US20130247033A1 - System and method for managing virtual machine configurations - Google Patents

System and method for managing virtual machine configurations Download PDF

Info

Publication number
US20130247033A1
US20130247033A1 US12636414 US63641409A US2013247033A1 US 20130247033 A1 US20130247033 A1 US 20130247033A1 US 12636414 US12636414 US 12636414 US 63641409 A US63641409 A US 63641409A US 2013247033 A1 US2013247033 A1 US 2013247033A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
plurality
operation
command messages
command
policies
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US12636414
Other versions
US8544003B1 (en )
Inventor
Harvinder Singh Sawhney
Suman Saraf
Rosen Sharma
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
McAfee LLC
Original Assignee
McAfee LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general

Abstract

A method in one example implementation includes receiving a plurality of command messages through a control channel and reconstructing the command messages to determine an intended command for one or more virtual machines on a server device. The command messages include one or more criteria and the intended command corresponds to an operation defined in a policy database. The method also includes determining whether the corresponding operation is permitted by comparing one or more policies associated with the operation to the one or more criteria. The method further includes sending the command messages to the server device if the operation is permitted. In more specific embodiments, the operation may include one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines.

Description

    CROSS-REFERENCE TO RELATED APPLICATION
  • This application claims the benefit of priority under 35 U.S.C. §119(e) of U.S. Provisional Application No. 61/201,699, filed Dec. 11, 2008, by Sharma et al., entitled “VM CHANGE ENFORCEMENT,” which is hereby incorporated by reference in its entirety.
  • TECHNICAL FIELD
  • This disclosure relates in general to the field of security and, more particularly, to managing virtual machine configurations in a virtual environment.
  • BACKGROUND
  • The field of network security has become increasingly important in today's society. In particular, the ability to effectively maintain secure and stable computers and systems presents a significant obstacle for component manufacturers, system designers, and network operators. This obstacle is made even more complicated due to the increased ease with which network systems may be manipulated, particularly in a virtualized environment. Virtualization is a software technology allowing an operating system (OS) to run in an isolated virtual environment (typically referred to as a virtual machine), where a platform's physical characteristics and behaviors are reproduced. More specifically, a virtual machine can represent an isolated, virtual environment running its own operating system and applications and being equipped with virtual hardware (processor, memory, disks, network interfaces, etc.). Commonly, the virtual machine is managed by a virtualization product. A virtual machine monitor (VMM) is the virtualization software layer that manages hardware requests from a guest OS (e.g., simulating answers from real hardware). A hypervisor is computer software/hardware platform virtualization software that may run on bare hardware and allows multiple operating systems to run on a host computer concurrently. ESX and ESXi by VMware, Inc. of Palo Alto, Calif., Xen by Citrix Systems, Inc. of Ft. Lauderdale, Fla., and Hyper-V by Microsoft Corp. of Redmond, Wash., represent forms of VMMs and these VMMs can be managed to better protect computers and systems from authorized and unauthorized manipulations that may affect system stability and security.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • To provide a more complete understanding of the present disclosure and features and advantages thereof, reference is made to the following description, taken in conjunction with the accompanying figures, wherein like reference numerals represent like parts, in which:
  • FIG. 1 is a pictorial representation of one embodiment of a network environment in which a system and method for managing virtual machine configurations may be implemented;
  • FIG. 2 is a simplified block diagram of one embodiment of a system and method for managing virtual machine configurations, which may be implemented as a control proxy;
  • FIG. 3 is a simplified block diagram illustrating one example implementation of a server in a system and method for managing virtual machine configurations;
  • FIG. 4 is a simplified block diagram of one example embodiment of a system and method for managing virtual machine configurations; and
  • FIG. 5 is a simplified flowchart illustrating a series of example steps associated with a system and method for managing virtual machine configurations in accordance with one embodiment.
  • DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS Overview
  • A method in one example implementation includes receiving a plurality of command messages through a control channel. The plurality of command messages may have one or more criteria. The method also includes reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device. The intended command has a corresponding operation in a policy database and the operation may have one or more associated policies. The method further includes determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria. The method also includes sending the plurality of command messages to the server device if the operation is permitted. In more specific embodiments, the operation may include one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines. In other more specific embodiments, the server device is adapted to perform the operation only if a control proxy sends the plurality of command messages to the server device, and the control proxy is adapted to receive only the plurality of command messages through the control channel.
  • Example Embodiments
  • FIG. 1 is a simplified block diagram of a network environment 100 in which a system for managing virtual machine configurations may be implemented. Network environment 100 may include a server 300 accessed by different clients through a communication link provided by network 130. The different clients may include client devices 110 a and 110 b, which represent users having administrative privileges to configure server 300, and end user devices 120 a and 120 b, which represent end users who access applications or services provided by server 300. In one embodiment, server 300 may be configured to host one or more virtual machines. A control proxy 200 may be operably connected to client devices 110 a and 110 b for receiving configuration commands through a control channel. Control proxy 200 may also be operably connected to server 300, for sending permitted configuration commands received from client devices 110 a and 110 b to server 300. Server 300 may send and receive data messages across a data channel for communicating with end user devices 120 a and 120 b.
  • In example embodiments, a system and method for managing virtual machine configurations may be implemented in network environment 100, providing control proxy 200 for intercepting command messages being sent from a user of client device 110 a or 110 b to configure virtual machines in server 300. Control proxy 200 interprets the particular protocol command messages to determine which command was intended by the user. Control proxy 200 then checks selected criteria of the command messages against predefined policies to determine whether an operation corresponding to the intended command is permitted. If the operation is permitted, then control proxy 200 sends the command messages to server 300. For purposes of illustrating the techniques of such a system, it is important to understand the activities occurring within a given virtual environment. The following foundational information may be viewed as a basis from which the present disclosure may be properly explained. Such information is offered earnestly for purposes of explanation only and, accordingly, should not be construed in any way to limit the broad scope of the present disclosure and its potential applications.
  • Protecting a virtual computer environment presents certain complexities that are not associated with a purely physical computer environment. When physical computers are initially configured within a network, physical wires may be connected to the computers, wiring arrangements to appropriate physical components may be configured, memory components may be added, external devices may be added, and the like. Appropriate security may also be included. For example, firewalls may be configured in both hardware and software, proxy servers may be configured between computers, and any other desired security mechanism may be implemented. Modifications to the physical computer may require adding or removing physical components and adding, removing, or rerouting wiring. Thus, such procedures may be labor intensive and consequently, may be performed only as time and manual labor allows. Such changes in a physical environment may necessitate planning and deliberation. For example, in many business environments, implementations and modifications to physical systems are often scheduled during off-hours or work downtime, so as not to interfere with daily business transactions. Even if changes must be made during working hours, end users are typically notified of the impending work and any expected downtime.
  • In a virtual environment, however, a hypervisor or virtual machine monitor may control the operation of one or more virtual machines, each having an associated operating system and one or more associated applications. The hypervisor is the basic abstraction layer of software that may sit directly on the hardware of a virtual machine host below operating systems. It is responsible for central processing unit (CPU) scheduling and memory partitioning of the various virtual machines running on a hardware device. The hypervisor not only abstracts the hardware for the virtual machines, but also controls the execution of virtual machines as they share the common processing environment.
  • The initial configuration and any subsequent modifications of a virtual machine may occur by simply sending electronic commands to a virtual machine host. Such commands may be issued by anyone with appropriate privileges who can access the virtual machine host. Thus, virtual machines may be configured (e.g., created, cloned, deleted, started, stopped, modified, etc.) simply by an authorized user typing in commands, which are received and performed on the virtual machine host. Such configurations may be accomplished with greater speed and frequency than in a physical environment. In addition, because of the transparency and ease with which such configuration commands may be issued, multiple individuals with appropriate privileges could actually issue conflicting commands, thereby potentially causing frequent and perhaps undesirable changes to the virtual machines. Moreover, these changes could occur anytime, such as during peak working hours, without warning to end users and possibly resulting in undesirable affects on end users and any associated business activities. Virtual machines may also incur substantial damage if a security hacker or other unauthorized user penetrates the virtual environment, at least in part because the hacker may have access to multiple operating systems and applications.
  • While the isolation provided by a virtual environment may offer more security from attacks by malicious code and abnormal process ends from an application or operating system, virtual machines may, on the other hand, be more easily manipulated by network administrators and other authorized users than in a purely physical environment. For example, in virtual machine environments such as VMware ESX or VMware ESXi, any individual, such as a network administrator, with appropriate privileges may be allowed to simply type in commands to edit hardware configurations for any of the virtual machines on a host server. A virtual machine may be created, cloned, or deleted, or any virtual machine hardware configurations (e.g., processors, CD/DVD drives, floppy drives, memory, SCSI devices, network adapters, parallel ports, serial ports, etc.) may be added, removed or modified. Moreover, such configuration commands may be issued at any time, from any device so long as the user is authorized (e.g., has a valid password). Thus, without proper controls, the potential for such commands to be issued during a time that disrupts business activities is great. In addition, because configuration commands may be issued from various locations, authorized users could issue conflicting commands that cause problems for the end users and disruptions to associated business activities.
