WO2015079123A1

WO2015079123A1 - Method of virtualization of a work station

Info

Publication number: WO2015079123A1
Application number: PCT/FR2013/052874
Authority: WO
Inventors: Sébastien CAZAJOUS
Original assignee: Occterra
Priority date: 2013-11-27
Filing date: 2013-11-27
Publication date: 2015-06-04
Also published as: EP3074908A1

Abstract

The subject of the invention is a method of virtualization of a work station (60) comprising hardware resources (62) making it possible to implement at least one operating system (64,66), at least one task (68) related to the administration and to the management of the hardware resources (62) of the work station (60), at least one professional application (70) making it possible to create and to manipulate computerized data (72), and at least one application (74) for securing this computerized data (72), the method being characterized in that it makes provision to install on a mass storage device (76) a low software layer (78) comprising a low operating system (64), each application (74) for securing the computing data and a virtualization engine (80), and in that it makes provision to install in a virtual manner in the low software layer (78) and thanks to the virtualization engine (80) another high software layer (82) comprising a high operating system (66) and each professional application (70).

Description

METHOD FOR VIRTUALIZING A WORKSTATION

The present invention relates to the virtualization of a workstation in order to secure the use of this workstation.

By workstation, the invention means a computer comprising for example a central unit, a screen, a keyboard and a mouse, the central unit of a workstation comprising hardware resources such as: motherboard, processor, memory , hard disk or other means of mass storage, as well as wired and / or wireless network communication means.

In the industry, workstations are used by different users in different situations.

In a first situation illustrated in FIG. 1, workstations 10 are used within the local professional network 12 of an industrial site.

For this purpose, the different workstations 10 are connected to a private server 14 allowing the workstations 10 to be connected to each other and also allowing the workstations 10 to access the international Internet network 16.

Thus, computer data 18 can be exchanged between the different workstations 10 within the local business network 12, or computer data 18 can be sent or received by the workstations 10 via the international Internet network 16.

In another use situation, a workstation 20 is used for telework, or remote work, by being directly connected to the international Internet network 16, for example via a mobile telephone network 22.

Thus, the workstation 20 can exchange computer data 18 with the private server 14 and the workstations 10 of the local professional network 12 of the industrial site, or with other workstations used in remote work.

According to another situation of remote use, a workstation 24 can be used for telecommuting within a private local area network 26 such as the private local area network. home of the user, the workstation 24 then being connected to the international network Internet 16 via network termination equipment 28.

As in the previous remote operation, the workstation 24 can exchange computer data 18 with the private server 14 and the workstations 10 of the professional local network 12 of the industrial site, or with other workstations used in telecommuting. Finally, according to a last example of a remote use situation, a workstation 30 can be used for telecommuting within a public local area network 32 such as, for example, the local area network of a public place, the workstation 30 then being connected to the international Internet network 16 via a public server 34 in order to be able to exchange computer data 18 with the private server 14 and the workstations 10 of the local professional network 12 of the industrial site, or with other workstations used in remote work.

In either of these use situations, the workstations 10 are used to implement different business applications.

These business applications include, for example, industrial product design, production management and monitoring, document management, configuration management, systems administration, distributed project management, distributed data processing, and more.

Advantageously, and thanks to the aforementioned networking means, most of these professional applications are collaborative work platforms.

Therefore, the computer data circulating between the different workstations 10, 20, 24, 30 are sensitive data that must remain confidential, and this as well when the workstations 10 are used internally within the local professional network 12 from the industrial site or that workstations 20,24,30 are used externally within unsecured networks.

As illustrated in FIG. 2, a workstation 10, 20, 24, 30 and its hardware resources 36 are currently used to implement a software system 38 comprising an operating system 40.

This operating system 40 performs various tasks 42 related to the administration and management of the hardware resources 36 of the workstation 10, 20, 24, 30, and allows the installation and execution of one or more professional applications 44. In the case where one of these professional applications 44 is a collaborative work platform, the confidentiality of the computer data created and manipulated by this application must be protected both when this data is stored in the workstation 10, 20, 24 Only when they pass between different workstations 10, 20, 24, 30 by unsecured networks.

For this purpose, various security applications 46 of the data 18 complete the functions performed by the operating system 40.

For example, an antivirus application 48 and a firewall application 50 protect the data 18 stored in the workstation 10, 20, 24, 30, while an encryption application 52 and a network interconnect application 54 using a tunneling protocol makes it possible to protect the data during their circulation between different workstations 10, 20, 24, 30 by insecure networks.

