WO2015070376A1 - Procédé et système pour réaliser la sécurité de virtualisation - Google Patents

Procédé et système pour réaliser la sécurité de virtualisation Download PDF

Info

Publication number
WO2015070376A1
WO2015070376A1 PCT/CN2013/086956 CN2013086956W WO2015070376A1 WO 2015070376 A1 WO2015070376 A1 WO 2015070376A1 CN 2013086956 W CN2013086956 W CN 2013086956W WO 2015070376 A1 WO2015070376 A1 WO 2015070376A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
command
security
type
user
Prior art date
Application number
PCT/CN2013/086956
Other languages
English (en)
Chinese (zh)
Inventor
施迅
叶思海
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2013/086956 priority Critical patent/WO2015070376A1/fr
Priority to CN201380004236.6A priority patent/CN104169939B/zh
Publication of WO2015070376A1 publication Critical patent/WO2015070376A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances

Definitions

  • the embodiments of the present invention relate to the field of cloud computing technologies, and in particular, to a method and system for implementing virtualization security.
  • Cloud computing is an important innovation in computing models that provides large-scale computing resources to users in the form of reliable services by efficiently integrating various interconnected computing resources and enabling multi-level virtualization and abstraction.
  • Virtualization technology brings a lot of convenience to the sharing and management of computing resources and becomes an important part of cloud computing.
  • the virtual machine monitor (VMM, Vi r tua l Machine Moni tor) is the core of virtualization technology.
  • the central processor CPU, cent ra l proces s ing uni t
  • Server physical resources such as memory, input/output (I/O, input/output) are converted into a set of logical resources that can be uniformly managed, flexibly scheduled, dynamically allocated, and based on these logical resources, multiple simultaneous constructions on a single physical server A virtual machine execution environment that runs and is isolated from each other.
  • the embodiment of the invention provides a method and system for implementing virtualization security to improve the user experience when implementing virtualization security.
  • the embodiment of the present invention provides a method for implementing virtualization security, where the method is applied to a system including a user virtual machine and a secure virtual machine, and specifically includes: The user virtual machine receives a command from a virtual machine user;
  • the user virtual machine classifies the command according to the execution body corresponding to the command, and obtains at least one of the following: a first type command and a second type command;
  • the user virtual machine executes the first type of command, and presents an execution result of the first type of command to the virtual machine user;
  • the user virtual machine sends the second type of command to the secure virtual machine through a virtual machine monitor; the secure virtual machine executes the second type of command, and The execution result of the second type of command is sent to the user virtual machine by using the virtual machine monitor; the user virtual machine presents the execution result of the second type of command to the virtual machine user;
  • the user virtual machine executes the first type of command, and sends the second type of command to the secure virtual machine through a virtual machine monitor;
  • the virtual machine executes the second type of command, and sends the execution result of the second type of command to the user virtual machine through the virtual machine monitor; the user virtual machine will use the first type of command
  • the execution result and the execution result of the second type of command are presented to the virtual machine user.
  • a correspondence between an operation code and an execution body is configured on the user virtual machine, and the execution body corresponding to the command further includes: :
  • the user virtual machine queries the corresponding relationship between the operation code and the execution entity according to the operation code carried by the command, and obtains an execution body corresponding to the command.
  • the method further includes:
  • the security light agent of the user virtual machine classifies the first type of commands according to the execution entity corresponding to the first type of command, and obtain at least one of the following: a proxy class command and a driver class command; And the secure light agent executes the proxy class command, and presents an execution result of the proxy class command to the virtual machine user; If the driver class command is obtained, the secure light agent sends the driver class command to the security driver of the user virtual machine; the security driver of the user virtual machine executes the driver class command, and the driver class The execution result of the command is sent to the secure light agent; the secure light agent presents the execution result of the drive type command to the virtual machine user;
  • the secure light proxy executes the proxy class command, and sends the driver class command to the user virtual machine security driver; the user virtual machine security driver execution And driving the command to send the execution result of the driver class command to the secure light agent; the secure light agent is configured to execute the execution result of the proxy class command and the execution result of the driver class command The virtual machine user is presented.
  • the method further includes: the security virtual Before executing the second type of commands, the machine further includes:
  • the user configuration auditing module of the security virtual machine audits the second type of command to determine that the second type of command satisfies a pre-configured security policy.
  • the method further includes:
  • the security function processing module of the secure virtual machine determines that the execution result of the second type of command satisfies the pre-configuration Notification policy.
  • the method further includes: performing a light proxy verification of the secure virtual machine
  • the module compares the integrity metric of the security light agent of the user virtual machine with the first correct value, and then processes the comparison result of the secure light agent according to the pre-configured first verification policy, where
  • the integrity metric of the secure light proxy is obtained by performing integrity calculation on the metric content of the secure light proxy, and the metric content of the secure light proxy includes at least one of the following: the code of the secure light proxy in memory , data, program files on disk, and Configuration Data.
  • the method further includes: a light proxy verification module of the secure virtual machine Comparing the security-driven integrity metric value of the user virtual machine with the second correct value, and then processing the comparison result of the security driver of the user virtual machine according to the pre-configured second verification policy.
  • the security-driven integrity metric is obtained by performing integrity calculation on the metric content of the security driver of the user virtual machine, where the metric content of the security driver includes at least one of the following: a security driver of the user virtual machine Code, data, drive files and configuration data saved on disk.
  • the embodiment of the present invention provides a system for implementing virtualization security, where the system includes a user virtual machine and a security virtual machine, where the user virtual machine is configured to receive a command from a virtual machine user, according to the The execution body corresponding to the command classifies the command, and obtain at least one of the following: a first type command and a second type command;
  • the user virtual machine is configured to execute the first type of command, and present an execution result of the first type of command to the virtual machine user;
  • the user virtual machine is configured to send the second type of command to the secure virtual machine by using a virtual machine monitor; and the secure virtual machine is configured to execute the second type a command, and the execution result of the second type of command is sent to the user virtual machine by using the virtual machine monitor; the user virtual machine is further configured to send the execution result of the second type of command to the user Virtual machine user presentation;
  • the user virtual machine is configured to execute the first type of command, and send the second type of command to the secure virtual machine through a virtual machine monitor;
  • the secure virtual machine is configured to execute the second type of command, and send the execution result of the second type of command to the user virtual machine by using the virtual machine monitor; the user virtual machine, And a method for presenting an execution result of the first type of command and an execution result of the second type of command to the virtual machine user.
  • a correspondence between an operation code and an execution body is configured on the user virtual machine, and the command is classified according to an execution body corresponding to the command.
  • the user virtual machine is further configured to query the corresponding relationship between the operation code and the execution entity according to the operation code carried by the command, and obtain an execution body corresponding to the command.