  • In one example scenario, many companies or organizations that conduct their businesses using large network systems may outsource their information technology (IT) support to a separate IT organization. Once the IT organization is given access and administrative privileges to the company's network, the company may have limited control over the activities undertaken by the IT organization to configure the virtual machines used by the company. Even well-intentioned configuration changes have the potential to disrupt business activities when performed during working hours without prior approval from and notice to the network owner. Thus, many companies in this scenario would benefit from a way to define policies that control the IT support organization's ability to modify virtual machine configurations within the network.
  • Hackers or other unauthorized users may also present problems in the virtual environment. Such individuals may attempt to gain administrative privileges on a virtual machine host server, such as, by acquiring an appropriate password and access to the network. If successful, the hacker or other unauthorized user may cause irreparable damage by issuing configuration commands and thereby adding, removing, or modifying the virtual machines and any associated virtual hardware. Thus, it has become very important to control or manage access to virtual machines based on configuration commands and defined policies associated with such configuration commands.
  • A system for managing virtual machine configurations, as outlined in FIG. 1, can resolve many of these issues. In accordance with one example implementation, a company or other organization that provides applications or services on network servers configured as virtual machine hosts can define policies that determine, for example, when and by whom particular configuration commands may be sent to the servers. These policies may be defined and evaluated in a control proxy that receives the configuration commands through a control channel from client devices. Also, the servers may be disabled from performing operations in response to configuration commands unless the commands are received from the control proxy. Thus, such a system would give companies or other organizations control over when and how their servers could be configured by network administrators and other users with administrative privileges.
  • Generally, virtual machine monitors (e.g., VMware ESX, VMware ESXi, Xen, Hyper-V, etc.) are hypervisors that can be employed to manage virtual machines and guest operating system (OS) instances. As used herein in this Specification, the term ‘virtual machine monitor’ is meant to include any such hypervisors, or other devices that can operate to manage one or more virtual machines.
  • Turning to the infrastructure of FIG. 1, a system for managing virtual machine configurations may be implemented in network environment 100, which may include additional servers, client devices, control proxies, and other devices not shown. Network environment 100 may be configured in any form including, but not limited to, local area networks (LANs), intranets, and wide area networks (WANs) such as the Internet. In one embodiment, client devices 110 a and 110 b and end user devices 120 a and 120 b may be operably coupled to network 130 (e.g., the Internet) by an Internet Service Provider (ISP) or through an Internet Server with dedicated bandwidth. In this embodiment, connections to network 130 may include any appropriate medium such as, for example, digital subscriber lines (DSL), telephone lines, T1 lines, T3 lines, wireless, satellite, fiber optics, cable, Ethernet, etc. or any combination thereof. In addition, gateways, routers, and the like may be used to facilitate electronic communication between client devices 110 a and 110 b and control proxy 200 and between end user devices 120 a and 120 b and server 300. Also, appropriate firewalls may be provided between network 130 and control proxy 200 and server 300. In another embodiment network 130 may represent a LAN to which client devices 110 a and 110 b are operably connected to communicate with control proxy 200 and to which end user devices 120 a and 120 b are operably connected to communicate with server 300. Network 130 may, in further embodiments, be implemented as a number of different combinations of networks, including for example, client device 110 a and end user device 120 a connected through a LAN and client device 110 b and end user device 120 b connected through the Internet.
  • Control proxy 200 and server 300 are operably connected to network 130. Logically, network 130 may be connected to control proxy 200 through the control channel for sending configuration command messages to control proxy 200 from client devices 110 a and 110 b. Network 130 may also be logically connected to server 300 through the data channel for sending data messages between end user devices 120 a and 120 b and server 300. In one embodiment, control proxy 200 does not receive data messages from client devices 110 a and 110 b or end user devices 120 a and 120 b. Rather, control proxy 200 is configured to only receive messages through the control channel, which include configuration command messages. One example embodiment includes network 130 supporting Simple Object Access Protocol (i.e., SOAP) messaging framework. SOAP is a protocol that may combine remote procedure calls (i.e., RPC) and Hypertext Transport Protocol (i.e., HTTP), allowing HTTP to be used as the transport for RPC messages. Although SOAP messages may be used in this example implementation, it will be apparent that the broad scope of the present disclosure could also be applied using other protocols.
  • In one example embodiment, control proxy 200 and server 300 may be implemented in an IT Headquarters of an organization or a data center, with client devices 110 a and 110 b being computers operated by individual users having network administrator privileges (e.g., authorization to configure and maintain computers, servers, and any other devices within a computer network). In this embodiment, end user devices 120 a and 120 b may be computers operated by users without administrative privileges, who remotely or locally access applications or services provided by server 300. Server 300 may provide applications or services only to end users within the organization that controls server 300 (e.g., employees) or it may provide applications or services to end users outside the organization (e.g., customers, Internet surfers, other businesses). Client devices 110 a and 110 b may include computers such as desktops, laptops, or any other computing device or console capable of sending configuration command messages to control proxy 200, using, for example the SOAP protocol. End user devices 120 a and 120 b may include computers such as desktops, laptops, or mobile or handheld computing devices (e.g., personal digital assistants (PDAs) or mobile phones) or any other computing device capable of receiving and sending data messages to server 300 through network 130. It should be noted that the network configurations and interconnections shown and described herein are for illustrative purposes only. One of ordinary skill in the art will appreciate that FIG. 1 is intended as an example and should not be construed to imply architectural limitations in the present disclosure.
  • Turning to FIG. 2, a simplified block diagram illustrates one embodiment of control proxy 200 that may be implemented in accordance with the present disclosure. Control proxy 200 may include hardware elements such as a memory element 210 and a processor 220 suitably configured to provide a platform for associated modules of control proxy 200. In addition, a suitable operating system (not shown) may be configured in control proxy 200 to appropriately manage the operation of hardware components therein. Control proxy 200 may include a protocol message module 230 for receiving configuration command messages. Protocol message module 230 understands the particular protocol (e.g., SOAP, etc.) of the command messages and determines the intended command of a user sending the command messages. Also included in control proxy 200 could be a policy database 240, a policy module 250 and an administration module 260. Policy database 240 may include entries corresponding to operations capable of being performed in server 300 and also may include entries corresponding to predefined policies associated with the operations. A management console 270 may be operably coupled to control proxy 200 for creating and/or updating policy database 240 with administration module 260. In one embodiment, management console 270 may be a McAfee ePolicy Orchestrator®.
  • Turning to FIG. 3, a simplified block diagram illustrates a server 300 that may be implemented in accordance with the present disclosure. Server 300 may be configured with, for example, VMware ESX or ESXi, SAP or other web services. In one example embodiment shown in FIG. 3, server 300 may include a virtual machine 310 and a virtual machine 320, which have respective operating systems 314 and 324 running respective applications 312 and 322. Server 300 may also include a virtual machine monitor (VMM) 330, which is, in one embodiment, a hypervisor that runs on hardware and which provides the capability of running multiple instances of operating systems 314 and 324 and associated applications 312 and 322, concurrently, by dynamically allocating the hardware resources to the operating systems 314 and 324 and applications 312 and 322 as needed. In this arrangement, applications 312 and 322 are logically run on top of respective operating systems 314 and 324, which are associated with respective virtual machines 310 and 320, and are provided with virtual hardware (e.g., processors, CD/DVD drives, floppy drives, memory, SCSI devices, network adapters, parallel ports, serial ports, etc.). Hardware components 340 beneath virtual machine monitor 330 may include a memory element 342 and a processor 344. Hardware components 340 may also include additional components such as, for example, network interface cards and disk drives. The entire configuration may be provided in a server (or some other network appliance). This implementation is only representing one possible example to which the present disclosure can apply. Any number of additional hypervisors or virtual elements could similarly benefit from the broad teachings discussed herein.
  • Typically, in server virtualization an authorized user is provided with an interface to manage a complete setup of virtual machines and the associated applications, operating systems, and virtual hardware. This management includes the hypervisor configuration and virtual machine configuration, including creation, deletion, modification, shutdown, startup, etc. In accordance with one embodiment of the present disclosure, server 300 is configured in “local access lockdown” such that even authorized users cannot successfully issue configuration commands directly to server 300. Instead, only configuration commands received from control proxy 200 will be performed. Thus, even if a user with administrative privileges bypasses control proxy 200 and connects directly to server 300, any configuration commands attempted by the user will not be executed because only configuration commands received in messages from control proxy 200 will be executed by server 300.
  • Not shown in FIGS. 2 and 3 is additional hardware that may be suitably coupled to control proxy processor 220 and server processor 344. Additional hardware may be in the form of memory management units (MMU), additional symmetric multiprocessing (SMP) elements, physical memory, Ethernet, peripheral component interconnect (PCI) bus and corresponding bridges, small computer system interface (SCSI)/integrated drive electronics (IDE) elements, etc.
  • Turning to FIG. 4, FIG. 4 is a simplified block diagram illustrating one implementation of a system 400 for managing virtual machine configurations in accordance with the present disclosure. In the example implementation, a VMware Infrastructure Client (i.e., VI client) 410 may be suitably coupled to a control proxy 420 for sending and receiving SOAP messages as previously described herein. Control proxy 420 may be operably connected to a VMware ESXi server 430 for sending permitted configuration command messages, received from VI client 410, to ESXi server 430. By way of example, a policy database 440 is shown with enumerated operations 442 (i.e., create, clone, delete, start, stop, modify, etc.) and policies 444 (i.e., user, time of day, date, host, etc.).
