Secure migration of virtual machines
View Patent ↗Technologies are generally described for the secure live migration of virtual machines. The migration may take place in the context of, for example, public clouds. In various embodiments, by using a hidden process incorporated in a virtual machine's kernel and a trusted wireless and/or wired positioning service, a cloud provider and/or cloud user may be alerted about possible virtual machine hijacking/theft. The provider or user may also be provided with an approximate physical location of the platform running the compromised virtual machine for further investigation and enforcement measures.
1. A method to migrate a virtual machine, the method comprising:
receiving, at a computing device, a request to migrate a virtual machine from a source host to a target host;
determining whether a geographic location of the target host is within a predetermined perimeter, wherein the geographic location is determined using a hidden process comprising a virtual machine kernel level process running on the computing device;
determining whether the virtual machine is running on a verified hardware configuration;
in response to a determination that the target host is within the predetermined perimeter, allowing migration of the virtual machine from the source host to the target host; and
in response to a determination that the target host is outside of the predetermined perimeter and the virtual machine is not running on a verified hardware configuration, denying migration of the virtual machine from the source host to the target host and providing an alert regarding hijacking, theft, or both of the virtual machine using the hidden process.
2. The method of claim 1 , wherein the determining is based on location information received from a positioning service.
3. The method of claim 2 , wherein the positioning service is a network based positioning service.
4. The method of claim 2 , wherein the positioning service is a GPS based positioning service.
5. The method claim 1 , wherein using the hidden process to alert the user or service provider host further comprises providing an approximate physical location of a platform running the virtual machine.
6. The method of claim 5 , wherein the approximate physical location is provided by positioning hardware and/or a positioning service.
7. A computing system comprising:
a computing device comprising at least one processor;
a memory communicatively coupled to the processor when the system is operational, the memory having stored therein computer instructions that upon execution by the at least one processor cause:
execution of a hidden process comprising a virtual machine level kernel configured to execute on the computing device that is configured to verify hardware configuration of a target host;
in response to a request to migrate a virtual machine from a source host to the target host, determine whether a geographic location of the target host is within a predetermined perimeter;
in response to a determination that the target host is within the predetermined perimeter, allow migration of the virtual machine from the source host to the target host; and
in response to a determination that the target host is outside of the predetermined perimeter and the virtual machine is not running on a verified hardware configuration, deny migration of the virtual machine from the source host to the target host and provide an alert regarding hijacking, theft, or both of the virtual machine using the hidden process.
8. The computing system of claim 7 , wherein the hidden process is configured to communicate with a trusted platform module to receive information for verification of the hardware configuration.
9. The computing system of claim 8 , wherein the information comprises a hash of an operating system and a private key.
10. The computing system of claim 7 , wherein the geographic location is determined based on information received from a network device.
11. The computing system of claim 7 , wherein the geographic location is determined based on information provided by a geolocation device.
12. The computing system of claim 7 , wherein the alert includes an indication of the geographic location.
13. The computing system of claim 7 , wherein the determining comprises searching for network devices connected to the target host and determining the geographic location by tracing IP addresses.
14. A non-transitory computer readable storage medium storing thereon computer executable instructions to migrate a virtual machine, the computer executable instructions comprising:
determining whether a geographic location of a target host is within a predetermined perimeter in response to receiving a request to migrate a virtual machine from a source host to a target host;
determining whether the virtual machine is running on a verified hardware configuration;
in response to a determination that the target host is within the predetermined perimeter, allowing migration of the virtual machine to the target host; and
in response to a determination that the target host is outside of the predetermined perimeter and that the virtual machine is not running on a verified hardware configuration, denying the migration of the virtual machine to the target host and providing an alert regarding hijacking, theft, or both of the virtual machine using the hidden process running on a computing device.
15. The computer readable storage medium of claim 14 , further comprising computer executable instructions for executing a hidden process configured to verify a hardware configuration of the target host.
16. The computer readable storage medium of claim 15 , wherein the hidden process is configured to communicate with a trusted platform module to receive information for verification of the hardware configuration.
17. The computer readable storage medium of claim 15 , wherein the hidden process is incorporated in a kernel of the virtual machine.
18. The computer readable storage medium of claim 14 , wherein the determining whether a geographic location of a target host is within a predetermined perimeter is based on location information received from a positioning service.
19. The computer readable storage medium of claim 14 , further comprising computer executable instructions for sending an alert indicating denial of the request.