Integrity verification for a software stack or part of a software stack
The present disclosure relates to a method for integrity verification of a software stack or part of a software stack resident on a host machine. A management entity generates a measurement log for a disk image associated with the software stack or the part of a software stack. A verifier entity retrieves the generated measurement log and compares the generated measurement log with a reference measurement of a verification profile previously assigned by the verifier entity to the software stack or the part of a software stack to verify the software stack or the part of a software stack.
1. A method comprising:
at a management entity:
generating a measurement log for a disk image associated with a virtual machine of a software stack resident on a host machine, wherein the virtual machine is associated with files of the disk image and the measurement log comprises file paths and hashes for the files; and
at a verifier entity:
retrieving the generated measurement log; and
comparing the generated measurement log with a reference measurement of a verification profile previously assigned by the verifier entity to the software stack to verify the software stack, wherein comparing the generated measurement log with the reference measurement comprises comparing the reference measurement with the file paths and the hashes of the generated measurement log.
2. A method according to claim 1 , wherein generating the measurement log comprises:
mounting the disk image to provide a mounted disk image;
scanning a filesystem of the mounted disk image to generate measurements of the files; and
generating the measurement log based on the generated measurements.
3. A method according to claim 1 , wherein generating the measurement log comprises:
snapshotting the software stack;
cloning the disk image to provide a cloned disk image;
mounting the cloned disk image in the management entity;
scanning a filesystem of the mounted disk image to generate measurements of files of the cloned disk image; and
generating the measurement log based on the generated measurements.
4. A method according to claim 3 , wherein cloning the disk image comprises generating a read-only clone of the disk image to provide the cloned disk image.
5. A method according to claim 1 , wherein generating the measurement log comprises:
receiving file details for the files from the host machine; and
generating the measurement log based on the received file details.
6. A method according to claim 1 , wherein the host machine comprises a hypervisor node, and wherein the management entity is a management virtual machine.
7. A method according to claim 1 , further comprising:
at the management entity, signing the measurement log.
8. A system comprising:
a plurality of host machines, each host machine hosting a software stack;
a management virtual machine; and
a verifier server, wherein the verifier server is to:
assign each software stack of each host machine of the plurality of host machines to a corresponding verification profile of a plurality of verification profiles, wherein a given verification profile of the plurality of verification profiles indicates one or more reference measurements for the corresponding software stack, a given reference measurement of the one or more reference measurements is associated with files of a disk image, the disk image is associated with a first virtual machine of the corresponding software stack, and the given reference measurement comprises reference file paths and reference hashes for the files;
request verification of a software stack of a given host machine of the plurality of host machines to the management virtual machine of the given host machine, wherein the given verification profile corresponds to the given host machine; and
compare a verification log generated by the management virtual machine to the one or more reference measurements of the given verification profile to verify the software stack of the given host machine, wherein the comparison comprises comparing the verification log to the reference file paths and the reference hashes.
9. A system according to claim 8 wherein the verifier server is to request verification of a management virtual machine of a host machine of each host machine of the plurality of host machines.
10. A system according to claim 8 , wherein the management virtual machine is to:
snapshot the software stack of the given host machine;
clone the disk image to provide a cloned disk image;
mount the cloned disk image in the management virtual machine to provide a mounted cloned disk image;
scan a filesystem of the mounted cloned disk image to generate measurements of files of the mounted cloned disk image; and
generate the verification log based on the generated measurements.
11. A system according to claim 8 , wherein the management virtual machine is to:
mount a disk image associated with the software stack in the management virtual machine to provide a mounted disk image;
scan a filesystem of the mounted disk image to generate measurements of the files; and
generate the verification log based on the generated measurements.
12. A system according to claim 11 , wherein the management virtual machine is to generate a read-only clone of the disk image.
13. A system according to claim 8 , wherein the management virtual machine is to:
receive file details for the files from the host machine; and
generate the verification log based on the received file details.
14. A system according to claim 8 , wherein each host machine of the plurality of host machines comprises a hypervisor node.
15. A non-transitory computer readable storage medium having stored thereon instructions which, when executed by a processing resource, cause the processing resource to:
generate a measurement log for a disk image associated with a virtual machine of a software stack, wherein the virtual machine is associated with files of the disk image and the measurement log comprises file paths and hashes for the files; and
make the measurement log available to a verifier entity for comparing the generated measurement log with a reference measurement of a verification profile previously assigned by the verifier entity to the software stack to verify the software stack, wherein the comparison comprises the verifier entity comparing the reference measurement with the file paths and the hashes of the measurement log.
16. A non-transitory computer readable storage medium according to claim 15 , wherein the instructions are further to cause the processing resource to:
snapshot the software stack;
clone the disk image to generate a read-only clone of the disk image to provide a cloned disk image;
mount the cloned disk image in the management entity to provide a mounted cloned disk image;
scan a filesystem of the mounted cloned disk image to generate measurements of files of the cloned disk image; and
generate the measurement log based on the generated measurements.
17. A non-transitory computer readable storage medium according to claim 15 , wherein the instructions are further to cause the processing resource to:
mount the disk image to provide a mounted disk image;
scan a filesystem of the mounted disk image to generate measurements of files of the mounted disk image; and
generate the measurement log based on the generated measurements.
18. A non-transitory computer readable storage medium according to claim 15 , wherein the instructions are further to cause the processing resource to:
receive file details for the files of a disk image associated with the virtual machine from the host machine; and
generate the measurement log based on the received file details.
19. A method according to claim 1 , further comprising, at the verifier entity, comparing a signature of the generated measurement log with a signature of the verification profile to verify the software stack.