  • VI client 410 may allow an authorized user to select virtual machine configuration commands that correspond to operations for ESXi server 430, such as, for example, creating, cloning, starting, stopping, deleting, and modifying virtual machines, which includes any associated virtual hardware. Once the user has selected a command, VI client 410 may create SOAP messages to communicate the selected commands to ESXi server 430. Multiple SOAP messages may be sent for each command selected by the user, with the SOAP messages having a plurality of criteria such as user, host address, date, time of day, etc. embedded therein. Control proxy 420 intercepts the SOAP messages and reconstructs the messages to determine which configuration command was intended. One of the operations 442 in policy database 440 may then be identified as corresponding to the intended command. Once the configuration command and its corresponding operation from policy database 440 have been determined, policies 444 associated with the corresponding operation may be compared to any of the plurality of criteria from the SOAP messages to determine whether the corresponding operation is permitted. Control proxy 420 may then send the SOAP messages to ESXi server 430 if the corresponding operation is permitted. If the corresponding operation is not permitted, however, the control proxy 420 may send an error message back to the VI client 410.
  • Turning to FIG. 5, a simplified flowchart 500 is depicted illustrating a process associated with one implementation for managing virtual machine configurations. The process involves intercepting messages between client devices and a server, determining what configuration commands have been issued in the messages, and determining whether operations corresponding to the intended commands are permissible based on predefined policies. The process may be implemented in control proxy 200 as shown in FIGS. 1 and 2, which may be implemented in any suitable architecture as described herein.
  • The process may begin at step 510, where control proxy 200 receives configuration command messages from one of the client devices 110 a or 110 b. Because the configuration command options may be provided on client device 110 a or 110 b at a user-understandable level, typically, one user action will result in many messages being sent. Therefore, flow passes to step 520 to reconstruct the plurality of configuration command messages to determine what command the user intended, and to determine an operation in policy database 240 corresponding to the intended command. Once the configuration command messages have been reconstructed and the corresponding operation in policy database 240 has been determined, flow passes to step 530 to determine if the operation corresponding to the intended command is permitted by associated policies in the policy database 240. In this step, policies associated with the corresponding operation in policy database 240 may be compared to selected criteria from the configuration command messages. If the associated policies do not permit the corresponding operation to be performed, based on the selected criteria, flow passes to step 540 and an error message may be sent to the particular client device 110 a or 110 b that sent the configuration command messages. However, if the corresponding operation is permitted, then flow passes to step 550 and the configuration command messages are sent to server 300.
  • In one example implementation, a policy (“Policy T”) may be defined in policy database 240 as not allowing particular operations to be performed by any users from any client devices or hosts during a specified time of day, such as normal business hours (e.g., 9 am-5 pm). By way of example, Policy T may then be mapped to operations “delete”, “stop”, and “modify” in policy database 240 for all authorized users and all authorized hosts. If an authorized user initiates a command on client device 110 a or 110 b at 12 pm to modify the memory of virtual machine 310 or 320 in server 300, configuration command messages would be intercepted by control proxy 200. Control proxy 200 would determine the intended command from the configuration command messages and would then determine that the intended command corresponds to the “modify” operation in the policy database 240. The time of day (i.e., 12 pm) the command messages were issued would be determined from the plurality of criteria embedded in the command messages. When the time of day (i.e., 12 pm) is compared to Policy T, which is mapped to the “modify” operation in policy database 240, it would be determined that the modify operation is not permitted and, therefore, the configuration command messages would not be sent to server 300. Instead, an error message may be sent to the appropriate client device 110 a or 110 b. However, if the same authorized user initiated the same command at 6 pm, then, when the time of day (i.e., 6 pm) is compared to Policy T, it would be determined that the modify operation is permitted and therefore, the configuration command messages would be sent to server 300. It will be apparent that this is just one example scenario, and that many other selected criteria, such as, for example, the host, the date, the user, etc., may be evaluated and that the control proxy would determine whether the operation corresponding to the intended command is permitted or not permitted based on the particular policies associated with the operation.
  • Software for managing virtual machine configurations can be provided at various locations (e.g., within policy module 250, administration module 260, protocol message module 230). In one example implementation, this software is resident in a computer sought to be protected from a security attack (or protected from unwanted or unauthorized manipulations of a writable memory area). In other embodiments, software could be received or downloaded from a web server (e.g., in the context of purchasing individual end-user licenses for separate devices, separate control proxies, separate virtual machines, hypervisors, servers, etc.) in order to provide this system for managing virtual machine configurations.
  • In other examples, the system and method for managing virtual machine configurations could involve a proprietary element (e.g., as part of an antivirus solution), which could be provided in (or be proximate to) these identified elements, or be provided in any other device, server, network appliance, console, firewall, switch, information technology (IT) device, etc., or be provided as a complementary solution (e.g., in conjunction with a firewall), or provisioned somewhere in the network. As used herein in this Specification, the term ‘computer’ is meant to encompass these possible elements (VMMs, hypervisors, virtual devices, network appliances, routers, switches, gateway, processors, servers, loadbalancers, firewalls, or any other suitable device, component, element, or object) operable to affect or process electronic information in a security environment. Moreover, this computer may include any suitable hardware, software, components, modules, interfaces, or objects that facilitate the operations thereof. This may be inclusive of appropriate algorithms and communication protocols that allow for the effective management of virtual machine configurations. In addition, the system functions can be consolidated in any suitable manner. Along similar design alternatives, any of the illustrated modules and components of FIGS. 1-4 may be combined in various possible configurations: all of which are clearly within the broad scope of this Specification.
  • In certain example implementations, the functions of managing virtual machine configurations outlined herein may be implemented by logic encoded in one or more tangible media (e.g., embedded logic provided in an application specific integrated circuit (ASIC), digital signal processor (DSP) instructions, software (potentially inclusive of object code and source code) to be executed by a processor, or other similar machine, etc.). In some of these instances, a memory element (as shown in FIGS. 2 and 3) can store data used for the operations described herein. This includes the memory element being able to store software, logic, code, or processor instructions that are executed to carry out the activities described in this Specification. A processor can execute any type of instructions to achieve the operations detailed herein in this Specification. In one example, the processors (as shown in the FIGURES) could transform an element or an article (e.g., data) from one state or thing to another state or thing. In another example, the activities outlined herein may be implemented with fixed logic or programmable logic (e.g., software/computer instructions executed by a processor) and the elements identified herein could be some type of a programmable processor, programmable digital logic (e.g., a field programmable gate array (FPGA), an erasable programmable read only memory (EPROM), an electrically erasable programmable ROM (EEPROM)) or an ASIC that includes digital logic, software, code, electronic instructions, or any suitable combination thereof.
  • Any of these elements (e.g., a computer, a server, a control proxy, a network appliance, a firewall, a virtual machine monitor, any other type of virtual element, etc.) can include memory elements for storing information to be used in achieving the management of virtual machine configurations as outlined herein. Additionally, each of these devices may include a processor that can execute software or an algorithm to perform the management of virtual machine configurations activities as discussed in this Specification. These devices may further keep information in any suitable memory element (random access memory (RAM), ROM, EPROM, EEPROM, ASIC, etc.), software, hardware, or in any other suitable component, device, element, or object where appropriate and based on particular needs. Any of the memory items discussed herein (e.g., policy database, etc.) should be construed as being encompassed within the broad term ‘memory element.’ Similarly, any of the potential processing elements, modules, and machines described in this Specification should be construed as being encompassed within the broad term ‘processor.’ Each of the computers, network appliances, virtual elements, etc. can also include suitable interfaces for receiving, transmitting, and/or otherwise communicating data or information in a secure environment.
  • Note that with the examples provided herein, interaction may be described in terms of two, three, four, or more network elements. However, this has been done for purposes of clarity and example only. In certain cases, it may be easier to describe one or more of the functionalities of a given set of flows by only referencing a limited number of components or network elements. It should be appreciated that the networks and systems of FIGS. 1 and 4 (and their teachings) are readily scalable. The system implemented in network environment 100 can accommodate a large number of components, as well as more complicated or sophisticated arrangements and configurations. Accordingly, the examples provided should not limit the scope or inhibit the broad teachings of the system as potentially applied to a myriad of other architectures. In addition, the system has been described herein as operating in conjunction with particular VMware architectures; however, other architectures can readily be accommodated by the present solution.
  • It is also important to note that the steps described with reference to the preceding FIGURES illustrate only some of the possible scenarios that may be executed by, or within, the system and method for managing virtual machine configurations. Some of these steps may be deleted or removed where appropriate, or these steps may be modified or changed considerably without departing from the scope of the discussed concepts. In addition, a number of these operations have been described as being executed concurrently with, or in parallel to, one or more additional operations. However, the timing of these operations may be altered considerably. The preceding operational flows have been offered for purposes of example and discussion. Substantial flexibility is provided by the present disclosure in that any suitable arrangements, chronologies, configurations, and timing mechanisms may be provided without departing from the teachings of the discussed concepts.