  • the user virtual machine includes a secure light proxy and a security driver, if the command is a security configuration command: the user virtual machine
  • the security light proxy is configured to classify the first type of commands according to an execution entity corresponding to the first type of command, and obtain at least one of the following: a proxy class command and a driver class command;
  • the secure light proxy is configured to execute the proxy class command, and present an execution result of the proxy class command to the virtual machine user;
  • the secure light agent is used to send the driver class command to the user virtual machine;
  • the user virtual machine security driver is configured to execute the driver class command. And sending the execution result of the driver class command to the secure light agent;
  • the secure light agent is further configured to present an execution result of the driver class command to the virtual machine user;
  • the secure light agent is configured to execute the agent class command, and send the driver class command to the user virtual machine security driver; the user virtual machine a security driver, configured to execute the driver-type command, and send an execution result of the driver-type command to the secure light agent; the secure light agent is further configured to execute an execution result of the proxy class command The execution result of the driver class command is presented to the virtual machine user.
  • the security virtual machine includes a user configuration auditing module, if the command is a security configuration command Before the security virtual machine is configured to execute the second type of command, the user configuration auditing module is configured to perform auditing on the second type of command, and determine the second type of command. Meet pre-configured security policies.
  • the security virtual machine includes a security function processing module, Before the execution result of the second type of command is sent to the user virtual machine by the virtual machine monitor, the security function processing module is configured to determine that the execution result of the second type of command satisfies a pre-configured notification policy.
  • the security virtual machine includes a light proxy verification module: a module, configured to compare an integrity metric of the security light agent of the user virtual machine with a first correct value, and then process the comparison result of the secure light agent according to the pre-configured first verification policy
  • the integrity metric of the secure light agent is calculated by performing integrity calculation on the metric content of the secure light agent, and the metric content of the secure light agent includes at least one of the following: the secure light agent is in the memory Code, data, program files on disk, and configuration data.
  • the light proxy verification module of the secure virtual machine is used to Comparing the security-driven integrity metric of the user virtual machine with the second correct value, and then processing the comparison result of the security driver of the user virtual machine according to the pre-configured second verification policy, the security The integrity metric of the driver is calculated by performing integrity calculation on the metric content of the security driver of the user virtual machine, and the metric content of the security driver includes at least one of the following: the security driver of the user virtual machine is in the memory The code, data, drive files and configuration data saved on the disk.
  • an embodiment of the present invention provides a system for implementing virtualization security, including: a processor, a memory, and a system bus, where the processor and the memory are connected through the system bus and complete each other.
  • the memory is configured to store a computer execution instruction;
  • the processor is configured to execute the computer to execute an instruction, and perform the first aspect or any one of the first to sixth possible implementation manners of the first aspect.
  • an embodiment of the present invention provides a computer program product, including a computer readable storage medium storing program code, where the program code includes instructions for performing the first aspect or the first aspect of the first aspect to The sixth of any possible implementation.
  • the user virtual machine receives the command from the virtual machine user, and classifies the command according to the execution entity corresponding to the command, to obtain at least one of the following: a first type command and a second type command, where The first type of command is executed by the user virtual machine, and the second type of command is executed by the secure virtual machine, and then the execution result of the command is presented by the user virtual machine to the virtual machine user, thereby being able to implement virtualization security. , improve the user experience.
  • FIG. 1 is a system architecture diagram for implementing virtualization security according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a method for implementing virtualization security according to an embodiment of the present invention
  • FIG. 3 is provided according to an embodiment of the present invention. The process of configuring the security function
  • FIG. 5 is a flow chart of a security function notification according to an embodiment of the present invention
  • FIG. 7 is another system structure diagram for implementing virtualization security.
  • Embodiments of the present invention provide a method and system for implementing virtualization security, which can ensure At the same time of virtualization security, the experience of virtual machine users (called users) is improved.
  • FIG. 1 is merely an exemplary illustration, and does not limit a specific networking manner.
  • the system includes a host 10, a virtualization management server 20, a security management server 30, and an application management server 40.
  • the host 10 is a physical server for providing computing resources in cloud computing.
  • the host 10 specifically includes: a hypervisor 101, a secure virtual machine 102, and a user virtual machine 103.
  • the hypervisor 101, the secure virtual machine 102, and the user virtual machine 103 may also be located in different hosts 10.
  • the secure virtual machine 102 and the hypervisor 101 are located in the host one, the user virtual machine 103 is located in the host two; or the hypervisor 101 is located in the host one.
  • the secure virtual machine 102 and the user virtual machine 103 are located in the host 2; or the hypervisor 101 is located in the host 1, the secure virtual machine 102 is located in the host 2, and the user virtual machine 103 is located in the host 3.
  • the Hypervisor 101, the secure virtual machine 102, and the user virtual machine 103 are located in the same main body example.
  • the Hypervisor 101 also known as the Virtual Machine Monitor (VMM)
  • VMM Virtual Machine Monitor
  • the Hypervisor 101 also known as the Virtual Machine Monitor (VMM)
  • VMM Virtual Machine Monitor
  • the security virtual machine 102 is configured to provide security protection capabilities for the user virtual machine 103, and specifically includes a security driver 1021 and a security application 1022.
  • the secure driver 1021 collects context information related to security events by invoking the hypervisor and communicates with the secure driver 1031 within the user virtual machine 103 by invoking the hypervisor.
  • the secure driver 1021 can also provide an application programming interface (API) to the security application 1022 to assist the security application 1022 in accessing the hypervisor 101.
  • API application programming interface
  • the security application 1022 provided by the security application software vendor, is the execution engine and database of the security application and provides a checksum audit function for the secure light agent 1032 within the user virtual machine 103.
  • the user virtual machine 103 is a virtual machine that provides computing power to the user, and can run desktop office, data execution, server maintenance, and the like.
  • the user virtual machine 103 provides functions similar to those of a general computer, and specifically includes a secure driver 1031 and a secure light agent 1 032.
  • the security driver 1031 is configured to monitor security events in the user virtual machine 103, such as file read and write, process creation, etc., and then invoke
  • Hyperv i sor 101 notifies the monitored security event information to the secure virtual machine 102.
  • the Secure Drive 1031 also provides an API interface to the Secure Light Agent 1032 to help the Secure Light Agent 1032 access Hyperv i sor 101.
  • the security driver 1031 can be specifically provided by a security application software vendor; or by a platform vendor.
  • the Secure Light Agent 1 032 also known as the "Thin Agent” is located in the User Virtual Machine 103 and provides functionality related to user interaction to ensure that virtual machine users experience the same when using a secure application. Other security functions are provided by the secure virtual machine 102, and the information transfer channel is provided by Hyperv i sor 101. Secure Light Agent 1032 is provided by security application software vendors.
  • a virtualization management server 20 for managing, maintaining, and distributing virtualized resources.
  • Virtualized resources include computing resources, storage resources, or network resources.