Also, in this known software system 38, all applications coexist in the same software layer.

Thus, the user has as much access to professional applications 44 useful for the accomplishment of his work as to security applications 46.

And, it turns out that this access to the security applications 46 by some users may result in the reduction or the disappearance of the data security functions 18 fulfilled by these security applications 46.

Indeed, some unsuspecting or malicious users may modify the operating parameters of these security applications 46, and even sometimes disable them, for example thinking that these security applications 46 are not necessarily useful and that they reduce the performances. of their workstation 10, 20, 24, 30. Also, the present invention aims to overcome the disadvantages of the prior art.

For this purpose, the subject of the invention is a method for virtualizing a workstation comprising hardware resources making it possible to implement at least one operating system, at least one task related to administration and management. hardware resources of the workstation, at least one professional application for creating and manipulating computer data, and at least one application for securing this computer data. According to the invention, the virtualization method is characterized in that it plans to install on a mass storage device a low software layer comprising a low operating system, each application for securing computer data and a data storage engine. virtualization, and in that it plans to install virtually in the low software layer and through the virtualization engine another high software layer including a top operating system and each professional application.

In more detail, each application for securing the computer data installed in the low software layer is inaccessible from the high software layer.

Thus, and whatever its intentions, the user of the workstation can not access the security applications and their operating parameters, which has the result of preserving, to the extent of the protection capabilities offered by the applications of security, the confidentiality of computer data, for example created and manipulated on the workstation with a professional application and communicated to other workstations, leaves unsecured networks.

The present invention also covers a mass storage device used for the implementation of this virtualization method, and a virtualized workstation receiving such a mass storage device.

Other features and advantages will become apparent from the following description of the invention, a description given by way of example only, with reference to the appended drawings in which:

FIG. 1 is a schematic view of different situations of use of a workstation,

FIG. 2 is a schematic view of the software configuration of a workstation according to the prior art, and

FIG. 3 is a schematic view of the software configuration of a workstation according to the invention.

As illustrated in FIG. 3, the present invention relates to the virtualization of a workstation 60 comprising hardware resources 62.

In known manner, a workstation 60 is a computer comprising for example a central unit, a screen, a keyboard and a mouse, the central unit of the workstation 60 comprising hardware resources 62 such as: motherboard, processor (s), RAM, a hard disk or other mass storage device, and wired and / or wireless network communication means.

This workstation 60 can take the form of a desktop computer, with or without an internal hard disk, a laptop, a touch screen computer, a touch screen tablet, a smartphone, etc.

The hardware resources 62 of the workstation 60 allow the implementation of at least one operating system, at least one task 68 related to the administration and management of the material resources 62 of the workstation, d. at least one professional application 70 making it possible to create and manipulate computer data 72, and at least one application for securing 74 of these computer data 72.

According to the invention, the virtualization method provides for installing on a mass storage device 76 a low software layer 78 comprising a low operating system 64, each security application 74 of the computer data 72 and a virtualization engine 80 , and it also plans to install virtually in the low software layer 78 and through the virtualization engine 80 another high software layer 82 comprising a top operating system 66 and each professional application 70. Thus, thanks to the engine of virtualization 80, only the high software layer 82, dedicated to the professional use of the workstation 60, is visible by the user of the workstation 60.

However, this high software layer 82 is encapsulated in the low software layer 78 which is dedicated to the administration of the operation of the workstation 60 and the securing of the computer data 72.

Thus, the low software layer 78 and its security applications 74 control and filter all the computer data exchanges 72 to or from the professional applications 70 of the high software layer 82.

Moreover, by virtue of this dual-layer software architecture, it is possible to integrate in the low software layer 78 applications establishing log files of the operation of the upper software layer 82 and its professional applications 70, or an application allowing to repair and / or restore the high software layer 82. Advantageously, the pair (low operating system 64, high operating system 66) is adapted according to the needs of the industrial and material resources 62 of the workstation 60.

However, the upper operating system 66 is rather chosen according to its compatibility with the professional applications 70 to be installed and implemented by the workstation 60, while the operating system low 64 is rather chosen according to its robustness, that is to say, its ability to provide the most reliable operation possible (without bug), and its ability to adapt to different hardware by integrating various drivers.

In addition, the lower operating system 64 is also chosen according to the higher operating system 66 to be virtualized.

Indeed, the choice of a high operating system 66 requires the use of some virtualization engines 80 which can be implemented only by some low operating systems 64.