Claims (20)

  1. 1. A method, comprising:
    receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria;
    reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database;
    determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy;
    determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and
    sending the plurality of command messages to the server device if the operation is permitted.
  2. 2. The method of claim 1, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines.
  3. 3. The method of claim 1, wherein the operation includes configuring a selected one of a group of hardware components of one of the virtual machines, the group of hardware components consisting of: a processor, a CD drive, a DVD drive, a floppy drive, a memory element, a SCSI device, a network adapter, a parallel port, and a serial port.
  4. 4. The method of claim 1, wherein the plurality of command messages use Simple Object Access Protocol (SOAP) messaging framework.
  5. 5. The method of claim 1, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel.
  6. 6. The method of claim 1, further comprising,
    creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations.
  7. 7. The method of claim 1, further comprising:
    sending an error message to be displayed on the client device when the operation corresponding to the intended command is not permitted.
  8. 8. The method of claim 1, wherein the one or more criteria includes a user sending the message, a time of day the message is sent, and an address of the client device.
  9. 9. The method of claim 1, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent.
  10. 10. A non-transitory media having logic stored therein to perform operations comprising:
    receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria;
    reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database;
    determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy;
    determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and
    sending the plurality of command messages to the server device if the operation is permitted.
  11. 11. The media of claim 10, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines.
  12. 12. The media of claim 10, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel.
  13. 13. The media of claim 10, the processor being operable to perform operations comprising:
    creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations.
  14. 14. The media of claim 10, the processor being operable to perform operations comprising:
    sending an error message to be displayed on the client device when the operation corresponding to the intended command is not permitted.
  15. 15. The media of claim 10, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent.
  16. 16. A control proxy, comprising:
    a memory component configured to store a policy database; and
    a processor operable to execute instructions associated with a protocol message module and a policy module, including:
    receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria;
    reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database;
    determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy;
    determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and
    sending the plurality of command messages to the server device if the operation is permitted.
  17. 17. The control proxy of claim 16, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines.
  18. 18. The control proxy of claim 16, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel.
  19. 19. The control proxy of claim 16, wherein the processor is operable to execute instructions associated with an administration module comprising:
    creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations.
  20. 20. The control proxy of claim 16, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent.
US12636414 2008-12-11 2009-12-11 System and method for managing virtual machine configurations Active 2031-08-21 US8544003B1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US20169908 true 2008-12-11 2008-12-11
US12636414 US8544003B1 (en) 2008-12-11 2009-12-11 System and method for managing virtual machine configurations

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US12636414 US8544003B1 (en) 2008-12-11 2009-12-11 System and method for managing virtual machine configurations

Publications (2)

Publication Number Publication Date
US20130247033A1 true true US20130247033A1 (en) 2013-09-19
US8544003B1 US8544003B1 (en) 2013-09-24

Family

ID=49158910

Family Applications (1)

Application Number Title Priority Date Filing Date
US12636414 Active 2031-08-21 US8544003B1 (en) 2008-12-11 2009-12-11 System and method for managing virtual machine configurations

Country Status (1)

Country Link
US (1) US8544003B1 (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120297234A1 (en) * 2011-05-19 2012-11-22 International Business Machines Corporation Concurrent management console operations
US20130159428A1 (en) * 2011-12-19 2013-06-20 Vmware, Inc. Methods and apparatus for an e-mail-based management interface for virtualized environments
US20140059228A1 (en) * 2012-08-25 2014-02-27 Vmware, Inc. Resource allocation diagnosis on distributed computer systems
EP3076326A1 (en) * 2015-03-31 2016-10-05 Juniper Networks, Inc. Configuring a sandbox environment for malware testing
US20160315805A1 (en) * 2015-04-27 2016-10-27 Dell Products L.P. Systems and methods for one-to-many wireless access to management controllers

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7840968B1 (en) 2003-12-17 2010-11-23 Mcafee, Inc. Method and system for containment of usage of language interfaces
US7856661B1 (en) 2005-07-14 2010-12-21 Mcafee, Inc. Classification of software on networked systems
US7757269B1 (en) 2006-02-02 2010-07-13 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US7895573B1 (en) 2006-03-27 2011-02-22 Mcafee, Inc. Execution environment file inventory
US8332929B1 (en) 2007-01-10 2012-12-11 Mcafee, Inc. Method and apparatus for process enforced configuration management
US9424154B2 (en) 2007-01-10 2016-08-23 Mcafee, Inc. Method of and system for computer system state checks
US8381284B2 (en) 2009-08-21 2013-02-19 Mcafee, Inc. System and method for enforcing security policies in a virtual environment
US8925101B2 (en) 2010-07-28 2014-12-30 Mcafee, Inc. System and method for local protection against malicious software
US8938800B2 (en) 2010-07-28 2015-01-20 Mcafee, Inc. System and method for network level protection against malicious software
US8549003B1 (en) 2010-09-12 2013-10-01 Mcafee, Inc. System and method for clustering host inventories
US9075993B2 (en) 2011-01-24 2015-07-07 Mcafee, Inc. System and method for selectively grouping and managing program files
US9112830B2 (en) 2011-02-23 2015-08-18 Mcafee, Inc. System and method for interlocking a host and a gateway
US9594881B2 (en) 2011-09-09 2017-03-14 Mcafee, Inc. System and method for passive threat detection using virtual memory inspection
US8973144B2 (en) 2011-10-13 2015-03-03 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US9069586B2 (en) 2011-10-13 2015-06-30 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US8713668B2 (en) 2011-10-17 2014-04-29 Mcafee, Inc. System and method for redirected firewall discovery in a network environment
US8800024B2 (en) 2011-10-17 2014-08-05 Mcafee, Inc. System and method for host-initiated firewall discovery in a network environment
US8739272B1 (en) 2012-04-02 2014-05-27 Mcafee, Inc. System and method for interlocking a host and a gateway
US8973146B2 (en) 2012-12-27 2015-03-03 Mcafee, Inc. Herd based scan avoidance system in a network environment
CN105580023A (en) 2013-10-24 2016-05-11 迈克菲股份有限公司 Agent assisted malicious application blocking in a network environment
US9516063B2 (en) * 2015-03-10 2016-12-06 Raytheon Company System, method, and computer-readable medium for performing automated security validation on a virtual machine
US9742782B2 (en) 2015-06-11 2017-08-22 International Business Machines Corporation Configuration management for virtual machine environment
US9584378B1 (en) * 2015-12-22 2017-02-28 International Business Machines Corporation Computer-implemented command control in information technology service environment

