Host-based digital signature verification for guest components

Patent metadata

Field	Value
Publication number	US-9531547-B2
Application number	US-201514749684-A
Country	US
Kind code	B2
Filing date	Jun 25, 2015
Priority date	Apr 6, 2015
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

Examples perform external verification of authenticity of software components loaded onto virtual machines (VM). A processor, external to the VM, reads the loaded software component from the VM, and restores the loaded software component to its disk image state by undoing any changes made to load the software component. The digital signature is read from the restored disk image of the software and compared to the verified digital signature of the publisher of the software component. Some examples contemplate marking the software component as verified or unverified, and preventing unverified software components from making global changes.

First claim

What is claimed is:

1. A system for verifying integrity and authenticity of a software component loaded on a data compute node, said system comprising:
a memory area associated with a computing device, said memory area storing a data compute node; and
a processor external to the data compute node programmed to:
in response to receiving a notification that a software component is loaded on the data compute node, read a copy of the loaded software component;
restore the read copy of the loaded software component to a disk copy state;
verify authenticity of first digital signature of the restored disk copy state of the software component by comparing it to a second digital signature; and
notify the data compute node of the authenticity of the software component.

2. The system of claim 1 , wherein a first digital signature utilizes a first hash of an executable of the software component.

3. The system of claim 1 , wherein a public key is used to decrypt a second hash to find a second digital signature of a software component.

4. The system of claim 1 , wherein the processor is further programmed to transmit the disk copy state of the software component to the digital signature verifier.

5. The system of claim 1 , wherein the verified digital signature of a publisher is stored outside the data compute node.

6. The system of claim 1 , further comprising means for marking the software component as at least one of verified, unverified, authentic, not authentic, or unknown.

7. The system of claim 6 , wherein the data compute node is a virtual machine or a container.

8. A method comprising:
in response to receiving a notification that a software component which is not verified is loaded on a data compute mode operating on a host, reading a loaded copy of the software component from the data compute node;
restoring the loaded copy of the software component to a disk copy state; and
comparing a first digital signature of the disk copy state of the software component to a second digital signature of a publisher of the software component; and
notifying the data compute node of a result of the comparison of the first digital signature to the second digital signature.

9. The method of claim 8 , further comprising receiving the notification that the software component which is not verified is loaded on the data compute node operating on the host.

10. The method of claim 8 , further comprising computing a first digital signature by calculating a first hash of an executable of the software component.

11. The method of claim 8 , wherein restoring the loaded copy of the software component to the disk copy state comprises undoing a plurality of changes made to load the software component.

12. The method of claim 8 , wherein the result of the comparison of the first digital signature to the second digital signature is at least one of authentic, not authentic, or unknown.

13. The method of claim 8 , further comprising marking the software component as verified based on the result of the comparison.

14. The method of claim 8 , wherein restoring the loaded software component to the disk copy state further comprises at least one of de-applying one or more relocations, de-applying one or more import resolutions, de-applying one or more global state changes, or de-applying one or more executable requirements.

15. The method of claim 8 , further comprising decrypting a second hash from a second digital signature of the software component using a public key.

16. A non-transitory computer readable storage medium having stored thereon computer software executable by a processor, the computer software embodying a method for verifying the authenticity of a software component by:
receiving a notification that a data compute node has loaded the software component, wherein the loaded software component is unverified;
reading, in response to the received notification, the loaded software component from the data compute node;
restoring the loaded software component to a disk copy state;
comparing a first digital signature of the disk copy state of the software component to a second digital signature of a publisher of the software component; and
notifying the data compute node of a result of the comparison of the second digital signature to the first digital signature, wherein the software component is prevented from making global changes or executing until the second digital signature is verified as authentic.

17. The non-transitory computer readable storage medium of claim 16 , wherein the computer-executable instructions further cause the processor to read a location of the software component iteratively until all the software component are read.

18. The non-transitory computer readable storage medium of claim 16 , wherein the computer-executable instructions further cause the processor to lock the data compute node until the software component is authenticated.

19. The non-transitory computer readable storage medium of claim 16 , wherein the computer-executable instructions cause the processor to mark the software component as verified or unverified when the software component is loaded on the data compute node.

20. The non-transitory computer readable storage medium of claim 19 , wherein the computer-executable instructions cause the processor to mark the software component as verified after authentication.

Assignees

• Vmware Inc

Inventors

• Dabak Prasad
• Kataria Alok Nemchand

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L2209/72

  Signcrypting, i.e. digital signing and encrypting simultaneously · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title