Security application for a guest operating system in a virtual computing environment

Patent metadata

Field	Value
Publication number	US-10691475-B2
Application number	US-201816102927-A
Country	US
Kind code	B2
Filing date	Aug 14, 2018
Priority date	Dec 31, 2015
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Hypervisors and guest operating systems/virtual machines communicate in virtual environments to enable applications and other services. Security measures are a concern in implementing a secure environment. One feature may include at least one of identifying a session initiation request from a guest operation system at a hypervisor component of a server and receiving periodic messages from the guest operating system, and establishing and maintaining a session and connection between the hypervisor and the guest operating system responsive to receiving the periodic messages from the guest operating system.

First claim

What is claimed is:

1. A method, comprising:
injecting, by a management component of a hypervisor, a guest kernel module storing heartbeat protocol information and a secret key that is shared between the guest kernel module and the management component of the hypervisor into a kernel of a guest operating system during a boot-up of the guest operating system, wherein the injecting establishes an encrypted heartbeat communication channel between the kernel and the management component of the hypervisor while the guest operating system is booting; and
receiving, at the management component of the hypervisor, periodic encrypted heartbeat messages from the injected guest kernel module based on the heartbeat protocol information, wherein each heartbeat, message verifies the injected guest kernel module is still operating.

2. The method of claim 1 , further comprising maintaining a session between the management component of the hypervisor and the injected guest kernel module responsive to receiving the periodic encrypted heartbeat messages.

3. The method of claim 1 , further comprising initializing a communication session between the injected guest kernel module and the management component of the hypervisor, wherein the management component is a hypervisor management component (HMC).

4. The method of claim 1 , further comprising at least one of:
determining that no periodic heartbeat messages have been received for a predetermined amount of time; and
notifying an administrator device of a security alert in response to the determining.

5. The method of claim 4 , further comprising attempting to reinstall the guest kernel module responsive to determining that no periodic heartbeat messages were received for the predetermined amount of time.

6. The method of claim 1 , wherein the encrypted heartbeat messages are periodically transmitted from the injected guest kernel module to the management component of the hypervisor according to a predetermined time interval that is provided by installation of an agent application on the guest operating system.

7. The method of claim 6 , further comprising at least one of:
applying frequency criteria to the encrypted heartbeat messages; and
monitoring whether the encrypted heartbeat messages are received according to the frequency criteria.

8. An apparatus, comprising:
a processor configured to:
inject, by a management component of a hypervisor, a guest kernel module storing heartbeat protocol information and a secret key that is shared between the guest kernel module and the management component of the hypervisor into a kernel of a guest operating system during a boot-up of the guest operating system, wherein the injection establishes an encrypted heartbeat communication channel between the kernel and the management component of the hypervisor component while the guest operating system is being booted; and
receive periodic encrypted heartbeat messages from the injected guest kernel module based on the heartbeat protocol information, wherein each heartbeat message verifies the injected guest kernel module is still operating.

9. The apparatus of claim 8 , wherein the processor is further configured to maintain a session between the management component of the hypervisor and the injected guest kernel module responsive to the periodic encrypted heartbeat messages being received.

10. The apparatus of claim 8 , wherein the processor is further configured to initialize a communication session between the injected guest kernel module and the management component of the hypervisor, wherein the management component is a hypervisor management component (HMC).

11. The apparatus of claim 8 , wherein the processor is further configured to determine that no periodic heartbeat messages have been received for a predetermined amount of time, and notify an administrator device of a security alert in response to the determination.

12. The apparatus of claim 11 , wherein the processor is further configured to attempt to reinstall the guest kernel module responsive to the determination that no periodic heartbeat messages were received for the predetermined amount of time.

13. The apparatus of claim 8 , wherein the encrypted heartbeat messages are periodically transmitted from the injected guest kernel module to the management component of the hypervisor according to a predetermined time interval that is provided by installation of an agent application on the guest operating system.

14. The apparatus of claim 13 , wherein the processor is further configured to apply frequency criteria to the encrypted heartbeat messages, and monitor whether the encrypted heartbeat messages are received according to the frequency criteria.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:
injecting, by a management component of a hypervisor, a guest kernel module storing heartbeat protocol information and a secret key that is shared between the guest kernel module and the management component of the hypervisor into a kernel of a guest operating system during a boot-up of the guest operating system, wherein the injecting establishes an encrypted heartbeat communication channel between the kernel and the management component of the hypervisor while the guest operating system is booting; and
receiving, at the management component of the hypervisor, periodic encrypted heartbeat messages from the injected guest kernel module based on the heartbeat protocol information, wherein each heartbeat message verifies the injected guest kernel module is still operating.

16. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform maintaining a session between the management component of the hypervisor and the injected guest kernel module responsive to receiving the periodic encrypted heartbeat messages.

17. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform initializing a communication session between the injected guest kernel module and the management component of the hypervisor, wherein the management component is a hypervisor management component (HMC).

18. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform at least one of:
determining that no periodic heartbeat messages have been received for a predetermined amount of time; and
notifying an administrator device of a security alert in response to the determining.

19. The non-transitory computer readable storage medium of claim 18 , wherein the processor is further configured to perform attempting to reinstall the guest kernel module responsive to determining that no periodic heartbeat messages were received for the predetermined amount of time.

20. The non-transitory computer readable storage medium of claim 15 , wherein the encrypted heartbeat messages are periodically transmitted from the injected guest kernel module to the management component of the hypervisor according to a predetermined time interval that is provided by installation of an agent application on the guest operating system, and wherein frequency criteria is applied to the encrypted heartbeat messages, and used to monitor whether the encrypted heartbeat messages are received according to the frequency criteria.

21. The method of claim 1 , wherein the injecting establishes the encrypted heartbeat communication chan

Assignees

• IBM

Inventors

• Barlev Shai
• Kohanim Shahar
• Regev Shmulik

Classifications

• G06F9/4555 Primary

  Para-virtualisation, i.e. guest operating system has to be modified · CPC title

• G06F11/30

  Monitoring · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F9/455 Primary

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title