Method and system for integrated securing and managing of virtual machines and virtual appliances
View Patent ↗Method and system for the integrated securing and managing of virtual machines and virtual appliances are presented. Sealing the virtual appliance at the computer of a sender, verifying authenticity of the sender at a recipient computer and managing the execution of the VA are performed in a seamless fashion.
1. A secured virtual machine apparatus, comprising:
at least one hardware processor; and
at least one hardware memory device, having computer readable instructions stored thereon for execution by the at least one hardware processor, forming:
a virtual machine, comprising a virtual hard disk, containing an operating system and software applications running on the virtual hard disk; and
a security and management module, comprising:
a sealing module, sealing with the virtual machine, a signature of a sender, and policies governing ownership and execution of the virtual machine, to generate a secured virtual machine at a sender computer;
a security enforcement module, verifying authenticity of the sender upon receiving the secured virtual machine at a recipient computer; and
an execution management module, retrieving the virtual machine and the policies from the secured virtual machine, and managing the execution of the virtual machine on the recipient computer in accordance with the policies.
2. The secured virtual machine apparatus of claim 1 , the computer readable instructions further forming another module, recording changes made to the virtual machine on the sender computer before the virtual machine has been sealed.
3. The secured virtual machine apparatus of claim 2 , wherein the sealing module is further configured to seal the changes together with the virtual machine, the signature and the policies to generate the secured virtual machine.
4. The secured virtual machine apparatus of claim 1 , the computer readable instructions further forming yet another module, recording changes made to the virtual machine on the recipient computer.
5. The secured virtual machine apparatus of claim 1 , the computer readable instructions further forming a metadata module, comprising metadata related to resource requirement data and runtime data for the virtual machine.
6. The secured virtual machine apparatus of claim 1 , wherein the execution management module further comprises a rules engine, processing rules describing the policies.
7. The secured virtual machine apparatus of claim 1 , the computer readable instructions further forming an encryption module for encrypting the secured virtual machine at the sender computer, and a decryption module, decrypting the secured virtual machine at the recipient computer.
8. The secured virtual machine apparatus of claim 1 , wherein the sealing module further comprises:
a hash generation module, creating a hash of contents of a file containing the virtual machine; and
a signature generation module, encrypting the hash with a private key of the recipient.
9. The secured virtual machine apparatus of claim 8 , wherein the signature generation module further comprises an encryption module, encrypting the secured virtual machine with a key, and further encrypting the key with a public key of the recipient.
10. The secured virtual machine apparatus of claim 1 , wherein the security enforcement module further comprises:
a signature verification module, verifying the signature of the sender; and
a hash verification module, determining a hash of contents of the file containing the virtual machine at the recipient computer, and comparing it with a hash of contents of a file containing the virtual machine at the sender computer.
11. A computer system, comprising:
a hardware platform, comprising at least one central processing unit, and at least one memory device;
the at least one hardware memory device, having computer readable instructions stored thereon for execution by the at least one central processing unit, forming:
a hypervisor having a virtual machine manager, managing one or more virtual machines, each virtual machine, comprising a virtual hard disk, containing an operating system and software applications running on the virtual hard disk;
at least one of the virtual machines being configured as a secured virtual machine by causing the at least one central processing unit to:
to generate a secured virtual machine at a sender computer, including sealing with a virtual machine, a signature of a sender, and policies governing ownership and execution of the virtual machine;
verify authenticity of the sender upon receiving the secured virtual machine at a recipient computer; and
retrieve, from the secured virtual machine, the virtual machine and the policies, and manage the execution of the virtual machine on the recipient computer in accordance with the policies.
12. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to record changes made to the virtual machine on the sender computer before the virtual machine has been sealed, and to seal the changes together with the virtual machine, the signature and the policies to generate the secured virtual machine.
13. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to record changes made to the virtual machine on the recipient computer.
14. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to encrypt the secured virtual machine at the sender computer, and to decrypt the encrypted secured virtual machine at the recipient computer.
15. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to:
create a hash of contents of a file containing the virtual machine; and
encrypt the hash with a private key of the recipient.
16. The computer system of claim 15 , wherein the computer readable instructions further cause the at least one central processing unit to encrypt the secured virtual machine with a key, and further encrypt the key with a public key of the recipient.
17. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to:
verify the signature of the sender; and
determine a hash of contents of the file containing the virtual machine at the recipient computer, and comparing it with a hash of contents of a file containing the virtual machine at the sender computer.
18. The computer system of claim 11 , wherein the computer readable instructions further cause the at least one central processing unit to form a rules engine, processing rules describing the policies.
19. The computer system of claim 11 , the computer readable instructions further forming a metadata module, comprising metadata related to resource requirement data and runtime data for the virtual machine.
20. A system for generating a secured virtual machine, the system comprising:
a sender computer, comprising:
a first processor; and
a first memory device, having computer readable instructions stored thereon for execution by the first processor, causing the first processor to generate the secured virtual machine, comprising sealing with a virtual machine, a signature of a sender, and policies governing ownership and execution of the virtual machine; and
a recipient computer, comprising:
a second processor; and
a second memory device, having computer readable instructions stored thereon
for execution by the second processor, causing the second processor to:
verify authenticity of the sender upon receiving the secured virtual machine at a recipient computer; and
retrieve the virtual machine and the policies from the secured virtual machine, and manage the execution of the virtual machine on the recipient computer in accordance with the policies.