Application whitelisting using user identification

Patent metadata

Field	Value
Publication number	US-9760712-B2
Application number	US-201414286010-A
Country	US
Kind code	B2
Filing date	May 23, 2014
Priority date	May 23, 2014
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Methods and systems for protecting a virtual machine network are disclosed. In an embodiment, a method involves storing an application whitelist including application-to-user associations in memory such that the application whitelist is immutable by a guest virtual machine, receiving a request to execute an application including an application identifier and a user identifier, comparing the application identifier and the user identifier of the request with the application whitelist, and generating an execution decision indicating whether the requested application can execute on the guest virtual machine.

First claim

What is claimed is:

1. A method for protecting a virtual machine network, the method comprising:
storing an application whitelist specific to a hypervisor within the virtual machine network in memory of a host machine, wherein the application whitelist is used to determine whether applications are permitted to execute on each of a plurality of guest virtual machines executing on the host machine and the application whitelist includes application-to-user associations and is stored in memory that is inaccessible to requests of the plurality of guest virtual machines such that the application whitelist is immutable by a guest virtual machine of the plurality of guest virtual machines during a phase in which adherence to the application whitelist is enforced;
receiving a request to execute an application on the guest virtual machine, the request being generated at the guest virtual machine responsive to intercepting, by the guest virtual machine, a user-generated request to execute the application on the guest virtual machine, wherein intercepting the user-generated request includes blocking execution of the application, and wherein the request to execute the application comprises an application identifier associated with the application and a user identifier associated with a user requesting execution of the application;
comparing the application identifier and the user identifier of the request with the application whitelist; and
generating an execution decision, wherein the execution decision indicates whether the application that was requested is allowed to execute on the guest virtual machine.

2. The method of claim 1 , wherein the application identifier comprises at least one of an application file name and a hash value of the application.

3. The method of claim 1 , wherein the user identifier comprises at least one of a user identifier (ID), a group ID, an Internet Protocol (IP) address, and workstation information of a user requesting the execution of the application.

4. The method of claim 1 , wherein the request to execute an application further comprises an identifier (ID) associated with user access conditions.

5. The method of claim 1 , wherein the application whitelist is generated by monitoring applications executed in virtual machines over a period of time.

6. The method of claim 1 , wherein the application whitelist is generated by automatically adding at least one of files and applications needed by a trusted software updater to the application whitelist when the trusted software updater is added to the application whitelist.

7. The method of claim 1 , wherein the request is received by an application whitelisting service and wherein the request is sent from an agent running on the guest virtual machine.

8. The method of claim 1 , wherein the application whitelist comprises policies defining characteristics of applications.

9. A computer system comprising:
at least one host computing device, the at least one host computing device including at least one processor and memory for running instantiated virtual machines; and
a virtual machine management system configured to manage the virtual machines;
the at least one host computing device and the virtual machine management system being configured to:
store an application whitelist specific to a hypervisor within the virtual machine network in memory of a host machine, wherein the application whitelist is used to determine whether applications are permitted to execute on each of a plurality of guest virtual machines executing on the host machine and the application whitelist includes application-to-user associations and is stored in memory that is inaccessible to requests of the plurality of guest virtual machines such that the application whitelist is immutable by a guest virtual machine of the plurality of guest virtual machines during a phase in which adherence to the application whitelist is enforced;
receive a request to execute an application on the guest virtual machine, the request being generated at the guest virtual machine responsive to intercepting, by the guest virtual machine, a user-generated request to execute the application on the guest virtual machine, wherein intercepting the user-generated request includes blocking execution of the application, and wherein the request to execute the application comprises an application identifier associated with the application and a user identifier associated with a user requesting execution of the application;
compare the application identifier and the user identifier of the request with the application whitelist; and
generate an execution decision, wherein the execution decision indicates whether the application that was requested is allowed to execute on the guest virtual machine.

10. The computer system of claim 9 , wherein the application identifier comprises at least one of an application file name and a hash value of the application.

11. The computer system of claim 9 , wherein the user identifier comprises at least one of a user identifier (ID), a group ID, an Internet Protocol (IP) address, and workstation information of a user requesting the execution of the application.

12. The computer system of claim 9 , wherein the request to execute an application further comprises an identifier (ID) associated with user access conditions.

13. The computer system of claim 9 , wherein the application whitelist is generated by monitoring applications executed in virtual machines over a period of time.

14. The computer system of claim 9 , wherein the application whitelist is generated by automatically adding at least one of files and applications needed by a trusted software updater to the application whitelist when the trusted software updater is added to the application whitelist.

15. The computer system of claim 9 , wherein the request is received by an application whitelisting service and wherein the request is sent from an agent running on the guest virtual machine.

16. The computer system of claim 9 , wherein the application whitelist comprises policies defining characteristics of applications.

17. A non-transitory computer-readable storage medium storing program instructions, wherein execution of the program instructions by one or more processors causes the one or more processors to perform steps comprising:
storing an application whitelist specific to a hypervisor within the virtual machine network in memory of a host machine, wherein the application whitelist is used to determine whether applications are permitted to execute on each of a plurality of guest virtual machines executing on the host machine and the application whitelist includes application-to-user associations and is stored in memory that is inaccessible to requests of the plurality of guest virtual machines such that the application whitelist is immutable by a guest virtual machine of the plurality of guest virtual machines during a phase in which adherence to the application whitelist is enforced;
receiving a request to execute an application on the guest virtual machine, the request being generated at the guest virtual machine responsive to intercepting, by the guest virtual machine, a user-generated request to execute the application on the guest virtual machine, wherein intercepting the user-generated request includes blocking execution of the application, and wherein the request to execute the application comprises an application identifier associated with the application and a user identifier associated with a user requesting execution of the application;
comparing the application identifie

Assignees

• Vmware Inc

Inventors

• Feroz Azeem
• Chen Binyuan
• Dabak Prasad Sharad

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title