Preferably, the top operating system 66 is selected from the family of the Windows ^® operating systems while the bottom 64 operating system is selected from the different free distributions Debian ^®, ^® RedHat, Ubuntu ^®, etc.

However, both of these high-66 and low-64 operating systems can be chosen from the aforementioned operating systems, as well as from the operating systems developed by other publishers, and for example Android ^® or iOS ^® . For example, and depending on the top operating systems 66 and 64 chosen, the virtualization engine 80 is Virtual Box ^® , VMWare ^® , Parallels ^® , Xen ^® , KVM ^® , Virtual Server ^® , or another virtualization engine known to those skilled in the art.

In more detail, the virtualization method provides that each security application 74 of the computer data 72 is installed in the low software layer 78 so as to be inaccessible from the high software layer 82.

This avoids any risk that a user, malicious or inadvertent, disrupting the proper operation of these applications for securing computer data 72.

By inaccessible, the invention means that no graphical user interface or any command or line of code makes it possible to access a security application 74 from the high software layer 82, that is to say from the data protection system. 'top operating 66 installed in this high software layer 82 or from a professional application 70 installed in this high software layer 82.

More generally, the virtualization method provides that the low software layer 78 as a whole is inaccessible from the high software layer 82.

Thus, neither the low operating system 64 nor a task 68 related to the administration and management of the hardware resources 62 of the workstation 60 is accessible from the high software layer 82, that is, say from the top operating system 66 installed in this high software layer 82 or from a professional application 70 installed in this high software layer 82.

As before, this avoids any risk that a user, malicious or inadvertent, disrupts the proper functioning of the low operating system 64, or task 68 related to the administration and management of resources 62 of the workstation 60.

Indeed, a malfunction of the low operating system 64 or a task 68 related to the administration and management of the hardware resources 62 of the workstation 60 could lead to a malfunction of a security application 74, and therefore a flaw in protecting the confidentiality of computer data 72.

By task 68 related to the administration and management of the hardware resources 62 of the workstation 60, the invention includes any task for ensuring the exchanges between the different components of the hardware resources 62 and the various peripherals of the workstation 60 so that these components and these devices allow the installation and implementation on the workstation 60 of at least one operating system and at least one application, for example dedicated to securing the data or to professional use.

According to the invention, a security application 74 of the computer data 72 is an antivirus application 84, a firewall application 86, an encryption application 88 of the computer data 72 or a network interconnection application 90, called VPN, and using a example a tunneling protocol.

If the antivirus application 84 and the firewall application 86 are more for the protection of the computer data 72 stored in the workstation 60 and therefore in the memory of the mass storage device 76, the encryption application 88 computer data 72 and the network interconnection application 90 are more intended for the protection of the confidentiality of computer data 72 intended to be sent to other workstations or received from other workstations, these other workstations being able to be located within a professional local network of an industrial site or used externally within unsecured networks.

Still according to the invention, a professional application 70 is an application for industrial product design, management and production monitoring, document management, configuration management, system administration, distributed project management, processing distributed data, etc.

More simply, a professional application 70 can also be an Internet browser ^® , word processing software, etc.

The present invention aims to promote the establishment of telework, or remote work, in certain public sectors, as well as remote collaboration of different industrial players on joint projects, at least one professional application 70 is a collaborative work platform .

For example, an industrial product design or production management and monitoring application can be a collaborative work platform.

A collaborative enterprise application 70 can also be a secure remote administration platform, a universal client for a web platform, a privileged client secured and maintained for an application hosted in the cloud, etc.

Of course, the use on a workstation 60 according to the invention of a collaborative professional application 70 is favored by the presence in the low software layer 78 of the encryption application 88 of the computer data 72 and the application network interconnection 90.

Finally, and considering the diversity of professional applications 70 that can be installed in the upper software layer 82, the computer data 72 can take different known formats, and free or proprietary depending on the application 70 that uses them.

At the same time, the present invention also covers the mass storage device 76 intended to be connected to the hardware resources 62 of a workstation 60 making it possible to implement at least one operating system 64, 66, at least one task 68 related to the administration and management of the hardware resources 62 of the workstation 60, at least one professional application 70 for creating and manipulating data 72, and at least one application for securing 74 of these computer data 74.

According to the invention, the low software layer 78 comprising the low operating system 64, each security application 74 of the computer data 72 and the virtualization engine 80 is installed on the mass storage device 76, and the other layer high software 82 including the top operating system 66 and each business application 70 is installed virtually in the low software layer 78 through the virtualization engine 80.

