Granted Patent B1

US 9,734,325 · App. 14/101,166 · Granted Aug 15, 2017

Abstract

Claims (71)

1. A method comprising:

receiving a request at a first hypervisor from an application within a virtual machine, the virtual machine executed within a virtualization layer supported by a second hypervisor, the virtual machine and the hypervisors executed by a computing node;

interrupting execution of the application within the virtual machine;

determining, while the application within the virtual machine is interrupted, an authorization key using hashing operations performed by the first hypervisor based on measurements associated with the computing node and data associated with the first hypervisor, wherein the measurements associated with the computing node comprise at least one hardware attribute associated with the computing node;

storing the authorization key in at least one memory;

resuming execution of the application;

receiving, by the virtual machine, the authorization key from the at least one memory;

determining whether the authorization key is valid; and

if the authorization key is valid, executing a function of the application or a second application within the virtual machine.

2. The method of claim 1 , wherein determining whether the authorization key is valid comprises:

decrypting encrypted data using the authorization key; and

determining whether the decrypted data matches expected data.

3. The method of claim 1 , wherein the authorization key is determined using a unique identifier associated with the first hypervisor.

4. The method of claim 3 , wherein the authorization key is further determined using data from the request.

5. The method of claim 3 , wherein the unique identifier associated with the first hypervisor comprises at least one of:

an image of the first hypervisor;

an encryption key associated with the first hypervisor; and

information from a Trusted Platform Module (TPM) chip to which the first hypervisor is bound.

6. The method of claim 1 , further comprising:

authenticating a source of the request at the first hypervisor.

7. The method of claim 1 , wherein:

the request identifies a specified memory location in the at least one memory; and

storing the authorization key comprises storing the authorization key at the specified memory location.

8. The method of claim 1 , further comprising:

performing the receiving, interrupting, determining, storing, and resuming steps at each of multiple computing nodes in a computing cloud, each computing node executing first and second hypervisors; and

wherein the first hypervisors in the computing nodes bind the virtual machine to the computing cloud so that the function of the application or the second application within the virtual machine cannot be executed outside the computing cloud.

9. An apparatus comprising:

at least one memory; and

at least one processing device configured to execute a virtual machine, a first hypervisor, and a second hypervisor, wherein the at least one processing device is configured when executing the first hypervisor to:

receive a request from an application within the virtual machine;

interrupt execution of the application within the virtual machine;

determine, while the application within the virtual machine is interrupted, an authorization key using hashing operations performed by the first hypervisor based on measurements associated with the apparatus and data associated with the first hypervisor, wherein the measurements associated with the apparatus comprise at least one hardware attribute associated with the apparatus;

store the authorization key in the at least one memory;

resume execution of the application;

receive, for use by the virtual machine, the authorization key from the at least one memory;

determine whether the authorization key is valid; and

if the authorization key is valid, execute a function of the application or a second application within the virtual machine.

10. The apparatus of claim 9 , wherein the at least one processing device is configured to determine whether the authorization key is valid by:

decrypting encrypted data using the authorization key; and

determining whether the decrypted data matches expected data.

11. The apparatus of claim 9 , wherein the at least one processing device is configured to determine the authorization key using a unique identifier associated with the first hypervisor.

12. The apparatus of claim 11 , wherein the at least one processing device is configured to determine the authorization key using data from the request.

13. The apparatus of claim 11 , wherein the unique identifier associated with the first hypervisor comprises at least one of:

an image of the first hypervisor;

an encryption key associated with the first hypervisor; and

information from a Trusted Platform Module (TPM) chip to which the first hypervisor is bound.

14. The apparatus of claim 9 , wherein the at least one processing device is further configured when executing the first hypervisor to authenticate a source of the request.

15. The apparatus of claim 9 , wherein:

the request identifies a specified memory location in the at least one memory; and

the at least one processing device is configured to store the authorization key at the specified memory location.

16. A non-transitory computer readable medium storing computer readable program code that when executed causes a computing node to:

receive a request at a first hypervisor from an application within a virtual machine, the virtual machine configured to be executed within a virtualization layer supported by a second hypervisor;

interrupt execution of the application within the virtual machine;

determine, while the application within the virtual machine is interrupted, an authorization key using hashing operations performed by the first hypervisor based on measurements associated with the computing node and data associated with the first hypervisor, wherein the measurements associated with the computing node comprise at least one hardware attribute associated with a bus of the computing node;

store the authorization key in at least one memory;

resume execution of the application;

receive, by the virtual machine, the authorization key from the at least one memory;

determine whether the authorization key is valid; and

if the authorization key is valid, execute a function of the application or a second application within the virtual machine.

17. The non-transitory computer readable medium of claim 16 , wherein the computer readable program code that when executed causes the computing node to determine the authorization key comprises:

computer readable program code that when executed causes the computing node to determine the authorization key using a unique identifier associated with the first hypervisor.

18. The method of claim 1 , wherein the at least one hardware attribute associated with the bus of the computing node comprises information associated with a manufacturer of a bus of the computing node.

19. The non-transitory computer readable medium of claim 16 , wherein the computer readable program code that when executed causes the computing node to determine whether the authorization key is valid comprises:

computer readable program code that when executed causes the computing node to:

decrypt encrypted data using the authorization key; and

determine whether the decrypted data matches expected data.

20. The non-transitory computer readable medium of claim 17 , wherein the computer readable program code when executed further causes the computer node to determine the authorization key using data from the request.

21. The non-transitory computer readable medium of claim 17 , wherein the unique identifier associated with the first hypervisor comprises at least one of:

an image of the first hypervisor;

an encryption key associated with the first hypervisor; and

information from a Trusted Platform Module (TPM) chip to which the first hypervisor is bound.

Assignments (13)