  • the virtualization management server 20 can be deployed in a server or virtual machine.
  • the security management server 30 is configured to provide deployment of the secure virtual machine 102, installation of the secure driver 1 031 in the user virtual machine 103, and monitor the running status of the secure driver 1021 and the secure driver 1031, receive events and alarm information, and ensure the secure driver 1021. And the reliable operation of the safe drive 1031.
  • the security management server 30 can be deployed in a separate server or virtual machine, or can be deployed together with the virtualization management server 20, or can be directly integrated into the software of the virtualization management server 20.
  • the application management server 40 is configured to provide management functions for the security application 1022, and is provided by the security application software vendor.
  • the application management server 40 may be deployed in a separate server or virtual machine, may be deployed together with the virtualization management server 20, or may be deployed together with the security management server 30. It includes the following modules (not shown): Security Application Deployment 401: Initially install and upgrade the security application 1 022, Secure Light Agent 1 032 in the virtualized system by means of centralized push or client application.
  • the administrator runs the execution and execution policies of the security application 1 022 and the secure light agent 1 032, such as resource occupancy policy and periodic task settings.
  • Security Function Operation 403 The operation object is specified by the administrator and the security application 1 022, the function of the secure light agent 1 032, such as anti-virus full disk scanning and sensitive data discovery.
  • the administrator of the cloud computing system can be divided into system administrators, security administrators, audit administrators, etc. according to the scope of responsibility. Cloud administrators with specific permissions can deploy and manage security applications in the virtualized system. 022, safe light agent 1 032.
  • the virtual machine user can connect to the virtual machine provided by the cloud through the network, and operate the desktop office, data execution, server maintenance, and the like.
  • the method for implementing virtualization security provided by the embodiment of the present invention is described below.
  • the method may be implemented on the system architecture of the foregoing embodiment.
  • An embodiment of the method for implementing virtualization security as shown in FIG. 2 includes the following steps:
  • the user virtual machine receives the command from the virtual machine user, and then classifies the command according to the execution body corresponding to the command, and obtains at least one of the following: a first type command and a second type command, wherein the first type command Executed by the user virtual machine, the second type of command is executed by the secure virtual machine.
  • the method further includes:
  • the user virtual machine queries the corresponding relationship between the operation code and the execution entity according to the operation code carried by the command, and obtains an execution body corresponding to the command.
  • the following steps 2) -6) are performed. If the first type of command is obtained, the user virtual machine executes the first type of command, and the The execution results of the first type of commands are presented to the virtual machine user.
  • the command includes at least one of the following: a security function configuration, a security function operation, and a security function notification.
  • a security function configuration a security function configuration
  • a security function operation a security function operation
  • a security function notification a security function notification
  • Hyperv i sor can also be called a virtual machine monitor ( ⁇ , Vi r tua l Machine Moni tor ).
  • the secure virtual machine sends the execution result of the second type of command to the Hyperv i sor.
  • the security function processing module of the secure virtual machine may determine that the execution result of the second type of command satisfies the pre-configured notification policy, and then sends the execution result of the second type of command to the Hypervisor.
  • Hyperv i sor sends the execution result of the second type of command to the user virtual machine.
  • the user virtual machine presents the execution result of the second type of command to the virtual machine user.
  • the user virtual machine receives the command from the virtual machine user, and classifies the command according to the execution entity corresponding to the command, to obtain at least one of the following: a first type command and a second type command
  • the first type of command is executed by the user virtual machine, and the second type is described by the virtual machine user. Therefore, the virtualized security can be realized by the secure virtual machine, and the physical risk of the virtual machine user is enhanced by the user virtual machine. Therefore, virtualized security is achieved through the cooperation of the secure virtual machine and the user virtual machine, and the application experience of the virtual machine user is improved.
  • the VMs can work with other modules to complete security function configuration, security function operations, and security function notifications. The details are described below.
  • FIG. 3 it is a flow of security function configuration provided by an embodiment of the present invention.
  • the virtual machine user according to his own usage habits, through the software interface provided by the secure light agent
  • User virtual machines and secure virtual machines are configured to be consistent with the use of traditional security software.
  • the user virtual machine includes a secure light agent and a secure driver;
  • the secure virtual machine includes a secure application and a secure driver.
  • the virtual machine monitor includes a virtualized security service platform.
  • the security light agent classifies the security function configuration to obtain a first type command or a second type command, wherein the first type command is executed by the user virtual machine, and the second type command is executed.
  • the first type of command is specifically divided into a proxy class command and a driver class command, wherein the proxy class command is locally saved by the secure light proxy of the user virtual machine.
  • the user configuration module in the secure light proxy can implement the above functions.
  • the proxy class command in the first type of command may specifically include at least one of the following: a log setting of the secure light agent, an upgrade setting of the secure light agent, and an upgrade setting of a security driver of the user virtual machine.
  • the log settings of the secure light agent include: but not limited to, configuring the log file size and saving time of the secure light agent;
  • Upgrade settings for secure light agents including but not limited to the upgrade cycle for configuring secure light agents; security driver upgrade settings for user virtual machines: including but not limited to the upgrade cycle for configuring security drives for user virtual machines.
  • the driver class command in the first type of command may specifically include at least one of the following: a log setting of the security driver of the user virtual machine, a cache setting, an Ema il protection setting, a self-protection setting of the security driver of the user virtual machine, The self-protection setting of the secure light agent.
  • the log setting of the security driver of the user virtual machine including but not limited to configuring the log file size of the security driver of the user virtual machine, or saving time;
  • Cache settings include, but are not limited to, whether to enable scan result caching, cache size, or number of cache files;
  • Ema il protection settings including but not limited to whether Ema il protection is enabled, attachment type, whether a large number of outsourcing is enabled for detection;
  • the self-protection setting of the security driver of the user virtual machine includes: but is not limited to, prohibiting the modification or stopping of the security monitoring function, recording the log of the destruction behavior, and automatically opening the time interval after temporarily closing the protection;
  • the self-protection setting of the security light agent includes, but is not limited to, prohibiting the deletion or stopping of the security light agent, recording the log of the destruction behavior, and automatically opening the time interval after the security light agent is temporarily stopped.
  • the second type of command is sent to the secure virtual machine for saving and executing by using the security driver of the user virtual machine and the virtualized security service platform, and may specifically include at least one of the following: periodic scan settings, filter settings, trust file settings, and processing mode settings. , notification settings, proactive defense settings, sample settings, upgrade settings for the security application of the secure virtual machine, and upgrade settings for the secure driver of the secure virtual machine.
  • the periodic scan setting includes: but not limited to, a periodic scan configuration at system startup, a periodic scan configuration at a specific time point, or a scan type, and the scan type includes a fast scan, a full scan, or a designated scan;
