Security assessment of virtual computing environment using logical volume image

Patent metadata

Field	Value
Publication number	US-11216563-B1
Application number	US-201715600554-A
Country	US
Kind code	B1
Filing date	May 19, 2017
Priority date	May 19, 2017
Publication date	Jan 4, 2022
Grant date	Jan 4, 2022

Abstract

Systems for performing a security assessment of a target computing resource, such as a virtual machine or an instance of a virtual machine, include a scanning service that facilitates duplication of all or a portion of the target computing resource, and then performs the security assessment on the duplicate computing resource to avoid consuming processing time, processing power, and storage space of the target computing resource. A snapshot of the target computing resource, containing the data necessary to reproduce the portion to be assessed, is captured and used to implement the duplicate computing resource in newly allocated resources. The snapshot can be an image of a logical volume implementing the target computing resource. To reproduce a target virtual machine, the snapshot may include a configuration used to instantiate the target virtual machine; the scanning service may implement a duplicate virtual machine that is instantiated with the same configuration.

First claim

What is claimed is:

1. A system, including a memory and a processor, the memory including computer-executable instructions that upon execution by the processor cause the system to:
receive a request to perform a security assessment of a first virtual machine instance, the first virtual machine instance including a first logical volume, the first virtual machine instance being configured to operate within a virtual network of a user of the system and associated with a user account of the user;
obtain access to a first volume image of the first logical volume generated at a first point in time;
cause a second virtual machine instance to be run, using the first volume image, in the virtual network of the user;
cause the second virtual machine instance to establish a connection to a restricted computing resource associated with the user account associated with the first virtual machine instance;
perform the security assessment on the second virtual machine instance to produce a first assessment result describing a security vulnerability of the first virtual machine instance, the security assessment including analyzing the connection of the second virtual machine instance to the restricted resource; and
associate the first assessment result with the first virtual machine instance.

2. The system of claim 1 , wherein the computer-executable instructions upon execution by the processor further cause the system to:
install a security agent program within the second virtual machine instance, the security agent program configured to, upon execution:
collect telemetry data of the second virtual machine instance, the telemetry data indicating network activity, file system activity, or processing activity; and
send the telemetry data to the system;
receive the telemetry data for a duration of the security assessment; and
analyze the telemetry data using assessment rules to produce the first assessment result.

3. The system of claim 1 , wherein the computer-executable instructions upon execution by the processor further cause the system to:
associate the first volume image with the user account associated with the first virtual machine instance; and
store the first volume image in a data store.

4. The system of claim 1 , wherein the computer-executable instructions upon execution by the processor further cause the system to:
receive a request identifying the user account associated with the first virtual machine instance, the request including a request to perform periodic security assessments on the first virtual machine instance; and
in response to a trigger event, generate the request to perform the security assessment, the trigger event occurring based on a time period specified by the request to perform the periodic security assessments.

5. The system of claim 1 wherein said performing the security assessment on the second virtual machine instance includes:
intercepting network traffic directed to the first virtual machine instance and routing the intercepted network traffic to the first virtual machine instance;
analyzing the intercepted network traffic and generating a traffic profile describing characteristics of the intercepted network traffic;
generating simulated network traffic including characteristics described by the traffic profile;
directing the simulated network traffic to the second virtual machine instance;
generating a partial assessment result for the first virtual machine instance by analyzing behavior of the second virtual machine instance in response to the simulated network traffic; and
including the partial assessment result in the first assessment result.

6. A system, comprising one or more hardware computing devices configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
receive a command to initiate a security assessment of a first computing resource including a first logical volume storing information for implementing the first computing resource, the first computing resource being configured to operate within a virtual network of a user of the system and being associated with a user account of the user;
obtain access to a first data describing a first state of the first logical volume at a first time;
use the first data to launch a second computing resource in the virtual network of the user that is associated with the user account of the user;
perform the security assessment using the first data to produce a first assessment result, the security assessment including analyzing a connection of the second computing resource to a restricted resource associated with the user account of the user associated with the first computing resource; and
associate the first assessment result with the first computing resource.

7. The system of claim 6 , wherein the first data includes an identifier of the first computing resource, and to obtain access to the first data, the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
obtain the identifier;
access a storage service containing the first data; and
use the identifier to retrieve the first data.

8. The system of claim 6 , wherein to perform the security assessment using the first data, the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to install an agent on the second computing resource, the agent including executable instructions that, when executed, cause the agent to perform the security assessment.

9. The system of claim 6 , wherein the security assessment includes an evaluation of a virtual machine configuration, the first computing resource is a first virtual machine instance, and to perform the security assessment the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
determine, based at least in part on the first data, that the first virtual machine instance has the virtual machine configuration;
generate, using the first data, a second virtual machine instance including the virtual machine configuration; and
perform the security assessment on the second virtual machine instance.

10. The system of claim 6 , wherein the first data comprises a volume image of the first logical volume, and to perform the security assessment using the first data, the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
request, from a computing resource service provider in communication with the one or more hardware computing devices, an allocation of physical storage resources;
create a second logical volume on the allocation of physical storage resources;
mount the volume image into the second logical volume to produce a mounted volume; and
perform the security assessment on the mounted volume.

11. The system of claim 10 , wherein to mount the image into the second logical volume, the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
determine, from the first data, a first type of a file system of the first logical volume;
transform, using the first type, the volume image into a virtual storage device comprising the file system of the first logical volu

Assignees

• Amazon Tech Inc

Inventors

• Veselov Vladimir
• Nagargadde Aparna
• Grajdeanu Adrian-Radu

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title