Lineage-based trust for virtual machine images
AssigneeAmazon Technologies, Inc.
InventorsArmando Jose Cruz Oliveira Queiros, Hart Matthew Rossman
Life of this patent
Estimating the term…
Abstract
A lineage-based trust for machine images that are derived from another may be established to validate a machine within the lineage before it is used to launch a virtual machine. An offspring machine image may be derived from a parent machine image through modifications made to the parent machine. Further, an integrity metric may be computed for each such modification and a data structure may be provided through which the parent and offspring machine images can be linked. When a customer of a provider network requests a virtual machine to be launched using a specified machine image, the specified machine image is loaded on to a host computer and validated using the associated integrity metrics before the virtual machine is launched.
Claims20
A system, comprising:
- one or more computing devices configured to implement a virtual machine manager;
- a storage subsystem configured to store machine images for use in launching virtual machines and to store manifests for the machine images, wherein the manifest for each machine image includes identifiers of modifications made to a predecessor machine image from which the machine image was derived and an integrity metric for each such modification;
- and
- a plurality of host computers on which to execute virtual machines using the machine images from the storage subsystem, each host computer containing an executable virtual machine validation agent;
- wherein, in response to a request to execute a virtual machine using a target machine image, the virtual machine manager is configured to cause the target machine image and the manifest associated with the target machine image, as well as manifests associated with machine images from which the target machine image is derived to be retrieved from the storage subsystem and to be transmitted to one of the plurality of host computers;
- wherein the host computer's virtual machine validation agent is configured to compute an integrity metric for each modification within the target machine image identified in the retrieved manifests, compare each computed integrity metric to a corresponding integrity metric contained in the respective manifests;
- and
- wherein the host computer is configured to launch the virtual machine from the target machine image in response a successful validation of the machine image.
A system, comprising:
- one or more processors coupled to memory, the one or more processors configured to implement a virtualization system including a virtual machine validation agent;
- wherein the virtual machine validation agent is configured to:
- validate a digital signature of a signed manifest corresponding to a target machine image usable to launch a virtual machine, wherein the manifest includes identifiers of modifications made to another virtual machine image and an integrity metric for each modification;
- compute an integrity metric of each modification identified in the manifest for the target machine image;
- and
- determine that at least one computed integrity metric for the target machine image does not match the corresponding integrity metric included in the manifest;
- and
- generate an error indicator.
A method, comprising:
- launching a virtual machine on a host computer using a first machine image;
- detecting a modification made to the virtual machine;
- computing an integrity metric of the detected modification;
- recording a metadata description of the modification and the integrity metric in storage within the host computer;
- and
- saving the modified virtual machine as a modified virtual machine image in a centralized storage subsystem configured to store machine images to be loaded on host computers for execution to instantiate virtual machines.
Dependencies are inferred from the claim text.