  • Filter settings including but not limited to file system protection file types, exclusion paths, real-time scan options, scanning of compressed files, and scan depth;
  • Trust file settings including but not limited to whitelist files, paths, file size exclusion; processing mode settings: including but not limited to automatic operations after detecting security risks, such as cleaning, deleting, quarantining, logging, whether to back up, whether to stop corresponding Process or service;
  • Notification settings including but not limited to whether to send a security event notification, or whether to send an execution result notification;
  • Active defense settings including but not limited to whether to enable "heuristic" active defense and defense level another 'J;
  • Sample setup including but not limited to whether to submit samples to the security software vendor's cloud security server;
  • Upgrade settings for the secure application of the secure virtual machine including but not limited to configuration security
  • the upgrade cycle of the application Since the security application can be understood as consisting of the scan engine and the signature, configuring the upgrade period of the security application can also be understood as configuring the scan engine upgrade period or configuring the signature upgrade period.
  • the upgrade setting of the secure driver of the secure virtual machine includes, but is not limited to, an upgrade period of configuring a secure drive of the secure virtual machine.
  • the corresponding relationship between the operation code and the execution body is configured on the user virtual machine, as shown in Table 1, and of course, Table 1 is merely an exemplary description.
  • the user virtual machine After receiving the command from the virtual machine user, the user virtual machine queries the corresponding relationship between the operation code and the execution entity according to the operation code carried by the command, and obtains the execution entity corresponding to the command.
  • the secure light proxy is configured to execute the proxy class command, and present an execution result of the proxy class command to the virtual machine user.
  • the secure light agent sends the driver class command or the second class command to the user's virtual machine security driver.
  • the security driver processing interface is called for the driver type command, and the security driver forwarding interface is called for the second type command.
  • the security driver of the user virtual machine executes the driver class command, and sends the execution result of the driver class command to the secure light agent; the secure light agent, the driver class command The execution result is presented to the virtual machine user.
  • the virtualized security service platform sends the second type of command to the secure virtual machine.
  • the virtualization security platform is used to establish an information transmission channel between the virtual machines in Hypervi sor (such as event 10 ring mechanism, memory sharing, authorization mechanism), and security events monitored by the security driver in the user virtual machine. (such as file read and write, process creation), transferred to the secure virtual machine, the security virtual machine performs the corresponding analysis and processing.
  • Hypervi sor such as event 10 ring mechanism, memory sharing, authorization mechanism
  • security events monitored by the security driver in the user virtual machine such as file read and write, process creation
  • the secure driver within the secure virtual machine sends a second type of command to the secure application.
  • the user of the security application can configure an audit module to audit the received second type of command.
  • the second type of command is executed only when it is determined that the second type of command satisfies a pre-configured security policy. Table 2 is used as an example. If the operation description carried in the command is "Disable all file types", the pre-configured security policy does not allow all file types to be disabled. Then the secure virtual machine will not operate on the second type of commands. . If the operation instructions carried in the command are the upgrade settings of the security application, which is not described in Table 2, it can be understood that the security virtual machine needs to perform the upgrade setting of the security application to meet the pre-configured security policy.
  • the command with the operation code Q00A is executed by the secure virtual machine according to Table 1.
  • the command also carries the instructions for "disable all file types".
  • the user configuration audit module of the secure virtual machine queries the pre-configured security policy corresponding to "disable all file types” and determines that "disable all file types" meets the pre-configured security policy before performing the filtering settings.
  • the command with the operation code 000B is executed by the secure virtual machine according to Table 1.
  • the command also carries the operating instructions of "Skip system critical path”.
  • the user configuration audit module of the secure virtual machine queries the pre-configured security policy corresponding to "skip system critical path", and determines that the "skip system critical path" meets the pre-configured security policy before executing the trust file setting. .
  • the secure virtual machine For configurations that have significant security risks (such as disabling all file types, or skipping system critical paths) or the actual effect is to turn off security protection, the secure virtual machine will provide "default protection" (refers to the protection policy configured by the administrator) Then, the secure virtual machine prompts the virtual machine user to confirm or modify it to avoid user configuration errors or malicious malicious modification of the configuration.
  • the security virtual machine Before the security virtual machine sends the result (success or failure) of the second type of command to the virtualization security service platform, it may first determine whether the execution result of the second type of command satisfies the pre-configured notification policy.
  • the secure virtual machine sends the execution result (success or failure) of the second type of command to the virtualized security service platform. For example, if the configuration fails, the pre-configured notification policy is "Yes", that is, the execution result of the second type of command needs to be notified to the user virtual machine; if the pre-configured notification policy is "No", That is, the execution result of the second type of command does not need to be notified to the user virtual machine.
  • the notification policy is configured as "yes” or it can be configured directly as “notify users.” If the notification policy is configured to "No", it can also be configured directly as "Do not notify the user.” table 3 If you follow the pre-configured notification policy, you need to notify the user. The security application then sends the execution result of the second type of command to the secure driver of the secure virtual machine.
  • the secure driver of the secure virtual machine sends the execution result of the second type of command to the virtual machine monitor.
  • the virtualized security service platform of the virtual machine monitor sends the execution result of the second type of command to the user virtual machine.
  • the security driver of the user virtual machine gives the execution result of the second type of command to the secure light agent. After executing the driver class command, the security driver sends the execution result of the driver class command to the secure light agent. After receiving the execution result of the second type command, the execution result of the second type command is sent to the security light agent. After waiting for the execution result of the second type of command, the execution result of the second type of command is sent to the secure light agent together with the execution result of the driver type command.
  • the security light agent of the user virtual machine presents the execution result of the second type of command to the virtual machine user Now.
  • the user virtual machine may present the execution result of the first type of command to the virtual machine user, and after receiving the execution result of the second type of command, present the execution result of the second type of command to the virtual machine user; After the execution result of the second type of command, the execution result of the second type of command is presented to the virtual machine user together with the execution result of the driver type command.
  • the method provided in this embodiment can implement the virtualized security function timing experience through the secure virtual machine. Therefore, the virtualized security is achieved through the cooperation of the secure virtual machine and the user virtual machine, and the application experience of the virtual machine user in the virtualization security function configuration is improved.
  • FIG. 4 it is a flow of security function operations provided by an embodiment of the method of the present invention.
  • Virtual machine users operate the user virtual machine and the secure virtual machine through the software interface provided by the secure light agent according to their own usage habits, which is consistent with the traditional security software.
  • the user virtual machine includes a secure light agent and a secure driver;
  • the secure virtual machine includes a secure application and a secure driver.
