Granted Patent B2

US 9,678,780 · App. 14/505,868 · Granted Jun 13, 2017

Inventors: Manbinder Pal Singh (Bangalore, IN); Imtiaz Mohammad (Bangalore, IN); Ian Pratt (Cambridge, GB)

Assignee: Citrix Systems, Inc.

G06F9/45558G06F21/53G06F21/6218G06F2009/45587

Abstract

Claims (58)

1. In a computing device executing a hypervisor hosting a secure virtual machine accessible to a network through a network connection and an unsecure virtual machine, a method for redirecting an access request to the unsecure virtual machine, comprising:

intercepting, by a control virtual machine hosted by the hypervisor, an access request originating from the secure virtual machine, the secure virtual machine accessible to the network through the network connection;

determining, by the control virtual machine, that the access request is for an unsecure resource not provided by the secure virtual machine;

creating, by the control virtual machine, the unsecure virtual machine for the access request for the unsecure resource, the unsecure virtual machine having a different level of access than the secure virtual machine; and

establishing, by the secure virtual machine, a secure communications channel between the secure virtual machine and the unsecure virtual machine, the communications channel only accessible by the secure virtual machine and the unsecure virtual machine; wherein establishing the secure communications channel comprises:

writing, by the unsecure virtual machine, a predetermined data string to a region of memory;

detecting, by the secure virtual machine, the predetermined data string written by the unsecure virtual machine; and

in response to detecting the predetermined data string, locking, by the secure virtual machine, the selected region of memory; and

redirecting, by the control virtual machine responsive to the determination, the access request to the unsecure virtual machine executing on the computing device via the secure communications channel between the secure virtual machine and the unsecure virtual machine.

2. The method of claim 1 , comprising:

intercepting the access request by a control program of the control virtual machine, the control program executing on a processor of the computing device.

3. The method of claim 1 , comprising:

intercepting, by the control virtual machine hosted by a type 1 hypervisor executing on the computing device, the access request.

4. The method of claim 1 , comprising:

initiating, by an application executing on the secure virtual machine, the access request for the unsecure resource.

5. The method of claim 1 , comprising:

determining that a virtual machine is secure based on one of: an application executing on the virtual machine, an identity of a user accessing the virtual machine, a level of access granted to the virtual machine for accessing one or more resources, and a risk level assigned to the virtual machine.

6. The method of claim 1 , comprising:

determining that a requested resource is secure based on one of: file-type association between a requested file and an application, a configuration file of resources, a security setting of the requested resource, an identity of a website corresponding to the requested resource, an identity of a location corresponding to the requested resource, and an identity of a host corresponding to the requested resource.

7. The method of claim 1 , wherein redirecting the access request comprises:

redirecting one of: a cookie and a security token.

8. The method of claim 1 , comprising:

transferring, by the control virtual machine, focus from the secure virtual machine to the unsecure virtual machine responsive to the access request; and

accessing, via the unsecure virtual machine, the unsecure resource.

9. The method of claim 1 , comprising:

displaying a requested resource on the secure virtual machine via a window executing on the unsecure virtual machine.

10. The method of claim 1 , comprising:

displaying a requested resource on the unsecure virtual machine.

11. In a computing device executing a hypervisor hosting a secure virtual machine accessible to a network through a network connection and an unsecure virtual machine, a system for redirecting an access request to the unsecure virtual machine, comprising:

a processor;

establishing, by the secure virtual machine, a secure communications channel between the secure virtual machine and the unsecure virtual machine, the communications channel only accessible by the secure virtual machine and the unsecure virtual machine; wherein establishing the secure communications channel comprises:

writing, by the unsecure virtual machine, a predetermined data string to a region of memory;

detecting, by the secure virtual machine, the predetermined data string written by the unsecure virtual machine; and

in response to detecting the predetermined data string, locking, by the secure virtual machine, the selected region of memory;

the hypervisor hosting a control virtual machine, the secure virtual machine and the unsecure virtual machine, the secure virtual machine accessible to the network through the network connection,

wherein the control virtual machine is configured to:

intercept the access request originating from the secure virtual machine;

determine that the access request is for an unsecure resource not provided by the secure virtual machine;

create the unsecure virtual machine for the access request for the unsecure resource, the unsecure virtual machine having a different level of access than the secure virtual machine; and

redirect, responsive to the determination that the access request is for the unsecure resource, the access request to the unsecure virtual machine executing on the computing device via the secure communications channel between the secure virtual machine and the unsecure virtual machine.

12. The system of claim 11 , wherein the control virtual machine comprises a control program that intercepts the request, the control program executing on a processor of the computing device.

13. The system of claim 11 , wherein the hypervisor comprises a type 1 hypervisor.

14. The system of claim 11 , comprising:

an application executing on the secure virtual machine, initiating the access request for the unsecure resource.

15. The system of claim 11 , wherein the control virtual machine identifies a virtual machine as secure or unsecure based on one of: an application executing on the virtual machine, an identity of a user accessing the virtual machine, a level of access granted to the virtual machine for accessing one or more resources, and a risk level assigned to the virtual machine.

16. The system of claim 11 , wherein the control virtual machine identifies a requested resource as secure or unsecure based on one of: file-type association between a requested file and an application, a configuration file of resources, a security setting of the requested resource, an identity of a website corresponding to the requested resource, an identity of a location corresponding to the requested resource, and an identity of a host corresponding to the requested resource.

17. The system of claim 11 , wherein the control virtual machine redirects one of: a cookie and a security token with the access request.

18. The system of claim 11 , wherein the control virtual machine transfers from the secure virtual machine to the unsecure virtual machine to handle the access request.

19. The system of claim 11 , wherein the secure virtual machine displays a requested resource via a window that executes on the unsecure virtual machine.

20. A computer program product in a computing device executing a hypervisor hosting a secure virtual machine accessible to a network through a network connection and an unsecure virtual machine for redirecting an access request to the secure virtual machine, the computer program product disposed upon a non-transitory computer-readable medium, the computer program product comprising computer program instructions that, when executed cause the computing device to carry out the steps of:

intercepting, by a control virtual machine hosted by the hypervisor, an access request originating from the unsecure virtual machine;

determining, by the control virtual machine, that the access request is for a secure resource not provided by the unsecure virtual machine;

creating, by the control virtual machine, the secure virtual machine for the access request for the secure resource, the secure virtual machine having a different level of access than the unsecure virtual machine and the secure virtual machine accessible to a network through the network connection;

establishing, by the secure virtual machine, a secure communications channel between the secure virtual machine and the unsecure virtual machine, the communications channel only accessible by the secure virtual machine and the unsecure virtual machine; wherein establishing the secure communications channel comprises:

writing, by the unsecure virtual machine, a predetermined data string to a region of memory;

detecting, by the secure virtual machine, the predetermined data string written by the unsecure virtual machine; and

in response to detecting the predetermined data string, locking, by the secure virtual machine, the selected region of memory; and

redirecting, by the control virtual machine responsive to the determination, the access request to the secure virtual machine executing on the computing device via the secure communications channel between the secure virtual machine and the unsecure virtual machine.

Assignments (9)

Continuity (3)