Protecting virtual machines processing sensitive information
View Patent ↗Methods, apparatus and articles of manufacture for protecting virtual machines processing sensitive information are provided herein. A method includes processing a request for uninterrupted virtual machine execution of a designated section of code by a first virtual machine; enabling uninterrupted virtual machine execution of the designated section of code by the first virtual machine on a selected core of a central processing unit based on said request; and disabling said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on an indication that the first virtual machine completed execution of the designated section of code.
1. A method comprising:
processing a request for uninterrupted virtual machine execution of a designated section of code by a first virtual machine;
enabling the uninterrupted virtual machine execution of the designated section of code by the first virtual machine on one or more cores selected, from multiple cores of a central processing unit, based on said request, wherein said enabling comprises identifying all memory pages in use by the first virtual machine at a time that the uninterrupted virtual machine execution of the designated section of code is established for exclusive use by the first virtual machine, and wherein said enabling comprises:
dynamically creating a distinct group of the one or more cores of the central processing unit specifically for executing the designated section of code; and
migrating the first virtual machine into the dynamically created distinct group of the one or more cores; and
disabling said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on an indication that the first virtual machine completed execution of the designated section of code;
wherein said processing, said enabling, and said disabling are carried out by a virtual machine manager on at least one computing device,
wherein said disabling comprises modifying an internal configuration of a scheduler component of the virtual machine manager so as to permit interruption from one or more additional virtual machines.
2. The method of claim 1 , wherein said first virtual machine processes sensitive information.
3. The method of claim 1 , further comprising:
enabling co-incident execution of code distinct from the designated section of code by a second virtual machine.
4. The method of claim 1 , wherein said designated section of code is associated with one or more sensitive operations.
5. The method of claim 1 , further comprising:
identifying said designated section of code.
6. The method of claim 5 , wherein said identifying said designated section of code comprises identifying a sensitive algorithm.
7. The method of claim 5 , wherein said identifying said designated section of code comprises identifying use of one or more items of sensitive data.
8. The method of claim 7 , wherein said one or more items of sensitive data comprises a private key.
9. The method of claim 1 , wherein said enabling comprises protecting the designated section of code by implementing a virtual machine manager hypercall to receive and process the request.
10. The method of claim 9 , wherein said protecting comprises executing scripting that changes the internal configuration of the scheduler component of the virtual machine manager.
11. The method of claim 9 , wherein said protecting comprises executing one or more code modifications to the scheduler component of the virtual machine manager that responds to the request to enable the uninterrupted execution made to the virtual machine manager.
12. The method of claim 1 , wherein the one or more cores are already associated with the first virtual machine and the central processing unit is already associated with the first virtual machine.
13. The method of claim 1 , wherein the one or more cores are not already associated with the first virtual machine and the central processing unit is already associated with the first virtual machine.
14. The method of claim 1 , wherein the one or more cores are not already associated with the first virtual machine and the central processing unit is not already associated with the first virtual machine.
15. An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out steps comprising:
processing a request for uninterrupted virtual machine execution of a designated section of code by a first virtual machine;
enabling the uninterrupted virtual machine execution of the designated section of code by the first virtual machine on one or more cores selected, from multiple cores of a central processing unit, based on said request, wherein said enabling comprises identifying all memory pages in use by the first virtual machine at a time that the uninterrupted virtual machine execution of the designated section of code is established for exclusive use by the first virtual machine, and wherein said enabling comprises:
dynamically creating a distinct group of the one or more cores of the central processing unit specifically for executing the designated section of code; and
migrating the first virtual machine into the dynamically created distinct group of the one or more cores; and
disabling said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on an indication that the first virtual machine completed execution of the designated section of code;
wherein said processing, said enabling, and said disabling are carried out by a virtual machine manager,
wherein said disabling comprises modifying an internal configuration of a scheduler component of the virtual machine manager so as to permit interruption from one or more additional virtual machines.
16. An apparatus comprising:
a memory; and
at least one processor coupled to the memory and configured to:
process a request for uninterrupted virtual machine execution of a designated section of code by a first virtual machine;
enable the uninterrupted virtual machine execution of the designated section of code by the first virtual machine on one or more cores selected, from multiple cores of a central processing unit, based on said request, wherein said enabling comprises identifying all memory pages in use by the first virtual machine at a time that the uninterrupted virtual machine execution of the designated section of code is established for exclusive use by the first virtual machine, and wherein said enabling comprises:
dynamically creating a distinct group of the one or more cores of the central processing unit specifically for executing the designated section of code; and
migrating the first virtual machine into the dynamically created distinct group of the one or more cores; and
disable said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on an indication that the first virtual machine completed execution of the designated section of code;
wherein said processing, said enabling, and said disabling are carried out by a virtual machine manager,
wherein said disabling comprises modifying an internal configuration of a scheduler component of the virtual machine manager so as to permit interruption from one or more additional virtual machines.
17. A method comprising steps of:
receiving a request from a first virtual machine for uninterrupted virtual machine execution of a designated section of code by the first virtual machine;
receiving a request from a second virtual machine for co-incident execution of code, separate from the designated section of code, by the second virtual machine;
enabling the uninterrupted virtual machine execution of the designated section of code by the first virtual machine on a first set of one or more cores selected, from multiple cores of a central processing unit, based on said request for uninterrupted virtual machine execution, wherein said enabling comprises identifying all memory pages in use by the first virtual machine at a time that the uninterrupted virtual machine execution of the designated section of code is established for exclusive use by the first virtual machine, and wherein said enabling comprises:
dynamically creating a distinct group of the first set of the one or more cores of the central processing unit specifically for executing the designated section of code; and
migrating the first virtual machine into the dynamically created distinct group of the first set of the one or more cores;
enabling said co-incident execution of code by the second virtual machine on a second set of one or more cores among either the multiple cores of the central processing unit or multiple cores of a different central processing unit based on said request for co-incident execution;
receiving an indication from the first virtual machine that execution of the designated section of code has been completed; and
disabling said uninterrupted virtual machine execution of the designated section of code by the first virtual machine based on said indication;
wherein the steps are carried out by a virtual machine manager on a computing device,
wherein said disabling comprises modifying an internal configuration of a scheduler component of the virtual machine manager so as to permit interruption from the second virtual machine or one or more additional virtual machines.
18. The method of claim 17 , wherein said designated section of code is associated with one or more sensitive operations.