  • the virtual machine monitor includes a virtualized security service platform.
  • the security light agent classifies the operation of the security function to obtain a first type command or a second type command, wherein the first type command is executed by the user virtual machine, and the second type command is executed. Executed by a secure virtual machine.
  • the above functions can be implemented by a security function operation module in the secure light agent.
  • the antivirus software is used as an example.
  • the common first type of command includes at least one of the following: an upgrade operation of the security light agent of the user virtual machine, an upgrade operation of the security driver of the user virtual machine, viewing the protection status, and viewing the log. , view statistics, view 4 reports, and view quarantined files.
  • the upgrade operation of the security light agent including but not limited to the upgrade of the security light agent
  • the security operation upgrade operation of the user virtual machine including but not limited to the upgrade of the security driver of the user virtual machine
  • a common second type of command includes at least one of the following: initiating a quick scan, initiating a full scan, initiating a custom scan, upgrading a scan engine, and upgrading a signature.
  • a quick scan including but not limited to quickly scanning memory, scanning for specific paths, scanning for susceptible files, or scanning for common virus infection locations;
  • custom scan including but not limited to custom scan memory, scan specified files, scan path;
  • Upgrade of security applications Includes but is not limited to upgrades to security applications. Since a security application can be understood as consisting of a scan engine and a signature, an upgrade to a secure application can also be understood as an upgrade to the scan engine or an upgrade to a signature.
  • the corresponding relationship between the operation code and the execution body is configured on the user virtual machine, as shown in Table 4.
  • Table 4 is merely an exemplary description.
  • the execution subject of the command is a secure virtual machine, and therefore only the second type of command is classified according to the execution subject. If the command from the virtual machine user carries 1004, 1008, and 100A, then According to Table 4, the execution entity of 1004 is a secure virtual machine, and the execution entities of 1008 and 100A are user virtual machines. The first type of command is 1008 and 100A, and the second type of command is 1004.
  • the secure light agent is configured to execute the first type of command, and present an execution result of the first type of command to the virtual machine user.
  • the security function operation module of the secure light agent sends the second type of command to the security driver of the user virtual machine.
  • the virtualized security service platform sends the second type of command to the secure virtual machine.
  • the virtualization security platform is used to establish an information transmission channel between the virtual machines in Hypervi sor (such as event 10 ring mechanism, memory sharing, authorization mechanism), and security events monitored by the security driver in the user virtual machine. (such as file read and write, process creation), transferred to the secure virtual machine, the security virtual machine performs the corresponding analysis and execution.
  • Hypervi sor such as event 10 ring mechanism, memory sharing, authorization mechanism
  • security events monitored by the security driver in the user virtual machine such as file read and write, process creation
  • the virtualized security service platform specifically includes a virtual machine monitoring module.
  • the virtual machine monitoring module is used to utilize Hypervi sor to manage and control real physical resources and virtual machine logical resources, directly access virtual machine disks, memory pages, and CPU registers, and provide support for security virtual machine analysis and execution of security events. information.
  • the security driver in the secure virtual machine sends the second type of command to the security application, which can be sent to the security function processing module of the security application, and the module executes the corresponding security function according to the second type of command.
  • the security function processing module receives a security event monitored by a security driver in the user virtual machine or a user-initiated security operation, and invokes a virtual machine monitoring module of the virtualization security service platform to obtain more context information (such as file content, process binary) Image information), analyzes security events and context information, identifies malicious security events, and then performs actions according to preset policies, such as automatically disabling (quarantine or deleting files), or prompting users and receiving user execution choices.
  • Anti-virus application As an example, the antivirus scan engine and virus signature database traditionally located in the user virtual machine are transferred to the secure virtual machine. The antivirus scan engine and virus signature database here form a secure application for a secure virtual machine.
  • the secure virtual machine sends the execution result (success or failure) of the second type of command to the virtualized security service platform.
  • Table 5 is used as an example.
  • the pre-configured notification policy is "notify the user".
  • the notification policy is "yes”, that is, the progress of upgrading the signature is required. Notify the user of the virtual machine.
  • the notification policy can be directly configured to be "No”, that is, the user VM is not required to be notified of the progress of upgrading the signature. As shown in Table 5, it is not necessary to notify the user of the progress of the signature upgrade.
  • Discovering virus prompts may be the result of a "quick scan” with an opcode of 1001, or a "full scan” with an opcode of 1002, or a "custom scan” with an opcode of 1003. Results of the.
  • “Security Risk Prompt” may be a prompt generated during the execution of "Quick Scan” with an operation code of 1001, or it may be a prompt generated during the execution of "Full Scan” with an operation code of 1002, or the operation code is 1003 "Custom Scan” is generated during the execution Tips.
  • Interactive Options may be an option generated during the execution of "Quick Scan” with an opcode of 1001, or it may be an option generated during the execution of "Full Scan” with an opcode of 1002, or the opcode is The option generated during the execution of the 1003 "Custom Scan”.
  • the security application then sends the execution result of the second type of command to the secure driver of the secure virtual machine.
  • the execution result of the second type of command here includes the result of the operation or the progress of the operation.
  • the secure virtual machine sends the execution result of the second type of command to the virtualized security service platform.
  • the virtualization security service platform sends the execution result of the second type of command to the user virtual machine.
  • the secure driver of the user virtual machine sends the execution result of the second type of command to the secure light agent.
  • the security light agent of the user virtual machine presents the execution result of the second type of command to the virtual machine user.
  • the user virtual machine may present the execution result of the first type of command to the virtual machine user, and after receiving the execution result of the second type of command, present the execution result of the second type of command to the virtual machine user; After the execution result of the second type of command, the execution result of the second type of command is presented to the virtual machine user together with the execution result of the first type of command.
  • the method provided in this embodiment can implement the experience of virtualized security function operation by using a secure virtual machine. Therefore, the virtualized security is achieved through the cooperation of the secure virtual machine and the user virtual machine, and the application experience of the virtual machine user in the operation of the virtualized security function is improved.
  • FIG. 5 it is a flow of a security function notification provided by an embodiment of the present invention.
  • the user virtual machine can also forward the monitored security event information to the secure virtual machine.
  • the computer performs analysis execution. If the pre-configured policy needs to notify the user of the execution result or requires the user to participate in the interactive selection, the relevant information is sent to the secure light agent, and presented to the user by the secure light agent.
  • the specific process is as follows:
  • the security driver in the user virtual machine monitors security events (such as file read and write, process creation, etc.) in the user's virtual machine, and sends security event information to the virtualized security service platform in the Hypervisor.
  • security events such as file read and write, process creation, etc.
  • the virtualization security service platform sends security event information to the secure virtual machine.
  • the secure driver in the secure virtual machine sends the security event information to the security function processing module of the security application, which performs the security function corresponding to the event type.
