System and method for enforcement of security controls on virtual machines throughout life cycle state changes

Patent metadata

Field	Value
Publication number	US-9389898-B2
Application number	US-201213633487-A
Country	US
Kind code	B2
Filing date	Oct 2, 2012
Priority date	Oct 2, 2012
Publication date	Jul 12, 2016
Grant date	Jul 12, 2016

Abstract

Systems and methods associated with virtual machine security are described herein. One example method includes instantiating a guest virtual machine in a virtual computing environment. The method also includes installing a life cycle agent on the guest virtual machine, assigning an identifying certificate, a set of policies, and an encryption key to the guest virtual machine, and providing the certificate, policies, and encryption key to the guest virtual machine. The certificate, policies, and encryption key may then be used by the guest virtual machine to authenticate itself within the virtual computing environment and to protect data stored on the guest virtual machine.

First claim

What is claimed is:

1. A computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to instantiate a guest virtual machine in a virtual computing environment;
computer readable program code configured to install a life cycle agent on the guest virtual machine;
computer readable program code configured to assign a certificate that identifies the virtual machine, a set of policies, and an encryption key to the guest virtual machine; and
computer readable program code configured to provide the identifying certificate, the set of policies, and the encryption key to the guest virtual machine for use of the identifying certificate, the set of policies or the encryption key, in conjunction with the life cycle agent.

2. The computer program product of claim 1 , further comprising:
computer readable program code configured to detect an event associated with the guest virtual machine; and
computer readable program code configured to provide an authorization signal to the guest virtual machine, where the authorization signal controls the guest virtual machine to perform an action.

3. The computer program product of claim 2 , where the event is a modification of data associated with the guest virtual machine, a modification of a policy associated with the guest virtual machine, an activation of the guest virtual machine, a signal received from the guest virtual machine, a modification of a state of the guest virtual machine, or a determination that integrity of the guest virtual machine has been compromised.

4. The computer program product of claim 2 , where the action is permitting modification of data associated with the detected event, permitting modification of a program associated with the detected event to occur, permitting modification of a policy associated with the detected event, changing a state of the guest virtual machine, shutting down the guest virtual machine, restoring data to a previous state, restoring a policy to a previous state, or restoring the guest virtual machine to a previous state.

5. The computer program product of claim 2 , where the computer readable program code configured to detect the event is further configured to receive a signal describing the event from the guest virtual machine.

6. The computer program product of claim 2 , further comprising computer readable program code configured to generate a report describing the event.

7. The computer program product of claim 1 , where the set of policies comprises a usage policy that indicates usage parameters for the guest virtual machine, an integrity policy that indicates integrity parameters for the guest virtual machine, a security policy that indicates data security parameters for the guest virtual machine, a repair policy that indicates repair parameters for the guest virtual machine, an encryption policy that indicates data encryption parameters for the guest virtual machine, or a snapshot policy that dictates backup parameters for the guest virtual machine.

8. The computer program product of claim 1 , where the identifying certificate, the set of policies, and the encryption key are stored by the life cycle agent.

9. The computer program product of claim 8 , where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to authenticate the guest virtual machine within the virtual computing environment, and where the identifying certificate, the set of policies, or the encryption key is used by the life cycle agent to monitor integrity of the guest virtual machine.

10. The computer program product of claim 1 , further comprising computer readable program code configured to put the guest virtual machine in a locked state and to prevent use of the guest virtual machine.

11. The computer program product of claim 1 , further comprising computer readable program code configured to monitor movement of the guest virtual machine from the virtual computing environment to another environment.

12. The computer program product of claim 11 , wherein the computer readable program code configured to monitor movement of the guest virtual machine is configured to prevent movement of the guest virtual machine from the virtual computing environment to another environment or to allow movement of the guest virtual machine from the virtual computing environment to another authorized environment.

13. The computer program product of claim 1 , further comprising computer readable program code configured to identify or allow a clone of the guest virtual machine.

14. The computer program product of claim 13 , wherein the computer readable program code configured to identify or allow a clone of the guest virtual machine is further configured to prevent concurrent running of the guest virtual machine and the clone of the guest virtual machine.

15. The computer program product of claim 1 , wherein life cycle agent is configured to encrypt data of the guest virtual machine.

16. The computer program product of claim 1 , further comprising computer readable program code configured to put the guest virtual machine in an out of sync state if there is a violation of the integrity of the guest virtual machine, the life cycle agent is missing from the guest virtual machine or there is a deviation in a policy associated with the guest virtual machine, and to correct an inconsistency of the guest virtual machine or revert the guest virtual machine to a previous state.

17. The computer program product of claim 1 , further comprising computer readable program code configured to put the virtual machine in a disposed state and to prevent activation of the virtual machine.

18. A system, comprising:
a policy data store, comprising hardware, to store policies associated with a guest virtual machine operating in a virtual computing environment;
an agent deployment module to deploy a life cycle agent to a guest virtual machine;
a policy deployment module to transmit a set of the policies to the life cycle agent; and
a life cycle engine module to monitor state changes associated with the guest virtual machine based on the policies, and to take remedial action upon detecting an unauthorized state change.

19. The system of claim 18 , further comprising an audit module to generate audit data in response to a remedial action taken by the life cycle engine module.

20. The system of claim 19 , further comprising a report module to generate a report describing a status of the virtual computing environment based, at least in part, on the audit data.

21. The system of claim 18 , further comprising an agent communicator to route signals between the life cycle agent and modules of the system.

22. The system of claim 18 , further comprising a virtual machine integrity module to detect integrity of the guest virtual machine based on the policies, and to take remedial action upon detecting that integrity of the guest virtual machine has been compromised.

23. The system of claim 18 , further comprising a virtual machine data store to store signatures of sensitive data on the guest virtual machine, a list of programs that are authorized to run on the guest virtual machine, data used for integrity checks of the guest virtual machine, data used for repairing the guest virtual machine, data used for restoring the guest virtual machin

Assignees

• Barak Nir
• Jerbi Amir
• Hadar Eitan
• Kletskin Michael
• Ca Inc

Inventors

• Barak Nir
• Jerbi Amir
• Hadar Eitan
• Kletskin Michael

Classifications

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554

  involving event detection and direct action · CPC title