Technique for verifying virtual machine integrity using hypervisor-based memory snapshots

Patent metadata

Field	Value
Publication number	US-9696940-B1
Application number	US-201314101257-A
Country	US
Kind code	B1
Filing date	Dec 9, 2013
Priority date	Dec 9, 2013
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

A method includes receiving a request at a hypervisor from an application, where the application and the hypervisor are executed by a computing node. The request identifies a memory location in a memory device of the computing node, and the memory location is associated with a virtual machine executed by the computing node. The method also includes obtaining a snapshot of contents of the memory location in the memory device, where the snapshot is obtained by the hypervisor directly from the memory device. The method further includes providing the snapshot to the application. The application could form part of a second virtual machine that is executed by the computing node.

First claim

What is claimed is:

1. A method comprising:
receiving a request at a first hypervisor from an application, the application and the first hypervisor executed by a computing node, wherein the request identifies a memory location in a memory device of the computing node, the memory location associated with a virtual machine executed by the computing node and managed by a second hypervisor also executed by the computing node;
interrupting execution of the application prior to obtaining a snapshot of contents of the memory location in the memory device;
obtaining the snapshot of the contents of the memory location in the memory device, the snapshot obtained by the first hypervisor directly from the memory device;
resuming execution of the application after obtaining the snapshot; and
providing the snapshot to the application.

2. The method of claim 1 , further comprising:
analyzing the snapshot using the application to detect a problem with the virtual machine.

3. The method of claim 2 , wherein analyzing the snapshot comprises performing a hashing operation using the snapshot.

4. The method of claim 3 , wherein analyzing the snapshot further comprises comparing a result of the hashing operation to at least one of:
hash results associated with known good images of kernels;
hash results associated with authorized applications; and
hash results associated with unauthorized applications.

5. The method of claim 2 , wherein analyzing the snapshot comprises:
obtaining a second snapshot of the contents of the memory location from the virtual machine; and
comparing the snapshots or data generated using the snapshots to verify whether at least one of the snapshots has been altered.

6. The method of claim 1 , wherein:
the request comprises one of multiple requests received at the first hypervisor from the application, the multiple requests identifying different memory locations in the memory device, the different memory locations associated with different virtual machines executed by the computing node; and
the method includes obtaining a snapshot for each of the requests and providing each snapshot to the application.

7. The method of claim 1 , further comprising:
suspending execution of the virtual machine using the first hypervisor in response to the virtual machine executing an impermissible application.

8. The method of claim 1 , further comprising:
authenticating a source of the request at the first hypervisor.

9. The method of claim 1 , wherein the application foul's part of a second virtual machine, the second virtual machine executed by the computing node.

10. An apparatus comprising:
at least one memory; and
at least one processing device configured to execute a virtual machine, a first hypervisor, a second hypervisor, and an application, the second hypervisor configured to manage the virtual machine, wherein the at least one processing device is configured when executing the first hypervisor to:
receive at the first hypervisor a request from the application, wherein the request identifies a memory location in the at least one memory, the memory location associated with the virtual machine;
interrupt execution of the application prior to obtaining a snapshot of contents of the memory location in the at least one memory;
obtain the snapshot of the contents of the memory location in the at least one memory directly from the at least one memory;
resume execution of the application after obtaining the snapshot; and
provide the snapshot to the application.

11. The apparatus of claim 10 , wherein the at least one processing device is configured when executing the application to analyze the snapshot to detect a problem with the virtual machine.

12. The apparatus of claim 11 , wherein the at least one processing device is configured to analyze the snapshot by:
performing a hashing operation using the snapshot; and
comparing a result of the hashing operation to at least one of:
hash results associated with known good images of kernels;
hash results associated with authorized applications; and
hash results associated with unauthorized applications.

13. The apparatus of claim 11 , wherein the at least one processing device is configured to analyze the snapshot by:
obtaining a second snapshot of the contents of the memory location from the virtual machine; and
comparing the snapshots or data generated using the snapshots to verify whether at least one of the snapshots has been altered.

14. The apparatus of claim 10 , wherein the at least one processing device is configured when executing the first hypervisor to suspend execution of the virtual machine in response to the virtual machine executing an impermissible application.

15. The apparatus of claim 10 , wherein the at least one processing device is configured to execute the application within a second virtual machine.

16. A non-transitory computer readable medium storing computer readable program code that when executed causes a computing node to:
receive a request at a first hypervisor from an application, the application and the first hypervisor executed by the computing node, wherein the request identifies a memory location in a memory device of the computing node, the memory location associated with a virtual machine executed by the computing node and managed by a second hypervisor also executed by the computing node;
interrupt execution of the application prior to obtaining a snapshot of contents of the memory location in the memory device;
obtain the snapshot of the contents of the memory location in the memory device, the snapshot obtained by the first hypervisor directly from the memory device;
resume execution of the application after obtaining the snapshot; and
provide the snapshot to the application.

17. The computer readable medium of claim 16 , wherein the computer readable medium further stores computer readable program code that when executed causes the computing node to analyze the snapshot using the application to detect a problem with the virtual machine.

18. The computer readable medium of claim 17 , wherein the computer readable program code that when executed causes the computing node to analyze the snapshot comprises computer readable program code that when executed causes the computing node to perform a hashing operation using the snapshot.

19. The computer readable medium of claim 16 , wherein the computer readable medium further stores computer readable program code that when executed causes the computing node to authenticate the application prior to providing the snapshot to the application.

20. The method of claim 1 , wherein the first hypervisor logically operates between a bare metal layer of the computing node and the second hypervisor.

21. The apparatus of claim 10 , wherein the first hypervisor is configured to logically operate between a bare metal layer of the apparatus and the second hypervisor.

Assignees

• Raytheon Co
• Forcepoint Fed Llc

Inventors

• Neumann Matthew D
• Thompson Jr Irby J
• Simms Michael

Classifications

• G06F3/065 Primary

  Replication mechanisms · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F3/0673

  Single storage device · CPC title

• G06F3/0604

  Improving or facilitating administration, e.g. storage management · CPC title