  • the security virtual machine invokes the virtual machine monitoring module of the virtualized security service platform to obtain more context information (such as file content, binary image information of the process), and analyze security events and context information. Identify malicious security events and then follow the preset policies, such as automatically disabling (quarantine or deleting files), or prompting the user and receiving the user's execution choices. If the pre-configured notification policy needs to notify the user of the execution result or requires the user to participate in the interactive selection, the result or interactive selection will be sent to the user's virtual machine.
  • Virus detection Virus information
  • Security risk tips Process suspicious behavior (through heuristics) Active defense discovery), suspicious files (found through sandbox, reputation evaluation)
  • Interactive selection of actions Alert the user to viruses, suspicious behavior, suspicious files; Receive user's execution choices (delete, quarantine, ignore).
  • the pre-configured notification policy is "Yes”, that is, the user VM needs to be notified of the discovery virus; if the pre-configured notification policy is "No", the virus is not required to be notified to the user VM.
  • the notification policy is configured as "yes” or it can be configured directly as “notify users.” If the notification policy is configured to "No”, it can also be configured directly as "Do not notify the user.”
  • the secure virtual machine sends the notification information generated by the security function processing module to the virtualization security service platform.
  • the virtualization security service platform sends the notification information generated during the execution of the security function to the security driver of the user virtual machine, and then is sent to the secure light agent by the security driver of the user virtual machine, and finally presented to the virtual machine user. And receive confirmation or selection from the user. If user selection is required, the subsequent steps are similar to the embodiment of Figure 4.
  • the method provided in this embodiment implements the virtualization security function notification by the cooperation of the security virtual machine and each module in the user virtual machine, and improves the application experience of the virtual machine user in the notification of the security function. Detailed description.
  • the security protection module of the virtualization security service platform periodically scans the disk and memory of the virtual machine to measure the integrity of the security driver of the user virtual machine.
  • the security-driven metric content includes at least one of the following: the user virtual machine securely drives the code, data in the memory, the driver file and the configuration data saved on the disk.
  • the method of integrity calculation includes: using a one-way cryptographic algorithm (such as HASH algorithm: SHA_1, SHA-256; SM3 algorithm) to calculate a digital digest (digital fingerprint) of the content being measured. Performing an integrity calculation on the security-driven metric content of the user virtual machine results in a security-driven integrity metric of the user virtual machine.
  • the integrity metric is performed, and the metric content of the secure light agent includes at least one of the following: code, data, program files on the disk, and configuration data of the secure light agent in memory.
  • the method of integrity calculation includes: using a one-way cryptographic algorithm (such as HASH algorithm: SHA-1, SHA-256; SM3 algorithm) to calculate a digital digest (digital fingerprint) of the content being measured. Performing an integrity calculation on the metric content of the secure light agent results in an integrity metric of the secure light agent.
  • a one-way cryptographic algorithm such as HASH algorithm: SHA-1, SHA-256; SM3 algorithm
  • the security driver of the user virtual machine performs an integrity metric to the secure light agent, the security driver of the user virtual machine needs to send the integrity metric value of the secure light agent to the virtualized security service platform.
  • the virtualization security service platform sends the integrity metric of the secure light agent or the security metric integrity metric of the user virtual machine to the secure virtual machine.
  • the security driver in the secure virtual machine sends the integrity metric of the secure light agent or the security metric integrity metric of the user virtual machine to the security application, which may be sent to the security application.
  • Light proxy verification module
  • the light proxy verification module compares the integrity metric of the secure light proxy of the user virtual machine with the first correct value.
  • the comparison result of the secure light agent is then processed according to a pre-configured first verification policy.
  • the first correct value is a metric that is pre-set, or previously executed correctly, or distributed centrally.
  • the pre-configured first verification strategy is shown in Table 7.
  • Remedial measures include reinstalling the secure light agent and restoring the secure light agent. The default configuration, or prompt the user for this security risk.
  • the light proxy verification module receives the integrity metric of the security driver including the user virtual machine, the light proxy verification module performs the security-driven integrity metric and the second correct value of the user virtual machine. The comparison then processes the comparison result of the secure driving of the user virtual machine according to the pre-configured second verification policy.
  • the specific method is similar to the verification of the security light agent, and will not be described again.
  • the secure virtual machine If prompted to the user, the secure virtual machine sends a prompt message such as the verification result to the virtualized security service platform.
  • the verification information and other prompt information are driven by the virtualized security service platform and the user virtual machine, and finally presented to the user by the secure light agent. If a user selection is required, the subsequent execution steps are similar to the embodiment described in FIG.
  • the embodiment of the present invention ensures the security of the secure light agent or the security of the user virtual machine through the light agent verification module, and solves the security risk problem that the user virtual machine is located in the untrusted domain.
  • another system for implementing virtualization security includes: a processor 101, a memory 102, and a system bus (memory bus) 105.
  • the processor 101 and the memory 102 are connected by a system bus 105 and communicate with each other.
  • Processor 101 may be a single core or multi-core central processing unit, or a particular integrated circuit, or one or more integrated circuits configured to implement embodiments of the present invention.
  • the memory 102 can be a high speed RAM memory or a nonvolatile memory.
  • non-volat i le memory such as at least one hard disk storage.
  • the memory 102 is used to store computer execution instructions 1 021. Specifically, the program code may be included in the computer execution instruction 1021.
  • the processor 101 executes the computer execution instruction 1 021, and the flow described in any one of Figures 2-6 can be performed.
  • the embodiment of the present invention further provides a virtualized and secure computer program product, comprising: a computer readable storage medium storing program code, wherein the program code comprises instructions for executing the flow of any one of Figures 2-6.
  • aspects of the invention, or possible implementations of various aspects may be embodied as a system, method, or computer program product.
  • aspects of the invention, or possible implementations of various aspects may be in the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, etc.), or a combination of software and hardware aspects, They are collectively referred to herein as "circuits," “modules,” or “systems.”
  • aspects of the invention, or possible implementations of various aspects may take the form of a computer program product, which is a computer readable program code stored on a computer readable medium.
  • the computer readable medium can be a computer readable signal medium or a computer readable storage medium.
  • the computer readable storage medium includes, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing, such as random access memory (RAM), read only memory (ROM), Erase programmable read-only memory (EPR0M or flash memory), optical fiber, portable read-only memory (CD-ROM).
  • the processor in the computer reads the computer readable program code stored in the computer readable medium, such that the processor can perform the functional actions specified in each step or combination of steps in the flowchart; A device that functions as specified in each block, or combination of blocks.
  • the computer readable program code can be executed entirely on the user's computer, partly on the user's computer, as a separate software package, partly on the user's computer and partly on the remote computer, or entirely on the remote computer or server. .
  • the functions noted in the various steps in the flowcharts or in the blocks in the block diagrams may not occur in the order noted in the drawings. For example, two steps, or two blocks shown in succession may be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

