Systems and methods for dynamically enrolling virtualized execution instances and managing secure communications between virtualized execution instances and clients
Disclosed embodiments relate to systems and methods for dynamically analyzing and enrolling virtualized execution instances. Techniques include identifying a request for enrollment for a virtualized execution instance configured to be deployed on a host in a virtual computing environment, the request including a result of a privileged configuration inspection for the virtualized execution instance; determining, based on the result of the privileged configuration inspection, to automatically enroll the virtualized execution instance; and including the virtualized execution instance in a group of enrolled virtualized execution instances, the group being available for secure communications with one or more clients in a manner that is isolated from the host.
1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for dynamically analyzing and enrolling virtualized execution instances, the operations comprising:
identifying a request for enrollment for a virtualized execution instance configured to be deployed on a host in a virtual computing environment, the request including a result of a privileged configuration inspection for the virtualized execution instance;
wherein the privileged configuration inspection is based on whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to perform operations, beyond an environment of the virtualized execution instance, on an environment of the host;
determining, based on the result of the privileged configuration inspection, to automatically enroll the virtualized execution instance; and
including the virtualized execution instance in a group of enrolled virtualized execution instances, the group being available for secure communications with one or more clients in a manner that is isolated from the host.
2. The non-transitory computer readable medium of claim 1 , wherein the operations further comprise dynamically assigning a port number to the virtualized execution instance.
3. The non-transitory computer readable medium of claim 2 , wherein the operations further comprise:
adaptively creating, at least in part based on the dynamically assigned port number, a set of one or more virtualized execution instances comprising emulation data indicative of at least one fictive information resource, the set being available for instantiation in the virtual computing environment; and
assigning the set of virtualized execution instances with corresponding port numbers within a range of port numbers associated with the virtualized execution instance.
4. The non-transitory computer readable medium of claim 3 , wherein the operations further comprise:
identifying suspicious activity associated with the set of one or more virtualized execution instances; and
triggering, based on the identifying, a control action comprising at least one of:
revoking enrollment of the set of one or more virtualized execution instances, controlling access to the set of one or more virtualized execution instances, or triggering an alert.
5. The non-transitory computer readable medium of claim 1 , wherein, based on the virtualized execution instance being included in the group of enrolled instances, permitted operations of the virtualized execution instance with the one or more clients are limited to an isolated area of the virtualized execution instance.
6. The non-transitory computer readable medium of claim 1 , wherein the group of enrolled virtualized execution instances are restricted to direct access by the one or more clients in a manner that is isolated from the environment of the host and isolated from others of the group of enrolled virtualized execution instances.
7. The non-transitory computer readable medium of claim 1 , wherein, during a runtime phase of the virtualized execution instance following the automatic enrollment of the virtualized execution instance, the operations further comprise:
prompting a runtime privileged configuration inspection for the virtualized execution instance, wherein the runtime privileged configuration inspection is adaptive to a dynamic state of the virtualized execution instance; and
determining, based on the runtime privileged configuration inspection, whether to perform at least one of: revoking the enrollment of the virtualized execution instance, controlling access to the virtualized execution instance, or triggering an alert.
8. The non-transitory computer readable medium of claim 1 , wherein the virtualized execution instance is configured to participate in the secure communications with the one or more clients without use of a secret in the virtualized execution instance.
9. The non-transitory computer readable medium of claim 1 , wherein the operations further comprise transmitting to the virtualized execution instance a cryptographic key for use in secure communications between the virtualized execution instance and the one or more clients.
10. The non-transitory computer readable medium of claim 9 , wherein the cryptographic key is transmitted to the virtualized execution instance on a just-in-time basis, and wherein the cryptographic key is configured to expire after a period of time.
11. The non-transitory computer readable medium of claim 1 , wherein the privileged configuration inspection is performed as part of a process of initializing the virtualized execution instance.
12. A computer-implemented method for dynamically analyzing and enrolling virtualized execution instances, the method comprising:
identifying a request for enrollment for a virtualized execution instance configured to be deployed on a host in a virtual computing environment, the request including a result of a privileged configuration inspection for the virtualized execution instance;
wherein the privileged configuration inspection is based on whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to perform operations, beyond an environment of the virtualized execution instance, on an environment of the host;
determining, based on the result of the privileged configuration inspection, to automatically enroll the virtualized execution instance; and
including the virtualized execution instance in a group of enrolled virtualized execution instances, the group being available for secure communications with one or more clients in a manner that is isolated from the host.
13. The computer-implemented method of claim 12 , further comprising receiving, from the one or more clients, a request to connect to the virtualized execution instance.
14. The computer-implemented method of claim 13 , further comprising sending, to the one or more clients, a private-public key pair, wherein a public key from the private-public key pair is signed using a private key associated with a digital certificate.
15. The computer-implemented method of claim 14 , wherein the cryptographic key transmitted to the virtualized execution instance is a public key corresponding to the private key associated with the digital certificate.
16. The computer-implemented method of claim 14 , wherein the private-public key pair is configured to expire upon a determined event.
17. The computer-implemented method of claim 12 , wherein the virtualized execution instance is configured to verify a signature associated with the cryptographic key.
18. The computer-implemented method of claim 17 , wherein, conditional on successfully verifying the signature associated with the cryptographic key, the virtualized execution instance is configured to engage in a secure connection session with the one or more clients.
19. The computer-implemented method of claim 18 , further comprising monitoring and auditing the secure connection session between the virtualized execution instance and the one or more clients.
20. The computer-implemented method of claim 18 , further comprising determining to disconnect the secure connection session between the virtualized execution instance and the one or more clients.
21. The non-transitory computer readable medium of claim 1 , wherein the privileged configuration inspection is further based on whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to access sensitive data.
22. The computer-implemented method of claim 12 , wherein the privileged configuration inspection is further based on whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to access sensitive data.