Method and device for the secure authentication and execution of programs

Patent metadata

Field	Value
Publication number	US-10122713-B2
Application number	US-201415027963-A
Country	US
Kind code	B2
Filing date	Oct 3, 2014
Priority date	Oct 8, 2013
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

A device and a method for encrypting a virtual machine by on-the-fly encryption and decryption of the memory is described. The device comprises hardware and software elements, including a hardware security module for executing, in response to data read/write requests, on-the-fly encryption and decryption operations of the data stream associated with an encrypted memory image. The device and the method are particularly suited to allowing the secure authentication and execution of programs in the context of the infrastructure as a service layer of the cloud computing model.

First claim

The invention claimed is:

1. In a cloud computing environment composed of a plurality of Virtual Machine (VM) servers wherein each VM server comprises a processor enabling an execution of hypervisor software in order to assign virtual machines to client terminals through a user network, and of at least one authentication server enabling a bilaterally authenticated connection between a client terminal and the cloud, a device for executing encrypted programs comprising:
a bilaterally authenticated connection establishment module for establishing a bilaterally authenticated connection between a client terminal and the cloud;
an encrypted memory image generation module for generating, in response to a request to connect to the cloud from said client terminal, an encrypted memory image for a virtual machine assigned to said client terminal; and
a security module for execution in response to requests of read/write of data into said encrypted memory image received from the processor of said virtual machine, of on-the-fly encryption and decryption operations in read/write of the data associated with said encrypted memory image,
wherein the encrypted memory image generation module comprises means for:
generating a private encryption key to assign a virtual memory image to said client terminal;
downloading to said client terminal the assigned virtual memory image;
encrypting the assigned virtual memory image; and
uploading the assigned and encrypted virtual memory image to the cloud; and

wherein the bilaterally authenticated connection establishment module for establishing the authenticated connection between said client terminal and the cloud comprise chip card reader type means coupled to said client terminal to calculate an encryption key as a function of a personal code stored on the chip card and means coupled to an authentication server of the cloud for performing an authentication upon reception of the personal code.

2. The device as claimed in claim 1 , wherein the personal code is a 128-bit long term secret.

3. The device as claimed in claim 1 , wherein the private encryption key generated for a virtual machine is a function of the personal code.

4. The device as claimed in claim 1 , wherein the private encryption key is stored in the authentication server.

5. The device as claimed in claim 4 , wherein the execution of an on-the-fly encryption or decryption operation performed in response to a request to read a word at a clear address of the memory of one of the servers comprises:
receiving from the authentication server the private encryption key;
retrieving in the encrypted memory image an encrypted data block containing the clear address of the word to be read;
decrypting the encrypted block with the private encryption key;
extracting the word to be read in the decrypted block; and
sending the extracted word to the processor of one of the servers.

6. The device as claimed in claim 4 , wherein the execution of an on-the-fly encryption or decryption operation performed in response to a request to write a word at a clear address in the memory of one of the servers comprises:
receiving from the authentication server the private encryption key;
retrieving in the encrypted memory image an encrypted data block containing the clear address of the word to be written;
decrypting the encrypted block with the private encryption key; and
writing the word at the clear address in the decrypted block.

7. The device as claimed in claim 1 , additionally comprising an interrupt management module.

8. In a cloud computing environment composed of a plurality of Virtual Machine (VM) servers wherein each VM server comprises a processor enabling an execution of hypervisor software in order to assign virtual machines to client terminals through a user network, and of at least one authentication server enabling a bilaterally authenticated connection between a client terminal and the cloud, a method for executing encrypted programs comprising the steps of:
after the establishment of a bilaterally authenticated connection between a client terminal and the cloud in response to a request to connect to the cloud from the client terminal, generating an encrypted memory image for a virtual machine assigned to said client terminal; and
in response to requests of read/write of data into said encrypted memory image received from the processor of said virtual machine, executing on-the-fly encryption and decryption operations in read/write of the data associated with said encrypted memory image,
wherein the step for generating an encrypted memory image additionally comprises the steps of:
generating a private encryption key to assign a virtual memory image to said client terminal;
downloading to said client terminal the assigned virtual memory image;
encrypting the assigned virtual memory image; and
uploading the assigned and encrypted virtual memory image to the cloud; and

wherein the step for enabling the authenticated connection between said client terminal and the cloud comprises a step for calculating an encryption key as a function of a personal code stored on a chip card read by chip card reader means coupled to said client terminal and a step for authenticating the personal code upon reception of the code by the authentication server.

9. The method as claimed in claim 8 , wherein the execution of an on-the-fly encryption or decryption operation is performed in response to a request to read a word at a clear address of the memory of one of the servers and comprises the steps of:
receiving from the authentication server a private encryption key;
retrieving in the encrypted memory image an encrypted data block containing the clear address of the word to be read;
decrypting the encrypted block with the private encryption key;
extracting the word to be read in the decrypted block; and
sending the extracted word to the processor of one of the servers.

10. The method as claimed in claim 8 , wherein the execution of an on-the-fly encryption or decryption operation is performed in response to a request to write a word at a clear address in the memory of said one of the servers and comprises the steps of:
receiving from the authentication server a private encryption key;
retrieving in the encrypted memory image an encrypted data block containing the clear address of the word to be written;
decrypting the encrypted block with the private encryption key; and
writing the word at the clear address in the decrypted block.

11. A non-transitory computer program product, said non-transitory computer program product comprising code instructions for carrying out the steps of the method as claimed in claim 8 , when said non-transitory computer program product is executed on a computer.

12. In a cloud computing environment composed of a plurality of servers and client terminals suitable for connecting to the cloud, one of the servers comprising a processor and a main memory enabling the execution of hypervisor software in order to assign virtual machines to the client terminals, a device comprising:
an encrypted memory image generation module for generating, in response to a request to connect to the cloud from a client terminal, an encrypted memory image of a virtual machine assigned to the client terminal;
a storage server to store the encrypted memory image; and
a security module coupled to the storage server and to said one of the servers, to execute, in response to data read/write requests received from the processor of one of the servers, on-the-fly encryption and decryption operations of the data stream associated with said encrypted memory image,
wherein the encrypted

Assignees

• Commissariat Energie Atomique

Inventors

• Hubert Laurent
• Sirdey Renaud

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0869 Primary

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• H04L67/1002

  Electricity · mapped topic

• G06F2221/034

  Test or assess a computer or a system · CPC title