Method and apparatus for lifecycle integrity verification of virtual machines
A method and system for verifying the integrity of virtual machines and for verifying the integrity of discrete elements of the virtual machines throughout the lifecycle of the virtual machines. A virtual machine manager capable of managing one or more virtual machine images is installed on a physical hardware platform. An integrity verification component can be communicatively coupled to the virtual machine manager and an integrity reference component so that the integrity verification component can compare digests of the virtual machine image or discrete virtual machine image elements to virtual machine integrity records accessible from the integrity reference component.
1. A system, comprising:
a machine;
a virtual machine manager capable of managing one or more virtual machine images installed on the machine;
an integrity reference component configured to store a plurality of virtual machine integrity records; and
an integrity verification component communicatively coupled to the virtual machine manager and the integrity reference component, the integrity verification component configured to compare a digest of said one or more virtual machine images to a digest of at least one of said plurality of virtual machine integrity records accessible from the integrity reference component,
wherein the integrity verification component is further configured to generate a trust score, among a plurality of trust scores, for one or more of the virtual machine images responsive to the comparison; and
wherein the system is configured to grant access to an environment responsive to determining whether the one or more virtual machine images are authorized for the environment based on the trust score.
2. The system of claim 1 , wherein:
said one or more virtual machine images includes a plurality of discrete virtual machine image elements; and
the integrity verification component is configured to compare digests of said plurality of discrete virtual machine image elements to digests of at least one of said plurality of virtual machine integrity records accessible from the integrity reference component.
3. The system of claim 2 , further comprising a measurement agent operable within each of said one or more virtual machine images and configured to collect measurements of said discrete virtual machine image elements corresponding to said one or more virtual machine images.
4. The system of claim 3 , wherein:
said collected measurements include said digests of said discrete virtual machine image elements.
5. The system of claim 3 , wherein:
said discrete virtual machine image elements include at least one of an operating system file, an application file, or a configuration file;
said collected measurements include digests of at least one of said operating system file, said application file, or said configuration file of said one or more virtual machine images; and
said collected measurements include at least one of version information of said discrete virtual machine image elements, vendor information of said discrete virtual machine image elements, or location information of said discrete virtual machine image elements.
6. The system of claim 3 , wherein:
the measurement agent operable within each of said one or more virtual machine images is configured to transfer said collected measurements to the integrity verification component; and
the integrity verification component is configured to compare said collected measurements to at least one of said virtual machine integrity records of the integrity reference component.
7. The system of claim 3 , wherein the integrity verification component is configured to generate the trust score using an authenticity score authenticating a source of said collected measurements.
8. The system of claim 2 , wherein the integrity verification component is configured to generate a trust score for at least one of said discrete virtual machine image elements responsive to said comparison.
9. The system of claim 8 , wherein the integrity verification component is configured to generate the trust score for the at least one of said discrete virtual machine images using an authenticity score authenticating a source of said collected measurements.
10. The system of claim 2 , wherein the integrity verification component is configured to generate said digests of said discrete virtual machine image elements.
11. The system of claim 1 , wherein the integrity verification component is integrated with the virtual machine manager.
12. The system of claim 1 , wherein the integrity verification component includes a sub-process having security privileges at least as high as security privileges for the virtual machine manager.
13. The system of claim 1 , wherein the integrity verification component is integrated with a physical hardware layer of the machine.
14. The system of claim 1 , wherein the integrity verification component is configured to verify the integrity of a software stack used to create said one or more virtual machine images prior to creation of said one or more virtual machine images.
15. The system of claim 1 , wherein the integrity verification component is configured to verity the integrity of said one or more virtual machine images when starting said one or more virtual machine images.
16. The system of claim 1 , wherein the integrity verification component is configured to analyze said one or more virtual machine images when stopping said one or more virtual machine images.
17. The system of claim 1 , wherein the integrity verification component is configured to analyze said one or more virtual machine images when suspending said one or more virtual machine images.
18. The system of claim 1 , wherein the integrity verification component is configured to analyze said one or more virtual machine images when migrating said one or more virtual machine images from a second machine to the machine.
19. The system of claim 18 , wherein:
the integrity verification component is configured to analyze said one or more virtual machine images when stopping said one or more virtual images on said second machine; and
the integrity verification component is configured to analyze said one or more virtual machine images when starting said one or more virtual images on the machine.
20. The system of claim 1 , wherein the integrity verification component is configured to analyze said one or more virtual machine images when destroying said one or more virtual machine images.
21. The system of claim 1 , wherein the integrity reference component is remotely accessible over a network.
22. The system of claim 1 , wherein the integrity reference component includes a virtual machine image.
23. The system of claim 1 , wherein the integrity reference component is digitally signed by an integrity reference provider.
24. A computer-implemented method for verifying the integrity of virtual machines, comprising:
storing a plurality of virtual machine integrity records in an integrity reference component;
comparing a digest of one or more virtual machine images to a digest of at least one of the plurality of virtual machine integrity records stored in the integrity reference component;
generating a trust score, among a plurality of trust scores, for the one or more virtual machine images responsive to comparing the digest of the one or more virtual machine images to the digest of the at least one of the plurality of virtual machine integrity records;
determining whether the one or more virtual machine images is authorized for an environment based on the trust score; and
granting access to the environment responsive to the determination.