Dans le procédé et le système des modes de réalisation de la présente invention, une machine virtuelle d'utilisateur reçoit une commande d'un utilisateur d'une machine virtuelle, classifie la commande en fonction d'un organe exécutif correspondant à la commande, et obtient au moins l'un des éléments suivants : un premier type de commande et un deuxième type de commande, le premier type de commande étant exécuté par la machine virtuelle d'utilisateur, le deuxième type de commande étant exécuté par une machine virtuelle de sécurité, la machine virtuelle d'utilisateur présentant ensuite les résultats de l'exécution de la commande à l'utilisateur de la machine virtuelle, ce qui améliore l'expérience d'utilisation tout en permettant de réaliser la sécurité de virtualisation.
PCT/CN2013/086956 2013-11-12 2013-11-12 Procédé et système pour réaliser la sécurité de virtualisation WO2015070376A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2013/086956 WO2015070376A1 (fr) 2013-11-12 2013-11-12 Procédé et système pour réaliser la sécurité de virtualisation
CN201380004236.6A CN104169939B (zh) 2013-11-12 2013-11-12 一种实现虚拟化安全的方法和系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2013/086956 WO2015070376A1 (fr) 2013-11-12 2013-11-12 Procédé et système pour réaliser la sécurité de virtualisation

Publications (1)

