatures of sensitive data on the guest virtual machine, a list of programs that are authorized to run on the guest virtual machine, data used for integrity checks of the guest virtual machine, data used for repairing the guest virtual machine, data used for restoring the guest virtual machine to a prior state, data describing a state of the guest virtual machine, certificate data associated with the guest virtual machine, or a snapshot of the guest virtual machine.

24. The system of claim 18, where the remedial action taken by the life cycle agent comprises initiating a state change in the guest virtual machine, controlling the guest virtual machine to shut down, or restoring the guest virtual machine to a previous state.

25. A system, comprising:

a policy data store, comprising hardware, to store policies associated with a guest virtual machine operating in a virtual computing environment;

an agent deployment module to deploy a life cycle agent to a guest virtual machine;

a policy deployment module to transmit a set of the policies to the life cycle agent; and

a virtual machine integrity module to detect integrity of the guest virtual machine based on the policies, and to take remedial action upon detecting that integrity of the guest virtual machine has been compromised.

26. The system of claim 25, further comprising an audit module to generate audit data in response to a remedial action taken by the virtual machine integrity module.

27. The system of claim 25, where detection that integrity of the guest virtual machine has been compromised comprises comparing data received from the life cycle agent to a policy associated with the guest virtual machine.

28. The system of claim 25, where detection that integrity of the guest virtual machine has been compromised comprises comparing a checksum associated with data on the guest virtual machine received from the life cycle agent to a checksum stored in a virtual machine data store.

29. The system of claim 25, where the remedial action taken by the virtual machine integrity module comprises restoring data on the guest virtual machine to a previous state, restoring a policy on the guest virtual machine to a previous state, or restoring the guest virtual machine to a previous state.

30. A method comprising:

instantiating a guest virtual machine in a virtual computing environment;

installing a life cycle agent on the guest virtual machine;

assigning a certificate that identifies the virtual machine, a set of policies, and an encryption key to the guest virtual machine; and

providing the identifying certificate, the set of policies, and the encryption key to the guest virtual machine for use of the identifying certificate, the set of policies or the encryption key, in conjunction with the life cycle agent.

31. The method of claim 30, further comprising:

detecting an event associated with the guest virtual machine; and

providing an authorization signal to the guest virtual machine, where the authorization signal controls the guest virtual machine to perform an action.

32. The method of claim 31, where the event is a modification of data associated with the guest virtual machine, a modification of a policy associated with the guest virtual machine, an activation of the guest virtual machine, a signal received from the guest virtual machine, a modification of a state of the guest virtual machine, or a determination that integrity of the guest virtual machine has been compromised.

33. The method of claim 31, where the action is permitting modification of data associated with the detected event, permitting modification of a program associated with the detected event to occur, permitting modification of a policy associated with the detected event, changing a state of the guest virtual machine, shutting down the guest virtual machine, restoring data to a previous state, restoring a policy to a previous state, or restoring the guest virtual machine to a previous state.

34. The method of claim 31, where detecting the event further comprises receiving a signal describing the event from the guest virtual machine.

35. The method of claim 31, further comprising generating a report describing the event.

36. The method of claim 30, where the set of policies comprises a usage policy that indicates usage parameters for the guest virtual machine, an integrity policy that indicates integrity parameters for the guest virtual machine, a security policy that indicates data security parameters for the guest virtual machine, a repair policy that indicates repair parameters for the guest virtual machine, an encryption policy that indicates data encryption parameters for the guest virtual machine, or a snapshot policy that dictates backup parameters for the guest virtual machine.

37. The method of claim 30, where the identifying certificate, the set of policies, and the encryption key are stored by the life cycle agent.

38. The method of claim 37, where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to authenticate the guest virtual machine within the virtual computing environment, and where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to monitor integrity of the guest virtual machine.