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030200332A1 (en) * 1999-07-29 2003-10-23 Amit Gupta Method and apparatus for dynamic proxy insertion in network traffic flow
US20100071035A1 (en) * 2008-09-12 2010-03-18 Renata Budko Methods and systems for securely managing virtualization platform

Family Cites Families (211)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4982430A (en) 1985-04-24 1991-01-01 General Instrument Corporation Bootstrap channel security arrangement for communication network
US4688169A (en) 1985-05-30 1987-08-18 Joshi Bhagirath S Computer software security system
US5155847A (en) 1988-08-03 1992-10-13 Minicom Data Corporation Method and apparatus for updating software at remote locations
US5560008A (en) 1989-05-15 1996-09-24 International Business Machines Corporation Remote authentication and authorization in a distributed data processing system
CA2010591C (en) 1989-10-20 1999-01-26 Phillip M. Adams Kernels, description tables and device drivers
US5222134A (en) 1990-11-07 1993-06-22 Tau Systems Corporation Secure system for activating personal computer software at remote locations
US5390314A (en) 1992-10-09 1995-02-14 American Airlines, Inc. Method and apparatus for developing scripts that access mainframe resources that can be executed on various computer systems having different interface languages without modification
US5339261A (en) 1992-10-22 1994-08-16 Base 10 Systems, Inc. System for operating application software in a safety critical environment
US5584009A (en) 1993-10-18 1996-12-10 Cyrix Corporation System and method of retiring store data from a write buffer
JP3042341B2 (en) 1994-11-30 2000-05-15 日本電気株式会社 Local output control method in a cluster coupled multiprocessor system
US6282712B1 (en) 1995-03-10 2001-08-28 Microsoft Corporation Automatic software installation on heterogeneous networked computer systems
US5699513A (en) 1995-03-31 1997-12-16 Motorola, Inc. Method for secure network access via message intercept
US5787427A (en) 1996-01-03 1998-07-28 International Business Machines Corporation Information handling system, method, and article of manufacture for efficient object security processing by grouping objects sharing common control access policies
US5842017A (en) 1996-01-29 1998-11-24 Digital Equipment Corporation Method and apparatus for forming a translation unit
US5907709A (en) 1996-02-08 1999-05-25 Inprise Corporation Development system with methods for detecting invalid use and management of resources and memory at runtime
US5787177A (en) 1996-08-01 1998-07-28 Harris Corporation Integrated network security access control system
US5991881A (en) 1996-11-08 1999-11-23 Harris Corporation Network surveillance system
US6969352B2 (en) 1999-06-22 2005-11-29 Teratech Corporation Ultrasound probe with integrated electronics
US5987611A (en) 1996-12-31 1999-11-16 Zone Labs, Inc. System and methodology for managing internet access on a per application basis for client computers connected to the internet
US6141698A (en) 1997-01-29 2000-10-31 Network Commerce Inc. Method and system for injecting new code into existing application code
US6587877B1 (en) 1997-03-25 2003-07-01 Lucent Technologies Inc. Management of time and expense when communicating between a host and a communication network
US6192475B1 (en) 1997-03-31 2001-02-20 David R. Wallace System and method for cloaking software
US6356957B2 (en) 1997-04-03 2002-03-12 Hewlett-Packard Company Method for emulating native object oriented foundation classes on a target object oriented programming system using a template library
US6073142A (en) 1997-06-23 2000-06-06 Park City Group Automated post office based rule analysis of e-mail messages and other data objects for controlled distribution in network environments
US6275938B1 (en) 1997-08-28 2001-08-14 Microsoft Corporation Security enhancement for untrusted executable code
US6192401B1 (en) 1997-10-21 2001-02-20 Sun Microsystems, Inc. System and method for determining cluster membership in a heterogeneous distributed system
US6393465B2 (en) 1997-11-25 2002-05-21 Nixmail Corporation Junk electronic mail detector and eliminator
US5987610A (en) 1998-02-12 1999-11-16 Ameritech Corporation Computer virus screening methods and systems
US6795966B1 (en) 1998-05-15 2004-09-21 Vmware, Inc. Mechanism for restoring, porting, replicating and checkpointing computer systems using state extraction
US6442686B1 (en) 1998-07-02 2002-08-27 Networks Associates Technology, Inc. System and methodology for messaging server-based management and enforcement of crypto policies
US6338149B1 (en) 1998-07-31 2002-01-08 Westinghouse Electric Company Llc Change monitoring system for a computer system
US6546425B1 (en) 1998-10-09 2003-04-08 Netmotion Wireless, Inc. Method and apparatus for providing mobile and other intermittent connectivity in a computing environment
JP3753873B2 (en) 1998-11-11 2006-03-08 株式会社島津製作所 Spectrophotometer
US6453468B1 (en) 1999-06-30 2002-09-17 B-Hub, Inc. Methods for improving reliability while upgrading software programs in a clustered computer system
US6256773B1 (en) 1999-08-31 2001-07-03 Accenture Llp System, method and article of manufacture for configuration management in a development architecture framework
US6990591B1 (en) 1999-11-18 2006-01-24 Secureworks, Inc. Method and system for remotely configuring and monitoring a communication device
US6321267B1 (en) 1999-11-23 2001-11-20 Escom Corporation Method and apparatus for filtering junk email
US6662219B1 (en) 1999-12-15 2003-12-09 Microsoft Corporation System for determining at subgroup of nodes relative weight to represent cluster by obtaining exclusive possession of quorum resource
US6460050B1 (en) 1999-12-22 2002-10-01 Mark Raymond Pace Distributed content identification system
US6769008B1 (en) 2000-01-10 2004-07-27 Sun Microsystems, Inc. Method and apparatus for dynamically altering configurations of clustered computer systems
WO2001069439A1 (en) 2000-03-17 2001-09-20 Filesx Ltd. Accelerating responses to requests made by users to an internet
US6748534B1 (en) 2000-03-31 2004-06-08 Networks Associates, Inc. System and method for partitioned distributed scanning of a large dataset for viruses and other malware
CA2305078A1 (en) 2000-04-12 2001-10-12 Cloakware Corporation Tamper resistant software - mass data encoding
US7325127B2 (en) 2000-04-25 2008-01-29 Secure Data In Motion, Inc. Security server system
US6769115B1 (en) 2000-05-01 2004-07-27 Emc Corporation Adaptive interface for a software development environment
US6847993B1 (en) 2000-05-31 2005-01-25 International Business Machines Corporation Method, system and program products for managing cluster configurations
US6934755B1 (en) 2000-06-02 2005-08-23 Sun Microsystems, Inc. System and method for migrating processes on a network
US6611925B1 (en) 2000-06-13 2003-08-26 Networks Associates Technology, Inc. Single point of entry/origination item scanning within an enterprise or workgroup
US6901519B1 (en) 2000-06-22 2005-05-31 Infobahn, Inc. E-mail virus protection system and method
US8204999B2 (en) 2000-07-10 2012-06-19 Oracle International Corporation Query string processing
US7093239B1 (en) 2000-07-14 2006-08-15 Internet Security Systems, Inc. Computer immune system and method for detecting unwanted code in a computer system
US7350204B2 (en) 2000-07-24 2008-03-25 Microsoft Corporation Policies for secure software execution
DE60102934T2 (en) 2000-08-04 2005-03-10 Xtradyne Technologies Ag Method and system for session-based authorization and access control for networked application objects
US7707305B2 (en) 2000-10-17 2010-04-27 Cisco Technology, Inc. Methods and apparatus for protecting against overload conditions on nodes of a distributed network
US7146305B2 (en) 2000-10-24 2006-12-05 Vcis, Inc. Analytical virtual machine
US7606898B1 (en) 2000-10-24 2009-10-20 Microsoft Corporation System and method for distributed management of shared computers
US6930985B1 (en) 2000-10-26 2005-08-16 Extreme Networks, Inc. Method and apparatus for management of configuration in a network
US6834301B1 (en) 2000-11-08 2004-12-21 Networks Associates Technology, Inc. System and method for configuration, management, and monitoring of a computer network using inheritance
US6766334B1 (en) 2000-11-21 2004-07-20 Microsoft Corporation Project-based configuration management method and apparatus
US20020069367A1 (en) 2000-12-06 2002-06-06 Glen Tindal Network operating system data directory
US6907600B2 (en) 2000-12-27 2005-06-14 Intel Corporation Virtual translation lookaside buffer
US6832227B2 (en) 2001-02-19 2004-12-14 Hitachi, Ltd. Database management program, a database managing method and an apparatus therefor
US6918110B2 (en) 2001-04-11 2005-07-12 Hewlett-Packard Development Company, L.P. Dynamic instrumentation of an executable program by means of causing a breakpoint at the entry point of a function and providing instrumentation code
US20070253430A1 (en) 2002-04-23 2007-11-01 Minami John S Gigabit Ethernet Adapter
US6988101B2 (en) 2001-05-31 2006-01-17 International Business Machines Corporation Method, system, and computer program product for providing an extensible file system for accessing a foreign file system from a local data processing system
US6715050B2 (en) 2001-05-31 2004-03-30 Oracle International Corporation Storage access keys
US6988124B2 (en) 2001-06-06 2006-01-17 Microsoft Corporation Locating potentially identical objects across multiple computers based on stochastic partitioning of workload
