Secure virtual machine
View Patent ↗An approach to securely distributing and running virtual machines is described that addresses the inherent insecurity of mobile virtual machines by authenticating a user before establishing a specialized virtualization runtime environment that includes a filesystem driver inserted into the host operating system to provide secure access to a virtual machine by authorized hypervisors only. Further described is the creation of a SecureVM package that includes the various components used to perform the operations of installation, user authentication and establishment of the specialized virtualization runtime environment.
1. A method for securely running a virtual machine on a computer, the method comprising:
establishing a host runtime environment on the computer using a host runtime component of a secure virtual machine package;
presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package;
receiving a selection from the user of the computer of one of the at least one virtual machine of the secure virtual machine package;
accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy;
authenticating the user of the computer according to the obtained user authentication security policy;
establishing a virtual machine runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hypervisor of the host operating system; and
accessing encrypted virtual machine files of the user selected virtual machine of the secure virtual machine package via the secure filesystem for the authorized hypervisor of the host operating system by the secure filesystem intercepting read requests from the authorized hypervisor to a regular file system of the host operating system and performing decryption of the secure virtual machine files in response to the intercepted read requests from the authorized hypervisor.
2. The method of claim 1 wherein the secure virtual machine package is installed on the computer before establishing the host runtime environment on the computer.
3. The method of claim 1 wherein presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package comprises displaying a list on a graphical user interface of the computer.
4. The method of claim 1 wherein accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy comprises the computer communicating with a remote server to obtain a key to decrypt the encrypted meta-data.
5. The method of claim 1 wherein accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy comprises obtaining a key embedded in a program included in the secure virtual machine package to decrypt the encrypted meta-data.
6. The method of claim 1 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises receiving a username and password from the user of the computer and comparing the received username and password to motored username and password from the secure virtual machine package.
7. The method of claim 1 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises establishing communication with a remote server.
8. The method of claim 1 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises receiving a hardware token from the user of the computer and comparing the received hardware token to a stored token from the secure virtual machine package.
9. The method of claim 1 wherein establishing a virtual machine runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hvpervisor of the host operating system includes inserting a filter driver into a kernel of the host operating system.
10. A method for securely running a virtual machine on a computer, the method comprising:
establishing a host runtime environment on the computer using a host runtime component of a secure virtual machine package;
presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package;
receiving a selection from the user of the computer of one of the at least one virtual machine of the secure virtual machine package;
accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy;
authenticating the user of the computer according to the obtained user authentication security policy;
establishing a virtual machine runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hypervisor of the host operating system; and
accessing encrypted virtual machine files of the user selected virtual machine of the secure virtual machine package via the secure filesystem for the authorized hypervisor of the host operating system by the secure filesystem intercepting write requests from the authorized hypervisor to a regular file system of the host operating system and performing encryption of a modified form of the secure virtual machine files in response to the intercepted write requests from the authorized hypervisor.
11. A non-transitory computer readable medium containing programming code executable by a processor, the programming code configured to perform a method comprising:
establishing a host runtime environment on the computer using a host runtime component of a secure virtual machine package;
presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package;
receiving a selection from the user of the computer of one of the at least one virtual machine of the secure virtual machine package;
accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy;
authenticating the user of the computer according to the obtained user authentication security policy;
establishing a virtual machine runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hypervisor of the host operating system; and
accessing encrypted virtual machine files of the user selected virtual machine of the secure virtual machine package via the secure filesystem for the authorized hypervisor of the host operating system by the secure filesystem intercepting read requests from the authorized hypervisor to a regular file system of the host operating system and performing decryption of the secure virtual machine files in response to the intercepted read requests from the authorized hypervisor.
12. A non-transitory computer readable medium containing programming code executable by a processor, the programming code configured to perform a method comprising:
establishing a host runtime environment on the computer using a host runtime component of a secure virtual machine package;
presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package;
receiving a selection from the user of the computer of one of the at least one virtual machine of the secure virtual machine package;
accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy;
authenticating the user of the computer according to the obtained user authentication security policy;
establishing a virtual machine runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hypervisor of the host operating system; and
accessing encrypted virtual machine files of the user selected virtual machine of the secure virtual machine package via the secure filesystem for the authorized hypervisor of the host operating system by the secure filesystem intercepting write requests from the authorized hypervisor to a regular file system of the host operating system and performing encryption of a modified form of the secure virtual machine files in response to the intercepted write requests from the authorized hypervisor.
13. The method of claim 10 wherein the secure virtual machine package is installed on the computer before establishing the host runtime environment on the computer.
14. The method of claim 10 wherein presenting to a user of the computer a choice of at least one virtual machine of the secure virtual machine package comprises displaying a list on a graphical user interface of the computer.
15. The method of claim 10 wherein accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy comprises the computer communicating with a remote server to obtain a key to decrypt the encrypted meta-data.
16. The method of claim 10 wherein accessing encrypted meta-data from the secure virtual machine package to obtain a user authentication security policy comprises obtaining a key embedded in a program included in the secure virtual machine package to decrypt the encrypted meta-data.
17. The method of claim 10 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises receiving a username and password from the user of the computer and comparing the received username and password to a stored username and password from the secure virtual machine package.
18. The method of claim 10 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises establishing communication with a remote server.
19. The method of claim 10 wherein authenticating the user of the computer according to the obtained user authentication security policy comprises
receiving a hardware token from the user of the computer and comparing the received hardware token to a stored token from the secure virtual machine package.
20. The method of claim 10 wherein establishing a virtual machine
runtime environment on the computer including inserting a secure filesystem from the secure virtual machine package into a host operating system of the computer thereby authorizing a hypervisor of the host operating system includes inserting a filter driver into a kernel of the host operating system.