Publication Number Publication Date
WO2015070376A1 true WO2015070376A1 (fr) 2015-05-21

Family

ID=51912352

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/086956 WO2015070376A1 (fr) 2013-11-12 2013-11-12 Procédé et système pour réaliser la sécurité de virtualisation

Country Status (2)

Country Link
CN (1) CN104169939B (fr)
WO (1) WO2015070376A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020140205A1 (fr) * 2019-01-02 2020-07-09 Nokia Shanghai Bell Co., Ltd. Procédé, système et appareil de gestion de configuration de sécurité unifiée

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9652612B2 (en) * 2015-03-25 2017-05-16 International Business Machines Corporation Security within a software-defined infrastructure
CN105227570B (zh) * 2015-10-19 2019-02-15 成都卫士通信息产业股份有限公司 一种综合防御的安全电子邮件系统
SG11201804327TA (en) * 2015-12-19 2018-07-30 Bitdefender Ipr Man Ltd Dual memory introspection for securing multiple network endpoints
CN107038128B (zh) * 2016-02-03 2020-07-28 华为技术有限公司 一种执行环境的虚拟化、虚拟执行环境的访问方法及装置
CN106844005B (zh) * 2016-12-29 2020-04-14 北京瑞星网安技术股份有限公司 基于虚拟化环境下的数据恢复方法及系统
CN111831609B (zh) * 2020-06-18 2024-01-02 中国科学院数据与通信保护研究教育中心 虚拟化环境中二进制度量值统一管理和分发的方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101630270A (zh) * 2009-07-22 2010-01-20 成都市华为赛门铁克科技有限公司 数据处理系统和方法
CN102254117A (zh) * 2011-07-07 2011-11-23 李鹏 一种基于虚拟化技术的数据防泄密系统
US20130007469A1 (en) * 2011-06-29 2013-01-03 Internatioanl Business Machines Corporation Securely managing the execution of screen rendering instructions in a host operating system and virtual machine
CN102971706A (zh) * 2010-05-10 2013-03-13 思杰系统有限公司 将信息从安全虚拟机重定向到不安全虚拟机

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110004878A1 (en) * 2009-06-30 2011-01-06 Hubert Divoux Methods and systems for selecting a desktop execution location
US8887227B2 (en) * 2010-03-23 2014-11-11 Citrix Systems, Inc. Network policy implementation for a multi-virtual machine appliance within a virtualization environtment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101630270A (zh) * 2009-07-22 2010-01-20 成都市华为赛门铁克科技有限公司 数据处理系统和方法
CN102971706A (zh) * 2010-05-10 2013-03-13 思杰系统有限公司 将信息从安全虚拟机重定向到不安全虚拟机
US20130007469A1 (en) * 2011-06-29 2013-01-03 Internatioanl Business Machines Corporation Securely managing the execution of screen rendering instructions in a host operating system and virtual machine
CN102254117A (zh) * 2011-07-07 2011-11-23 李鹏 一种基于虚拟化技术的数据防泄密系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020140205A1 (fr) * 2019-01-02 2020-07-09 Nokia Shanghai Bell Co., Ltd. Procédé, système et appareil de gestion de configuration de sécurité unifiée
US12010146B2 (en) 2019-01-02 2024-06-11 Nokia Solutions And Networks Oy Method, system and apparatus for unified security configuration management

Also Published As

Publication number Publication date
CN104169939A (zh) 2014-11-26
CN104169939B (zh) 2017-02-15

Similar Documents

Publication Publication Date Title
US20200301764A1 (en) Operating system on a computing system
US10630643B2 (en) Dual memory introspection for securing multiple network endpoints
US10678935B2 (en) Identifying container file events for providing container security
US11222123B2 (en) Securing privileged virtualized execution instances from penetrating a virtual host environment
US8925076B2 (en) Application-specific re-adjustment of computer security settings
US9094451B2 (en) System and method for reducing load on an operating system when executing antivirus operations
RU2645268C2 (ru) Сложное классифицирование для выявления вредоносных программ
US9639693B2 (en) Techniques for detecting a security vulnerability
US10565378B1 (en) Exploit of privilege detection framework
WO2015070376A1 (fr) Procédé et système pour réaliser la sécurité de virtualisation
JP6055574B2 (ja) セキュアなオペレーティングシステム環境へのコンテキストベースのスイッチング
US20180191779A1 (en) Flexible Deception Architecture
US11645390B2 (en) Cloud-based method to increase integrity of a next generation antivirus (NGAV) security solution in a virtualized computing environment
US8826275B2 (en) System and method for self-aware virtual machine image deployment enforcement
US20220188444A1 (en) Systems and methods for securing virtualized execution instances
US9785492B1 (en) Technique for hypervisor-based firmware acquisition and analysis
EP2881883B1 (fr) Système et procédé de réduction de charge sur un système d'exploitation lors de l'exécution des opérations antivirus
Sun et al. Cloud armor: Protecting cloud commands from compromised cloud services
US20230106879A1 (en) Virtualized applications on managed virtual machines
WO2019209893A1 (fr) Système d'exploitation sur un système informatique
US11983263B2 (en) Virtual machines to install untrusted executable codes
US11928494B2 (en) Configuration techniques for managed virtual machines
Varadharajan et al. Integrated Security Architecture for Virtual Machines

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13897439

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13897439

Country of ref document: EP

Kind code of ref document: A1