US7290266B2 (en) 2001-06-14 2007-10-30 Cisco Technology, Inc. Access control by a real-time stateful reference monitor with a state collection training mode and a lockdown mode for detecting predetermined patterns of events indicative of requests for operating system resources resulting in a decision to allow or block activity identified in a sequence of events based on a rule set defining a processing policy
US7065767B2 (en) 2001-06-29 2006-06-20 Intel Corporation Managed hosting server auditing and change tracking
US7069330B1 (en) 2001-07-05 2006-06-27 Mcafee, Inc. Control of interaction between client computer applications and network resources
US20030023736A1 (en) 2001-07-12 2003-01-30 Kurt Abkemeier Method and system for filtering messages
US20030014667A1 (en) 2001-07-16 2003-01-16 Andrei Kolichtchak Buffer overflow attack detection and suppression
US6877088B2 (en) 2001-08-08 2005-04-05 Sun Microsystems, Inc. Methods and apparatus for controlling speculative execution of instructions based on a multiaccess memory condition
US7007302B1 (en) 2001-08-31 2006-02-28 Mcafee, Inc. Efficient management and blocking of malicious code and hacking attempts in a network environment
US7010796B1 (en) 2001-09-28 2006-03-07 Emc Corporation Methods and apparatus providing remote operation of an application programming interface
US7177267B2 (en) 2001-11-09 2007-02-13 Adc Dsl Systems, Inc. Hardware monitoring and configuration management
US7346781B2 (en) 2001-12-06 2008-03-18 Mcafee, Inc. Initiating execution of a computer program from an encrypted version of a computer program
US7039949B2 (en) 2001-12-10 2006-05-02 Brian Ross Cartmell Method and system for blocking unwanted communications
US7159036B2 (en) 2001-12-10 2007-01-02 Mcafee, Inc. Updating data from a source computer to groups of destination computers
US10033700B2 (en) 2001-12-12 2018-07-24 Intellectual Ventures I Llc Dynamic evaluation of access rights
JP4522705B2 (en) 2001-12-13 2010-08-11 独立行政法人科学技術振興機構 Software safety execution system
US7398389B2 (en) 2001-12-20 2008-07-08 Coretrace Corporation Kernel-based network security infrastructure
JP3906356B2 (en) 2001-12-27 2007-04-18 独立行政法人情報通信研究機構 Parsing method and apparatus
US7743415B2 (en) 2002-01-31 2010-06-22 Riverbed Technology, Inc. Denial of service attacks characterization
US20030167399A1 (en) 2002-03-01 2003-09-04 Yves Audebert Method and system for performing post issuance configuration and data changes to a personal security device using a communications pipe
US7600021B2 (en) 2002-04-03 2009-10-06 Microsoft Corporation Delta replication of source files and packages across networked resources
US7370360B2 (en) 2002-05-13 2008-05-06 International Business Machines Corporation Computer immune system and method for detecting unwanted code in a P-code or partially compiled native-code program executing within a virtual machine
US7823148B2 (en) 2002-05-22 2010-10-26 Oracle America, Inc. System and method for performing patch installation via a graphical user interface
US20030221190A1 (en) 2002-05-22 2003-11-27 Sun Microsystems, Inc. System and method for performing patch installation on multiple devices
US7024404B1 (en) 2002-05-28 2006-04-04 The State University Rutgers Retrieval and display of data objects using a cross-group ranking metric
US7512977B2 (en) 2003-06-11 2009-03-31 Symantec Corporation Intrustion protection system utilizing layers
US7823203B2 (en) 2002-06-17 2010-10-26 At&T Intellectual Property Ii, L.P. Method and device for detecting computer network intrusions
US7139916B2 (en) 2002-06-28 2006-11-21 Ebay, Inc. Method and system for monitoring user interaction with a computer
US8924484B2 (en) 2002-07-16 2014-12-30 Sonicwall, Inc. Active e-mail filter with challenge-response
US7522906B2 (en) 2002-08-09 2009-04-21 Wavelink Corporation Mobile unit configuration management for WLANs
US7624347B2 (en) 2002-09-17 2009-11-24 At&T Intellectual Property I, L.P. System and method for forwarding full header information in email messages
US7546333B2 (en) 2002-10-23 2009-06-09 Netapp, Inc. Methods and systems for predictive change management for access paths in networks
US7353501B2 (en) 2002-11-18 2008-04-01 Microsoft Corporation Generic wrapper scheme
US20040143749A1 (en) 2003-01-16 2004-07-22 Platformlogic, Inc. Behavior-based host-based intrusion prevention system
US20040167906A1 (en) 2003-02-25 2004-08-26 Smith Randolph C. System consolidation tool and method for patching multiple servers
US7024548B1 (en) 2003-03-10 2006-04-04 Cisco Technology, Inc. Methods and apparatus for auditing and tracking changes to an existing configuration of a computerized device
US7529754B2 (en) 2003-03-14 2009-05-05 Websense, Inc. System and method of monitoring and controlling application files
JPWO2004095285A1 (en) 2003-03-28 2006-07-13 松下電器産業株式会社 Recording medium and recording apparatus and reproducing apparatus using the same
US7607010B2 (en) 2003-04-12 2009-10-20 Deep Nines, Inc. System and method for network edge data protection
US20050108516A1 (en) 2003-04-17 2005-05-19 Robert Balzer By-pass and tampering protection for application wrappers
US20040230963A1 (en) 2003-05-12 2004-11-18 Rothman Michael A. Method for updating firmware in an operating system agnostic manner
DE10324189A1 (en) 2003-05-28 2004-12-16 Robert Bosch Gmbh A method for controlling access to a resource of an application in a data processing device
US7657599B2 (en) 2003-05-29 2010-02-02 Mindshare Design, Inc. Systems and methods for automatically updating electronic mail access lists
US20050108562A1 (en) 2003-06-18 2005-05-19 Khazan Roger I. Technique for detecting executable malicious code using a combination of static and dynamic analyses
US7283517B2 (en) 2003-07-22 2007-10-16 Innomedia Pte Stand alone multi-media terminal adapter with network address translation and port partitioning
US7886093B1 (en) 2003-07-31 2011-02-08 Hewlett-Packard Development Company, L.P. Electronic device network supporting compression and decompression in electronic devices
US7464408B1 (en) 2003-08-29 2008-12-09 Solidcore Systems, Inc. Damage containment by translation
US7356703B2 (en) 2003-09-16 2008-04-08 At&T Delaware Intellectual Property, Inc. Time-based computer access controls
US20050114672A1 (en) 2003-11-20 2005-05-26 Encryptx Corporation Data rights management of digital information in a portable software permission wrapper
US7600219B2 (en) 2003-12-10 2009-10-06 Sap Ag Method and system to monitor software interface updates and assess backward compatibility
US7546594B2 (en) 2003-12-15 2009-06-09 Microsoft Corporation System and method for updating installation components using an installation component delta patch in a networked environment
US7840968B1 (en) 2003-12-17 2010-11-23 Mcafee, Inc. Method and system for containment of usage of language interfaces
US7272654B1 (en) 2004-03-04 2007-09-18 Sandbox Networks, Inc. Virtualizing network-attached-storage (NAS) with a compact table that stores lossy hashes of file names and parent handles rather than full names
US7783735B1 (en) 2004-03-22 2010-08-24 Mcafee, Inc. Containment of network communication
US7487495B2 (en) 2004-04-19 2009-02-03 Lumension Security, Inc. Generic framework for runtime interception and execution control of interpreted languages
US7890946B2 (en) 2004-05-11 2011-02-15 Microsoft Corporation Efficient patching
US20060004875A1 (en) 2004-05-11 2006-01-05 Microsoft Corporation CMDB schema
US7469139B2 (en) 2004-05-24 2008-12-23 Computer Associates Think, Inc. Wireless manager and method for configuring and securing wireless access to a network
US7818377B2 (en) 2004-05-24 2010-10-19 Microsoft Corporation Extended message rule architecture
US7506170B2 (en) 2004-05-28 2009-03-17 Microsoft Corporation Method for secure access to multiple secure networks
US20050273858A1 (en) 2004-06-07 2005-12-08 Erez Zadok Stackable file systems and methods thereof
JP4341517B2 (en) 2004-06-21 2009-10-07 日本電気株式会社 Security policy management system, security policy management method and program
US20050289538A1 (en) 2004-06-23 2005-12-29 International Business Machines Corporation Deploying an application software on a virtual deployment target
US7203864B2 (en) 2004-06-25 2007-04-10 Hewlett-Packard Development Company, L.P. Method and system for clustering computers into peer groups and comparing individual computers to their peers
US7908653B2 (en) 2004-06-29 2011-03-15 Intel Corporation Method of improving computer security through sandboxing
US20060015501A1 (en) 2004-07-19 2006-01-19 International Business Machines Corporation System, method and program product to determine a time interval at which to check conditions to permit access to a file
US7937455B2 (en) 2004-07-28 2011-05-03 Oracle International Corporation Methods and systems for modifying nodes in a cluster environment
US7703090B2 (en) 2004-08-31 2010-04-20 Microsoft Corporation Patch un-installation
US7873955B1 (en) 2004-09-07 2011-01-18 Mcafee, Inc. Solidifying the executable software set of a computer
US20060080656A1 (en) 2004-10-12 2006-04-13 Microsoft Corporation Methods and instructions for patch management
US9329905B2 (en) 2004-10-15 2016-05-03 Emc Corporation Method and apparatus for configuring, monitoring and/or managing resource groups including a virtual machine
US7765538B2 (en) 2004-10-29 2010-07-27 Hewlett-Packard Development Company, L.P. Method and apparatus for determining which program patches to recommend for installation
US20060101277A1 (en) 2004-11-10 2006-05-11 Meenan Patrick A Detecting and remedying unauthorized computer programs
