Method and device for the secure authentication and execution of programs
AssigneeCommissariat A L'energie Atomique Et Aux Energies Alternatives
InventorsLaurent Hubert, Renaud Sirdey
Life of this patent
Estimating the term…
Abstract
A device and a method for encrypting a virtual machine by on-the-fly encryption and decryption of the memory is described. The device comprises hardware and software elements, including a hardware security module for executing, in response to data read/write requests, on-the-fly encryption and decryption operations of the data stream associated with an encrypted memory image. The device and the method are particularly suited to allowing the secure authentication and execution of programs in the context of the infrastructure as a service layer of the cloud computing model.
Claims16
In a cloud computing environment composed of a plurality of Virtual Machine (VM) servers wherein each VM server comprises a processor enabling an execution of hypervisor software in order to assign virtual machines to client terminals through a user network, and of at least one authentication server enabling a bilaterally authenticated connection between a client terminal and the cloud, a device for executing encrypted programs comprising:
- a bilaterally authenticated connection establishment module for establishing a bilaterally authenticated connection between a client terminal and the cloud;
- an encrypted memory image generation module for generating, in response to a request to connect to the cloud from said client terminal, an encrypted memory image for a virtual machine assigned to said client terminal;
- and
- a security module for execution in response to requests of read/write of data into said encrypted memory image received from the processor of said virtual machine, of on-the-fly encryption and decryption operations in read/write of the data associated with said encrypted memory image,
- wherein the encrypted memory image generation module comprises means for:
- generating a private encryption key to assign a virtual memory image to said client terminal;
- downloading to said client terminal the assigned virtual memory image;
- encrypting the assigned virtual memory image;
- and
- uploading the assigned and encrypted virtual memory image to the cloud;
- and
- wherein the bilaterally authenticated connection establishment module for establishing the authenticated connection between said client terminal and the cloud comprise chip card reader type means coupled to said client terminal to calculate an encryption key as a function of a personal code stored on the chip card and means coupled to an authentication server of the cloud for performing an authentication upon reception of the personal code.
In a cloud computing environment composed of a plurality of Virtual Machine (VM) servers wherein each VM server comprises a processor enabling an execution of hypervisor software in order to assign virtual machines to client terminals through a user network, and of at least one authentication server enabling a bilaterally authenticated connection between a client terminal and the cloud, a method for executing encrypted programs comprising the steps of:
- after the establishment of a bilaterally authenticated connection between a client terminal and the cloud in response to a request to connect to the cloud from the client terminal, generating an encrypted memory image for a virtual machine assigned to said client terminal;
- and
- in response to requests of read/write of data into said encrypted memory image received from the processor of said virtual machine, executing on-the-fly encryption and decryption operations in read/write of the data associated with said encrypted memory image,
- wherein the step for generating an encrypted memory image additionally comprises the steps of:
- generating a private encryption key to assign a virtual memory image to said client terminal;
- downloading to said client terminal the assigned virtual memory image;
- encrypting the assigned virtual memory image;
- and
- uploading the assigned and encrypted virtual memory image to the cloud;
- and
- wherein the step for enabling the authenticated connection between said client terminal and the cloud comprises a step for calculating an encryption key as a function of a personal code stored on a chip card read by chip card reader means coupled to said client terminal and a step for authenticating the personal code upon reception of the code by the authentication server.
In a cloud computing environment composed of a plurality of servers and client terminals suitable for connecting to the cloud, one of the servers comprising a processor and a main memory enabling the execution of hypervisor software in order to assign virtual machines to the client terminals, a device comprising:
- an encrypted memory image generation module for generating, in response to a request to connect to the cloud from a client terminal, an encrypted memory image of a virtual machine assigned to the client terminal;
- a storage server to store the encrypted memory image;
- and
- a security module coupled to the storage server and to said one of the servers, to execute, in response to data read/write requests received from the processor of one of the servers, on-the-fly encryption and decryption operations of the data stream associated with said encrypted memory image,
- wherein the encrypted memory image generation module comprises means for:
- receiving a request to connect to the cloud from a client terminal;
- establishing a bilaterally authenticated connection between the client terminal and the cloud;
- generating a private encryption key to assign a virtual memory image to the client terminal;
- downloading to the client terminal the assigned virtual memory image;
- encrypting the assigned virtual memory image;
- and
- uploading the assigned and encrypted virtual memory image to the cloud;
- and
- wherein the means for establishing the authenticated connection between the client terminal and the cloud comprise chip card reader type means coupled to the client terminal to calculate an encryption key as a function of a personal code stored on the chip card and means coupled to an authentication server of the cloud for performing an authentication upon reception of the personal code.
Dependencies are inferred from the claim text.