Providing security for a virtual machine by selectively triggering a host security scan
View Patent ↗The disclosed embodiments provide a system that protects an application from malware on a host system. During operation, the system receives a command to commence execution of the application on the host system. In response to the command, the system causes a security scan to be performed on the host system to detect malware, wherein the malware can compromise the security of the application. The system also restricts one or more operations associated with the application until the security scan successfully completes.
1. A method for protecting an application from malware on a host system, comprising:
receiving a command to launch the application on the host system, wherein the application is a virtual machine or virtual machine monitor for a virtual machine; and
in response to the command,
commencing a security scan on the host system to detect malware before launching the application, wherein the malware can compromise security of the application and wherein the security scan examines running processes which are resident in memory,
launching the application on the host system even if the security scan has not completed, and
restricting one or more operations associated with the launched application until the security scan successfully completes.
2. The method of claim 1 , wherein restricting the one or more operations associated with the application involves preventing a user from entering a password associated with the application, thereby preventing key-logging malware from intercepting the password.
3. The method of claim 2 ,
wherein preventing the user from entering the password involves greying out an authorization dialog box so that the user is prevented from entering the password into the authorization dialog box; and
wherein after the security scan completes successfully, the method further comprises ungreying the authorization dialog box so that the user can enter the password into the authorization dialog box.
4. The method of claim 1 , wherein restricting the one or more operations associated with the application involves obscuring a screen or preventing the application from displaying the screen, thereby preventing screen-scraping malware from scraping data from the screen.
5. The method of claim 1 , wherein the method further comprises:
periodically performing a full or a progressive/differential security scan on the host system while the application is executing; and
if a periodic security scan fails, restricting data input and data output associated with the application.
6. The method of claim 1 , wherein the method further comprises performing a full or a progressive/differential security scan on the host system when a pre-specified trigger point is encountered during execution of the application.
7. The method of claim 6 , wherein the pre-specified trigger point can include:
the application reading and decrypting an encrypted file;
the application displaying an authentication dialog;
the application writing data to disk; or
the application performing an application-shut-down operation.
8. The method of claim 1 , wherein the virtual machine monitor can trigger execution of the virtual machine.
9. The method of claim 8 , wherein triggering the execution of the virtual machine involves:
causing a second security scan to be performed on the host system to detect malware, wherein the malware can compromise security of the virtual machine;
commencing execution of the virtual machine on the host system; and
restricting one or more operations associated with the virtual machine until the second security scan successfully completes.
10. The method of claim 1 , wherein the security scan further examines one or more of the following:
any executable code which is to be loaded into memory; and
any code that can potentially inject malware.
11. The method of claim 1 , wherein causing the security scan to be performed on the host system involves determining whether the security scan was performed within a preceding time interval, and if not, triggering the security scan.
12. The method of claim 1 , wherein causing the security scan to be performed on the host system involves ensuring that an existing security scanner within the host system is installed, running and up-to-date.
13. The method of claim 1 , wherein if the security scan detects malware, the method further comprises:
notifying a user and/or an administrator about the malware; and
continuing to restrict the one or more operations associated with the application.
14. The method of claim 1 , wherein performing the security scan on the host system involves uploading data from the host system to a remote computing system, so that the remote computing system can perform the security scan.
15. The method of claim 1 , wherein performing the security scan on the host system involves detecting the presence of a working malware scanner installed on the host system.
16. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for protecting an application from malware on a host system, the method comprising:
receiving a command to launch the application on the host system, wherein the application is a virtual machine or virtual machine monitor for a virtual machine; and
in response to the command,
commencing a security scan on the host system to detect malware before launching the application, wherein the malware can compromise security of the application and wherein the security scan examines running processes which are resident in memory,
launching the application on the host system even if the security scan has not completed, and
restricting one or more operations associated with the launched application until the security scan successfully completes.
17. The computer-readable storage medium of claim 16 , wherein restricting the one or more operations associated with the application involves preventing a user from entering a password associated with the application, thereby preventing key-logging malware from intercepting the password.
18. The computer-readable storage medium of claim 17 ,
wherein preventing the user from entering the password involves greying out an authorization dialog box so that the user is prevented from entering the password into the authorization dialog box; and
wherein after the security scan completes successfully, the method further comprises ungreying the authorization dialog box so that the user can enter the password into the authorization dialog box.
19. The computer-readable storage medium of claim 16 , wherein restricting the one or more operations associated with the application involves obscuring a screen or preventing the application from displaying the screen, thereby preventing screen-scraping malware from scraping data from the screen.
20. The computer-readable storage medium of claim 16 , wherein the method further comprises:
periodically performing a full or progressive/differential security scan on the host system while the application is executing; and
if a periodic security scan fails, restricting data input and data output associated with the application.
21. The computer-readable storage medium of claim 16 , wherein the method further comprises performing a full or a progressive/differential security scan on the host system when a pre-specified trigger point is encountered during execution of the application.
22. The computer-readable storage medium of claim 21 , wherein the pre-specified trigger point can include:
the application reading and decrypting an encrypted file;
the application displaying an authentication dialog;
the application writing data to disk; or
the application performing an application-shut-down operation.
23. The computer-readable storage medium of claim 16 , wherein the virtual machine monitor can trigger execution of the virtual machine.
24. The computer-readable storage medium of claim 23 , wherein triggering the execution of the virtual machine involves:
causing a second security scan to be performed on the host system to detect malware, wherein the malware can compromise security of the virtual machine;
commencing execution of the virtual machine on the host system; and
restricting one or more operations associated with the virtual machine until the second security scan successfully completes.
25. The computer-readable storage medium of claim 16 , wherein the security scan further examines one or more of the following:
any executable code which is to be loaded into memory; and
any code that can potentially inject malware.
26. The computer-readable storage medium of claim 16 , wherein causing the security scan to be performed on the host system involves determining whether the security scan was performed within a preceding time interval, and if not, triggering the security scan.
27. The computer-readable storage medium of claim 16 , wherein causing the security scan to be performed on the host system involves ensuring that an existing security scanner within the host system is installed, running and up-to-date.
28. The computer-readable storage medium of claim 16 , wherein if the security scan detects malware, the computer-readable storage medium further comprises:
notifying a user and/or an administrator about the malware; and
continuing to restrict the one or more operations associated with the application.
29. The computer-readable storage medium of claim 16 , wherein performing the security scan on the host system involves uploading data from the host system to a remote computing system, so that the remote computing system can perform the security scan.
30. The computer-readable storage medium of claim 16 , wherein performing the security scan on the host system involves detecting the presence of a working malware scanner installed on the host system.
31. An apparatus that protects an application from malware on a host system, comprising:
an execution mechanism configured to receive a command to launch the application on the host system, wherein in response to the command, the execution mechanism is configured to launch the application on the host system, wherein the application is a virtual machine or virtual machine monitor for a virtual machine; and
a security mechanism, wherein in response to the command being received by the execution mechanism, the security mechanism is configured to,
commence a security scan on the host system before launching the application, to detect malware, wherein the malware can compromise security of the application and wherein the security scan examines running processes which are resident in memory,
launch the application on the host system even if the security scan has not completed, and
restrict one or more operations associated with the launched application until the security scan successfully completes.