US7698744B2 (en) 2004-12-03 2010-04-13 Whitecell Software Inc. Secure system for allowing the execution of authorized computer program code
US7765544B2 (en) 2004-12-17 2010-07-27 Intel Corporation Method, apparatus and system for improving security in a virtual machine host
US8479193B2 (en) 2004-12-17 2013-07-02 Intel Corporation Method, apparatus and system for enhancing the usability of virtual machines
US7607170B2 (en) 2004-12-22 2009-10-20 Radware Ltd. Stateful attack protection
US7302558B2 (en) 2005-01-25 2007-11-27 Goldman Sachs & Co. Systems and methods to facilitate the creation and configuration management of computing systems
US8056138B2 (en) 2005-02-26 2011-11-08 International Business Machines Corporation System, method, and service for detecting improper manipulation of an application
US7836504B2 (en) 2005-03-01 2010-11-16 Microsoft Corporation On-access scan of memory for malware
US7685635B2 (en) 2005-03-11 2010-03-23 Microsoft Corporation Systems and methods for multi-level intercept processing in a virtual machine environment
US7552479B1 (en) 2005-03-22 2009-06-23 Symantec Corporation Detecting shellcode that modifies IAT entries
US7770151B2 (en) 2005-04-07 2010-08-03 International Business Machines Corporation Automatic generation of solution deployment descriptors
US7349931B2 (en) 2005-04-14 2008-03-25 Webroot Software, Inc. System and method for scanning obfuscated files for pestware
US8590044B2 (en) 2005-04-14 2013-11-19 International Business Machines Corporation Selective virus scanning system and method
US7363463B2 (en) 2005-05-13 2008-04-22 Microsoft Corporation Method and system for caching address translations from multiple address spaces in virtual machines
WO2006137057A3 (en) 2005-06-21 2007-08-02 Liad Agmon A method and a system for providing comprehensive protection against leakage of sensitive information assets using host based agents, content- meta-data and rules-based policies
US7739721B2 (en) 2005-07-11 2010-06-15 Microsoft Corporation Per-user and system granular audit policy implementation
US7856661B1 (en) 2005-07-14 2010-12-21 Mcafee, Inc. Classification of software on networked systems
US7895651B2 (en) 2005-07-29 2011-02-22 Bit 9, Inc. Content tracking in a network security system
US7962616B2 (en) 2005-08-11 2011-06-14 Micro Focus (Us), Inc. Real-time activity monitoring and reporting
US8327353B2 (en) 2005-08-30 2012-12-04 Microsoft Corporation Hierarchical virtualization with a multi-level virtualization mechanism
US7340574B2 (en) 2005-08-30 2008-03-04 Rockwell Automation Technologies, Inc. Method and apparatus for synchronizing an industrial controller with a redundant controller
US20070074199A1 (en) 2005-09-27 2007-03-29 Sebastian Schoenberg Method and apparatus for delivering microcode updates through virtual machine operations
US8131825B2 (en) 2005-10-07 2012-03-06 Citrix Systems, Inc. Method and a system for responding locally to requests for file metadata associated with files stored remotely
US7725737B2 (en) 2005-10-14 2010-05-25 Check Point Software Technologies, Inc. System and methodology providing secure workspace environment
US20070169079A1 (en) 2005-11-08 2007-07-19 Microsoft Corporation Software update management
US7836303B2 (en) 2005-12-09 2010-11-16 University Of Washington Web browser operating system
US7856538B2 (en) 2005-12-12 2010-12-21 Systex, Inc. Methods, systems and computer readable medium for detecting memory overflow conditions
US20070143851A1 (en) 2005-12-21 2007-06-21 Fiberlink Method and systems for controlling access to computing resources based on known security vulnerabilities
US20070174429A1 (en) 2006-01-24 2007-07-26 Citrix Systems, Inc. Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment
US7757269B1 (en) 2006-02-02 2010-07-13 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
WO2007099273A1 (en) 2006-03-03 2007-09-07 Arm Limited Monitoring values of signals within an integrated circuit
US8621433B2 (en) 2006-03-20 2013-12-31 Microsoft Corporation Managing version information for software components
US7895573B1 (en) 2006-03-27 2011-02-22 Mcafee, Inc. Execution environment file inventory
US7752233B2 (en) 2006-03-29 2010-07-06 Massachusetts Institute Of Technology Techniques for clustering a set of objects
US7870387B1 (en) 2006-04-07 2011-01-11 Mcafee, Inc. Program-based authorization
US8015563B2 (en) 2006-04-14 2011-09-06 Microsoft Corporation Managing virtual machines with system-wide policies
US7966659B1 (en) 2006-04-18 2011-06-21 Rockwell Automation Technologies, Inc. Distributed learn mode for configuring a firewall, security authority, intrusion detection/prevention devices, and the like
US8458673B2 (en) 2006-04-26 2013-06-04 Flexera Software Llc Computer-implemented method and system for binding digital rights management executable code to a software application
US7849502B1 (en) 2006-04-29 2010-12-07 Ironport Systems, Inc. Apparatus for monitoring network traffic
US8291409B2 (en) 2006-05-22 2012-10-16 Microsoft Corporation Updating virtual machine with patch on host that does not have network access
US7761912B2 (en) 2006-06-06 2010-07-20 Microsoft Corporation Reputation driven firewall
US7809704B2 (en) 2006-06-15 2010-10-05 Microsoft Corporation Combining spectral and probabilistic clustering
US20070300215A1 (en) 2006-06-26 2007-12-27 Bardsley Jeffrey S Methods, systems, and computer program products for obtaining and utilizing a score indicative of an overall performance effect of a software update on a software host
US8468526B2 (en) 2006-06-30 2013-06-18 Intel Corporation Concurrent thread execution using user-level asynchronous signaling
US8365294B2 (en) 2006-06-30 2013-01-29 Intel Corporation Hardware platform authentication and multi-platform validation
US8572721B2 (en) 2006-08-03 2013-10-29 Citrix Systems, Inc. Methods and systems for routing packets in a VPN-client-to-VPN-client connection via an SSL/VPN network appliance
US8015388B1 (en) 2006-08-04 2011-09-06 Vmware, Inc. Bypassing guest page table walk for shadow page table entries not present in guest page table
US8161475B2 (en) 2006-09-29 2012-04-17 Microsoft Corporation Automatic load and balancing for virtual machines to meet resource requirements
US9697019B1 (en) 2006-10-17 2017-07-04 Manageiq, Inc. Adapt a virtual machine to comply with system enforced policies and derive an optimized variant of the adapted virtual machine
US7689817B2 (en) 2006-11-16 2010-03-30 Intel Corporation Methods and apparatus for defeating malware
US7996836B1 (en) 2006-12-29 2011-08-09 Symantec Corporation Using a hypervisor to provide computer security
US8336046B2 (en) 2006-12-29 2012-12-18 Intel Corporation Dynamic VM cloning on request from application based on mapping of virtual hardware configuration to the identified physical hardware resources
US8381209B2 (en) 2007-01-03 2013-02-19 International Business Machines Corporation Moveable access control list (ACL) mechanisms for hypervisors and virtual machines and virtual port firewalls
US8254568B2 (en) 2007-01-07 2012-08-28 Apple Inc. Secure booting a computing device
US8380987B2 (en) 2007-01-25 2013-02-19 Microsoft Corporation Protection agents and privilege modes
US8276201B2 (en) 2007-03-22 2012-09-25 International Business Machines Corporation Integrity protection in data processing systems
US7930327B2 (en) 2007-05-21 2011-04-19 International Business Machines Corporation Method and apparatus for obtaining the absolute path name of an open file system object from its file descriptor
US20080301770A1 (en) 2007-05-31 2008-12-04 Kinder Nathan G Identity based virtual machine selector
US20090007100A1 (en) 2007-06-28 2009-01-01 Microsoft Corporation Suspending a Running Operating System to Enable Security Scanning
US8839450B2 (en) 2007-08-02 2014-09-16 Intel Corporation Secure vault service for software components within an execution environment
US8763115B2 (en) 2007-08-08 2014-06-24 Vmware, Inc. Impeding progress of malicious guest software
WO2009032711A1 (en) 2007-08-29 2009-03-12 Nirvanix, Inc. Policy-based file management for a storage delivery network
US8250641B2 (en) 2007-09-17 2012-08-21 Intel Corporation Method and apparatus for dynamic switching and real time security control on virtualized systems
US8819676B2 (en) 2007-10-30 2014-08-26 Vmware, Inc. Transparent memory-mapped emulation of I/O calls
JP5238235B2 (en) 2007-12-07 2013-07-17 株式会社日立製作所 Management apparatus and management method
US8261317B2 (en) 2008-03-27 2012-09-04 Juniper Networks, Inc. Moving security for virtual machines
US8321931B2 (en) 2008-03-31 2012-11-27 Intel Corporation Method and apparatus for sequential hypervisor invocation
CA2726310C (en) 2008-08-07 2013-10-08 Serge Nabutovsky Link exchange system and method
US9141381B2 (en) 2008-10-27 2015-09-22 Vmware, Inc. Version control environment for virtual machines
US8060722B2 (en) 2009-03-27 2011-11-15 Vmware, Inc. Hardware assistance for shadow page table coherence with guest page mappings
US8359422B2 (en) 2009-06-26 2013-01-22 Vmware, Inc. System and method to reduce trace faults in software MMU virtualization
US8341627B2 (en) 2009-08-21 2012-12-25 Mcafee, Inc. Method and system for providing user space address protection from writable memory area in a virtual environment
US8938800B2 (en) 2010-07-28 2015-01-20 Mcafee, Inc. System and method for network level protection against malicious software
US8925101B2 (en) 2010-07-28 2014-12-30 Mcafee, Inc. System and method for local protection against malicious software

