US 10,650,157 B2 · Securing virtual execution environments

Abstract

Facilities are provided to secure guest runtime environments (GREs). Security policy specifications may be associated with GREs. A GRE's security policy may be specific to the GRE and may also include security policy inherited from higher levels such as a host operating environment. The security policy of a GRE specifies restrictions and/or permissions for activities that may be performed within the scope of execution of the GRE. A GRE's security policy may limit what the GRE's guest software may do within the GRE. Restrictions/permissions may be applied to objects such as files, configuration data, and the like. Security specifications may be applied to execution initiated within a GRE. A GRE's security specification may restrict/permit executable objects from loading and executing within the GRE. The executability or accessibility of objects may be conditioned on factors such as the health/integrity of the GRE, the host system, requested files, and others.

Claims20

Dependent claims

A method performed by a host computing device comprising processing hardware and storage hardware, the method comprising:

executing a host operating system, the host operating system executing a guest runtime environment (GRE) engine, the GRE engine configured to instantiate and manage the execution of GREs, each GRE comprising an environment that isolates execution within the GRE from the host operating system and from other GREs;
providing a security policy for a GRE managed by the GRE environment, the security policy specifying execution restrictions to be imposed on code executing within the GRE;
and
enforcing the security policy with respect to the GRE by monitoring execution of code within the GRE against the security policy and enforcing the execution restrictions when they are determined to be applicable, the monitoring comprising evaluating executable code for compliance with the security policy when the executable code has been requested to be loaded for execution by the GRE, the enforcing comprising preventing the GRE from loading executable code into memory for execution when the executable code has been determined to not comply with the security policy.

1 more element

Computer storage hardware storing information configured to enable a computing device to perform a process, the process comprising:

managing execution of guest runtime environments (GREs) on the computing device, the managing including virtualizing access to hardware of the computing device by guest software executing in the GREs;
associating a security policy specification with a GRE, the security policy specification specifying objects within the GRE and specifying respective security restrictions to be enforced within the scope of execution of the GRE;
enforcing the security policy specification by monitoring requests to access objects stored within the GRE, determining whether the objects requested to be accessed correspond to the objects specified by the security policy specification, and when so determined, determining whether the requests to access the specified objects satisfy the restrictions in the security policy specification;
and
determining whether to grant or deny access to the objects within the GRE based on the monitoring.

2 more elements

Dependencies are inferred from the claim text.

Securing virtual execution environments

Life of this patent

Securing virtual execution environments

Life of this patent

Abstract

Claims20