In order to allow a user to move with his virtualized workstation 60, the mass storage device 76 takes the form of a transportable mass storage device comprising removable connection means, and for example responding to the USB ^® standard, to the hardware resources 62 of a computer.

Thus, wherever he is, and as long as he has a computer, the user can work on his virtualized workstation 60.

In order to improve the security of the computer data 72 by doubling the encryption already performed by the encryption application 88, the mass storage device 76 may include its own data encryption means.

These data encryption means of the mass storage device 76 generally take the form of a processor having its own encryption algorithms and making it possible to encrypt in a hardware manner all the data contained in the memory of the mass storage device 76 with these algorithms.

Such an encrypted mass storage device 76 also comprises input means such as a keyboard making it possible to authorize using a code the use of the content of the mass storage device 76, and therefore that of the workstation. virtualized 60.

This encrypted mass storage device 76 is for example the encrypted disk of the Storeva Lockdrive ^® brand.

According to another variant, for example to facilitate the deployment and administration of different workstations on the same industrial site, the mass storage device 76 is the internal hard disk of a computer.

The present invention also aims to protect a virtualized workstation 60 in the form of a computer comprising such a mass storage device 76 connected to its hardware resources 62. Finally, and in addition to improving the security of the computer data 72 of the workstation 60 and the reliability of the operation of the workstation 60, the dual-layer software architecture of a workstation 60 makes it possible to ignore the Specific characteristics of the hardware resources 62 of each different computer used for the implementation of this workstation 60 and it simplifies the life cycle of the user environments constituted by the high software layer 82, the top operating system 66 and each application professional 70.

Claims

A method of virtualizing a workstation (60) comprising hardware resources (62) for implementing at least one operating system (64,66), at least one task (68) related to the administration and management of material resources (62) of the workstation (60), at least one professional application (70) for creating and manipulating computer data (72), and at least one security application (74) of said computer data (72), the method being characterized by providing on a mass storage device (76) a low software layer (78) comprising a low operating system (64), each securing application (74) of the computer data and a virtualization engine (80), and in that it plans to install virtually in the low software layer (78) and through the virtualization engine (80) another high software layer (82) comprising a system me up operation (66) and each professional application (70).

A method of virtualizing a workstation (60) according to claim 1, characterized in that each security application (74) of the computer data (72) installed in the low software layer (78) is inaccessible from the layer high software (82).

A method of virtualizing a workstation (60) according to claim 2, characterized in that neither the low operating system (64) nor a task (68) related to the administration and management of The hardware resource (62) of the workstation (60) is accessible from the high software layer (82).

4. A method of virtualizing a workstation (60) according to one of claims 1 to 3, characterized in that a securing application (74) of the computer data (72) is an antivirus application (84), a firewall application (86), an encryption application (88) of the computer data (72) or a network interconnection application (90).

The method of virtualizing a workstation (60) according to one of claims 1 to 4, characterized in that a professional application (70) is an application for the design of industrial products, management and monitoring of production, document management, configuration management, systems administration, distributed project management, or distributed data processing.

6. Process for virtualization of a workstation (60) according to one of claims 1 to 5, characterized in that a professional application (70) is a collaborative work platform.

A mass storage device (76) for connection to the hardware resources (62) of a workstation (60) for implementing at least one operating system (64,66), at least one task (68) related to the administration and management of material resources (62) of the workstation (60), at least one professional application (70) for creating and manipulating computer data (72), and least one application for securing (74) said computer data (72), the mass storage device (76) being characterized in that a low software layer (78) comprising a low operating system (64), each securing application (74) of the computer data (72) and a virtualization engine (80) is installed on the mass storage device (76), and that another high software layer (82) comprising a data storage system operation (66) and each professional application (70) is inst virtually traverses the low software layer (78) through the virtualization engine (80).

8. A mass storage device (76) according to claim 7, characterized in that it takes the form of a transportable mass storage device comprising removable connection means to the hardware resources (62) of a computer.

9. Mass storage device (76) according to claim 8, characterized in that the mass storage device comprises its own data encryption means.

10. Mass storage device (76) according to claim 7, characterized in that the mass storage device is the internal hard disk of a workstation.

11. Virtualized workstation (60) in the form of a computer comprising a mass storage device (76) according to one of claims 7 to 10 and connected to its hardware resources (62).