25. A computer-implemented method according to claim 24 , wherein generating the trust score for the one or more virtual machine images includes using an authenticity score authenticating a source of the collected measurements.
26. A computer-implemented method according to claim 24 , further comprising comparing digests of discrete virtual machine image elements in one of the virtual machine images to digests stored in at least one of the plurality of virtual machine integrity records stored in the integrity reference component.
27. A computer-implemented method according to claim 26 , further comprising:
collecting measurements of the discrete virtual machine image elements using a measurement agent configured within each of the one or more virtual machine images.
28. A computer-implemented method according to claim 27 , wherein collecting measurements includes generating a digest of at least one of the discrete virtual machine image elements.
29. A computer-implemented method according to claim 27 , wherein:
the discrete virtual machine image elements include at least one of an operating system file, an application file, or a configuration file;
collecting measurements includes:
generating digests of at least one of the operating system file, the application file, or the configuration file of the one or more virtual machine images; and
collecting at least one of version information of said discrete virtual machine image elements, vendor information of said discrete virtual machine image elements, or location information of said discrete virtual machine image elements.
30. A computer-implemented method according to claim 27 , further comprising:
transferring the collected measurements between the measurement agent configured within each of the one or more virtual machine images and the integrity verification component; and
comparing the collected measurements to at least one of the plurality of virtual machine integrity records of the integrity reference component.
31. A computer-implemented method according to claim 30 , further comprising:
generating a trust score for at least one of the discrete virtual machine image elements responsive to the comparison.
32. A computer-implemented method according to claim 31 , wherein generating the trust score includes using an authenticity score authenticating a source of the collected measurements.
33. A computer-implemented method according to claim 24 , further comprising:
verifying the integrity of a software stack used to create the one or more virtual machine images prior to creation of the one or more virtual machine images; and
creating the one or more virtual machine images responsive to verifying the integrity of the software stack.
34. A computer-implemented method according to claim 24 , further comprising:
starting the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
35. A computer-implemented method according to claim 24 , further comprising:
stopping the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
36. A computer-implemented method according to claim 24 , further comprising:
suspending the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
37. A computer-implemented method according to claim 24 , further comprising:
migrating the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
38. A computer-implemented method according to claim 24 , further comprising:
verifying the integrity of the one or more virtual machine images when destroying the one or more virtual machine images; and
destroying the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
39. A computer-implemented method according to claim 24 , further comprising:
remotely accessing the integrity reference component over a network.
40. An article comprising a non-transitory machine-accessible medium having associated data that, when accessed, results in a machine:
storing a plurality of virtual machine integrity records in an integrity reference component;
comparing a digest of one or more virtual machine images to a digest of at least one of the plurality of virtual machine integrity records stored in the integrity reference component;
generating a trust score, among a plurality of trust scores, for the one or more virtual machine images responsive to comparing the digest of the one or more virtual machine images to the digest of the least one of the plurality of virtual machine integrity records;
determining whether the one or more virtual machine images is authorized for an environment based on the trust score; and
granting access to the environment responsive to the determination.
41. An article according to claim 40 , wherein generating the trust score for the one or more virtual machine images includes using an authenticity score authenticating a source of the collected measurements.
42. An article according to claim 40 , further comprising comparing digests of discrete virtual machine image elements in one of the virtual machine images to digests stored in at least one of the plurality of virtual machine integrity records stored in the integrity reference component.
43. An article according to claim 42 , further comprising:
collecting measurements of the discrete virtual machine image elements using a measurement agent configured within each of the one or more virtual machine images.
44. An article according to claim 43 , wherein collecting measurements includes generating a digest of at least one of the discrete virtual machine image elements.
45. An article according to claim 43 , wherein:
the discrete virtual machine image elements include at least one of an operating system file, an application file, or a configuration file; and
collecting measurements includes generating digests of at least one of the operating system file, the application file, or the configuration file of the one or more virtual machine images.
46. An article according to claim 43 , further comprising:
transferring the collected measurements between the measurement agent configured within each of the one or more virtual machine images and an integrity verification component; and
comparing the collected measurements to at least one of the plurality of virtual machine integrity records of the integrity reference component.
47. An article according to claim 46 , further comprising:
generating a trust score for at least one of the discrete virtual machine image elements responsive to said comparing the collected measurements.
48. An article according to claim 47 , wherein generating the trust score includes using an authenticity score authenticating a source of the collected measurements.
49. An article according to claim 40 , further comprising:
verifying the integrity of a software stack used to create the one or more virtual machine images prior to creation of the one or more virtual machine images; and
creating the one or more virtual machine images responsive to verifying the integrity of the software stack.
50. An article according to claim 40 , further comprising:
starting the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
51. An article according to claim 40 , further comprising:
stopping the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
52. An article according to claim 40 , further comprising:
suspending the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
53. An article according to claim 40 , further comprising:
migrating the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
54. An article according to claim 40 , further comprising:
verifying the integrity of the one or more virtual machine images when destroying the one or more virtual machine images; and
destroying the one or more virtual machine images responsive to verifying the integrity of the one or more virtual machine images.
55. An article according to claim 40 , further comprising:
remotely accessing the integrity reference component over a network.