Extending shrouding capability of hosting system
Technical solutions are described for extending shrouding capability of a virtual server hosting system. An example method includes receiving a request to deploy a shrouded virtual server using a predetermined set of hardware components, and using a shrouded mode. The method also includes adding a guest server to the hosting system, the guest server including the predetermined set of hardware components. The method also includes deploying a preconfigured hypervisor on the guest server, where the preconfigured hypervisor is deployed in an immutable mode that disables changes to security settings of the preconfigured hypervisor. The method also includes deploying, by the preconfigured hypervisor, a preconfigured boot image as an instance of the virtual server on the preconfigured hypervisor. The method also includes sending an identifier of the virtual server for receipt by the client device.
1. A computer implemented method for extending shrouding capability of a virtual server hosting system, the method comprising:
adding, by a host manager, a guest server to the hosting system in response to receiving a request to deploy a virtual server using a shrouded mode, the shrouded mode preventing an administrator of a hosting system from accessing data or applications of the virtual server, the request being sent by a client device;
deploying, by the host manager, a preconfigured boot image as an instance of the virtual server on a hypervisor for the guest server, the deploying comprising initiating a new disk partition on the guest server and deploying the preconfigured boot image on the new disk partition and restricting the hypervisor to loading a clear memory dump that was generated without a system failure; and
sending, by the host manager, an identifier of the virtual server for receipt by the client device.
2. The computer implemented method of claim 1 , wherein the guest server is a physical server comprising different hardware components from an existing server in the hosting system.
3. The computer implemented method of claim 1 , wherein the host manager configures the hypervisor to encrypt the data in the virtual server using a session key received from the client device.
4. The computer implemented method of claim 1 , wherein the host manager configures the hypervisor to encrypt paging data of the virtual server using a session key received from the client device.
5. The computer implemented method of claim 1 , wherein the host manager configures the hypervisor to disable access to cache lines of the guest server.
6. The computer implemented method of claim 1 further comprising, prior to deployment of the hypervisor on the guest server, determining, by the host manager, authenticity of the hypervisor by comparing a hash value of the hypervisor with a predetermined value.
7. The computer implemented method of claim 1 further comprising, prior to deployment of the preconfigured boot image, determining, by the host manager, authenticity of the preconfigured boot image by comparing a hash value of the preconfigured boot image with a predetermined value.
8. The computer implemented method of claim 1 , wherein the new disk partition is a logical disk partition.
9. The computer implemented method of claim 1 , wherein the clear memory dump further does not contain a state of from a previous execution of the shrouded virtual server.
10. A system for extending shrouding capability of a virtual server hosting system, the system comprising:
a server computer; and
a host manager console configured to:
add a guest server to the hosting system in response to receiving a request to deploy a shrouded virtual server using a shrouded mode, the shrouded mode preventing an administrator of a hosting system from accessing data or applications of the virtual server, the request being sent by a client device;
deploy, via a preconfigured hypervisor, a preconfigured boot image as an instance of the virtual server on the preconfigured hypervisor by initiating a new disk partition on the guest server and deploying the preconfigured boot image on the new disk partition and restricting the preconfigured hypervisor to loading a clear memory dump that was generated without a system failure; and
send an identifier of the virtual server for receipt by the client device.
11. The system of claim 10 , wherein the new disk partition is a logical disk partition.
12. The system of claim 10 , wherein the host manager console configures the virtual server to encrypt the data in the virtual server using a session key received from the client device.
13. The system of claim 10 , wherein the host manager console configures the virtual server to encrypt paging data using a session key received from the client device.
14. The system of claim 10 , wherein the host manager console configures the virtual server to disable access to cache lines of the guest server.
15. The system of claim 10 , wherein the clear memory dump further does not contain a state of from a previous execution of the shrouded virtual server.
16. A computer program product for extending shrouding capability of a virtual server hosting system, the computer program product comprising a computer readable storage device, the computer readable storage device comprising computer executable instructions, wherein the computer readable storage device comprises instructions to:
add a guest server to the hosting system in response to receiving a request to deploy a shrouded virtual server using a shrouded mode, the shrouded mode preventing an administrator of a hosting system from accessing data or applications of the virtual server, the request being sent by a client device;
deploy, via a preconfigured hypervisor, a preconfigured boot image as an instance of the virtual server on the preconfigured hypervisor by initiating a new disk partition on the guest server and deploying the preconfigured boot image on the new disk partition and restricting the preconfigured hypervisor to loading a clear memory dump that was generated without a system failure; and
send an identifier of the virtual server for receipt by the client device.
17. The computer program product of claim 16 , wherein the new disk partition is a logical disk partition.
18. The computer program product of claim 16 , wherein the computer readable storage device further comprises instructions to configure the virtual server to encrypt the data in the virtual server using a session key received from the client device.
19. The computer program product of claim 16 , wherein the computer readable storage device further comprises instructions to configure the virtual server to encrypt paging data using a session key received from the client device.
20. The computer program product of claim 16 , wherein the clear memory dump further does not contain a state of from a previous execution of the shrouded virtual server.