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030200332A1 (en) * 1999-07-29 2003-10-23 Amit Gupta Method and apparatus for dynamic proxy insertion in network traffic flow
US20100071035A1 (en) * 2008-09-12 2010-03-18 Renata Budko Methods and systems for securely managing virtualization platform

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120297234A1 (en) * 2011-05-19 2012-11-22 International Business Machines Corporation Concurrent management console operations
US9298501B2 (en) * 2011-05-19 2016-03-29 Globalfoundries Inc. Concurrent management console operations
US20130159428A1 (en) * 2011-12-19 2013-06-20 Vmware, Inc. Methods and apparatus for an e-mail-based management interface for virtualized environments
US9049257B2 (en) * 2011-12-19 2015-06-02 Vmware, Inc. Methods and apparatus for an E-mail-based management interface for virtualized environments
US20140059228A1 (en) * 2012-08-25 2014-02-27 Vmware, Inc. Resource allocation diagnosis on distributed computer systems
US9323579B2 (en) * 2012-08-25 2016-04-26 Vmware, Inc. Resource allocation diagnosis on distributed computer systems
US9871856B2 (en) 2012-08-25 2018-01-16 Vmware, Inc. Resource allocation diagnosis on distributed computer systems
EP3076326A1 (en) * 2015-03-31 2016-10-05 Juniper Networks, Inc. Configuring a sandbox environment for malware testing
US9477837B1 (en) 2015-03-31 2016-10-25 Juniper Networks, Inc. Configuring a sandbox environment for malware testing
US9740853B2 (en) 2015-03-31 2017-08-22 Juniper Networks, Inc. Configuring a sandbox environment for malware testing
US20160315805A1 (en) * 2015-04-27 2016-10-27 Dell Products L.P. Systems and methods for one-to-many wireless access to management controllers

Also Published As

Publication number Publication date Type
US8544003B1 (en) 2013-09-24 grant

Similar Documents

Publication Publication Date Title
Padhy et al. Cloud computing: security issues and research challenges
Mather et al. Cloud security and privacy: an enterprise perspective on risks and compliance
US7506170B2 (en) Method for secure access to multiple secure networks
US7484247B2 (en) System and method for protecting a computer system from malicious software
Pearce et al. Virtualization: Issues, security threats, and solutions
US8719898B1 (en) Configuring and providing profiles that manage execution of mobile applications
US8776180B2 (en) Systems and methods for using reputation scores in network services and transactions to calculate security risks to computer systems and platforms
Vaquero et al. Locking the sky: a survey on IaaS cloud security
US20110167472A1 (en) Endpoint-Hosted Hypervisor Management
US8381284B2 (en) System and method for enforcing security policies in a virtual environment
US7725737B2 (en) System and methodology providing secure workspace environment
US20100125855A1 (en) System and method of security management for a virtual environment
US20070300069A1 (en) Associating a multi-context trusted platform module with distributed platforms
US20120084381A1 (en) Virtual Desktop Configuration And Operation Techniques
US20070089111A1 (en) Virtual environment manager
US20110219434A1 (en) Providing security services within a cloud computing environment
US20110247047A1 (en) Method for securing data and/or applications in a cloud computing architecture
Almorsy et al. An analysis of the cloud computing security problem
Berger et al. TVDc: managing security in the trusted virtual datacenter
US20130290694A1 (en) System and method for secure provisioning of virtualized images in a network environment
US20140298420A1 (en) Validating the Identity of a Mobile Application for Mobile Application Management
US20100251363A1 (en) Modified file tracking on virtual machines
US8881284B1 (en) Method and system for secure network access using a virtual machine
Dawoud et al. Infrastructure as a service security: Challenges and solutions
Jasti et al. Security in multi-tenancy cloud

Legal Events

Date Code Title Description
AS Assignment

Owner name: MCAFEE INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SAWHNEY, HARVINDER SINGH;SARAF, SUMAN;SHARMA, ROSEN;SIGNING DATES FROM 20091208 TO 20091211;REEL/FRAME:023643/0834

FPAY Fee payment

Year of fee payment: 4

AS Assignment

Owner name: MCAFEE, LLC, CALIFORNIA

Free format text: CHANGE OF NAME AND ENTITY CONVERSION;ASSIGNOR:MCAFEE, INC.;REEL/FRAME:043665/0918

Effective date: 20161220

AS Assignment

Owner name: MORGAN STANLEY SENIOR FUNDING, INC., MARYLAND

Free format text: SECURITY INTEREST;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:045056/0676

Effective date: 20170929

Owner name: JPMORGAN CHASE BANK, N.A., NEW YORK

Free format text: SECURITY INTEREST;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:045055/0786

Effective date: 20170929