Method for monitoring the security of a virtual machine in a cloud computing architecture

Patent metadata

Field	Value
Publication number	US-10540499-B2
Application number	US-201515317910-A
Country	US
Kind code	B2
Filing date	Jun 10, 2015
Priority date	Jun 11, 2014
Publication date	Jan 21, 2020
Grant date	Jan 21, 2020

Abstract

One embodiment relates to a method for monitoring the security of a virtual machine hosted by a host system, the virtual machine comprising an operating system communicating with a hypervisor of the host system. The hypervisor interfaces between the operating system and hardware resources of the host system. The method comprises receiving at least one machine instruction corresponding to an interruption in the operating system, said interruption following an event having occurred in the virtual machine and executing the instruction by the hypervisor using the hardware resources of the host system and transmitting to the operating system a data stream including the result of the execution. The sent data stream is duplicated in a second stream and the second stream is analyzed by a security agent running on an entity separate from the virtual machine in order to detect a security problem during the processing of the interruption.

First claim

The invention claimed is:

1. A method for security monitoring of a virtual machine hosted by a host system, the virtual machine comprising an operating system communicating with a hypervisor of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following processes executed by the hypervisor:
duplicating the virtual machine as a duplicated virtual machine, the duplicated virtual machine having a security agent installed thereon;
receiving from the operating system at least one machine instruction corresponding to an interrupt in the operating system, said interrupt following an event that has occurred in the virtual machine; and
executing the instruction using the hardware resources of the host system and sending to the operating system a data stream including the result of executing the instruction;
wherein the sent data stream is duplicated in a second stream and the second stream is sent to the duplicated virtual machine and analyzed by the security agent installed on the duplicated virtual machine in order to detect a security problem during the processing of the interrupt.

2. The security monitoring method as claimed in claim 1 wherein the stream duplication, stream sending and instruction execution processes are executed atomically.

3. A device for security monitoring of a virtual machine hosted on said device and including an operating system communicating with a hypervisor of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said device comprising a processor and a memory, the device being configured to:
duplicate the virtual machine as a duplicated virtual machine, the duplicated virtual machine having a security agent installed thereon
receive from the operating system at least one associated machine instruction corresponding to an interrupt in the operating system, said interrupt following an event that has occurred in the virtual machine;
execute said instruction using the hardware resources of the host system and send to the operating system a stream including the result of executing said instruction;
duplicate the stream as a second stream; and
execute the security agent installed on the duplicated virtual machine to analyze the second stream in order to detect a security problem when processing the interrupt.

4. A security monitoring system including:
the security monitoring device of claim 3 ;
the virtual machine; and
the duplicated virtual machine having the security agent installed theron.

5. A computer comprising a processor and a memory, the computer having stored thereon instructions, which when executed by said computer, cause said computer to perform a method for security monitoring of a virtual machine hosted by a host system, the virtual machine comprising an operating system communicating with a hypervisor of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following processes:
duplicating the virtual machine as a duplicated virtual machine, the duplicated virtual machine having a security agent installed thereon;
receiving from the operating system at least one machine instruction corresponding to an interrupt in the operating system, said interrupt following an event that has occurred in the virtual machine; and
executing the instruction using the hardware resources of the host system and sending to the operating system a data stream including the result of executing the instructions;
wherein the sent data stream is duplicated in a second stream and the second stream is sent to the duplicated virtual machine and analyzed by the security agent installed on the duplicated virtual machine in order to detect a security problem during the processing of the interrupt.

6. A non-transitory computer readable medium having stored thereon instructions, which when executed by a computer, cause said computer to perform a method for security monitoring of a virtual machine hosted by a host system, the virtual machine comprising an operating system communicating with a hypervisor of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following processes:
duplicating the virtual machine as a duplicated virtual machine, the duplicated virtual machine having a security agent installed thereon;
receiving from the operating system at least one machine instruction corresponding to an interrupt in the operating system, said interrupt following an event that has occurred in the virtual machine; and
executing the instruction using the hardware resources of the host system and sending to the operating system a data stream including the result of executing the instruction;
wherein the sent data stream is duplicated in a second stream and the second stream is sent to the duplicated virtual machine and analyzed by the security agent installed on the duplicated virtual machine in order to detect a security problem during the processing of the interrupt.

Assignees

• Orange

Inventors

• Wailly Aurélien
• Legouge Pascal

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title