# US 8,751,781 B2 · System and method for supporting secure subsystems in a client hosted virtualization system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,781 B2
- Document ID: US8751781B2
- Status: Granted
- Kind: B2
- Application number: 12/790,548
- Filed: 2010-05-28
- Published: 2011-12-01
- Granted: 2014-06-10
- Earliest claimed: 2010-05-28
- Assignees: Dell Products L.P.
- Applicants: David Konetski; Kenneth W. Stufflebeam; Shree Dandekar
- Inventors: David Konetski; Kenneth W. Stufflebeam; Shree Dandekar
- Web page: https://patentgrep.com/patent/US8751781B2

## CPC

- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3271: {using challenge-response}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An client hosted virtualization system includes an authentication device, a processor and non-volatile memory with BIOS code and virtualization manager code. The virtualization manager initializes the client hosted virtualization system authenticates a virtual machine image, launches a portion of the virtual machine that initiates an authentication session with the authentication device, receives an authentication object from the authentication device, sends the authentication object to the portion of the virtual machine, and launches another portion of the virtual machine. The client hosted virtualization system is configurable to execute the BIOS or the virtualization manager.

## Claims

### Claim 1

A client hosted virtualization system (CHVS) comprising:
an authentication device;
a processor operable to execute code; and
a non-volatile memory including first code to implement a basic input/output system to initialize the CHVS and second code to implement a virtualization manager operable to:
authenticate a first virtual machine image associated with a first virtual machine;
launch a first portion of the first virtual machine on the CHVS based on the first virtual machine image, wherein the first portion of the first virtual machine is operable to initiate a first authentication session with the authentication device;
receive an authentication object from the authentication device in response to the first portion of the first virtual machine initiating the first authentication session;
send the authentication object to the first portion of the first virtual machine; and
launch a second portion of the first virtual machine;
wherein the CHVS is configurable in a first configuration to execute the first code and not the second code, and is configurable in a second configuration to execute the second code and not the first code.

### Claim 2 (depends on 1)

The CHVS of claim 1, further comprising a mass storage device, and wherein the first virtual machine image:
is stored on the mass storage device; and
includes an operating system and an application.

### Claim 3 (depends on 1)

The CHVS of claim 1, wherein:
the authentication device includes a keyboard; and
the authentication object includes a password.

### Claim 4 (depends on 1)

The CHVS of claim 1, wherein the authentication device includes a biometric input device.

### Claim 5 (depends on 1)

The CHVS of claim 1, further comprising:
a secure memory device;
wherein the virtualization manager is further operable to:
store the authentication object in the secure memory device; and
send the authentication object to the first portion of the first virtual machine from the security device.

### Claim 6 (depends on 1)

The CHVS of claim 1, wherein the virtualization manager is further operable to:
authenticate a second virtual machine image associated with a second virtual machine;
launch a first portion of the second virtual machine on the CHVS based on the second virtual machine image, wherein the first portion of the second virtual machine is operable to initiate a second authentication session with the authentication device;
receive an authentication object from the authentication device in response to the first portion of the first virtual machine initiating the authentication session;
send the authentication object to the first portion of the second virtual machine from the secure memory device; and
launch a second portion of the first virtual machine.

### Claim 7 (depends on 6)

The CHVS of claim 6, further comprising:
a trusted platform module;
wherein the virtualization manager is further operable to:
receive a first validation request from the first virtual machine;
send the first validation request to the trusted platform module;
receive a validation response from the trusted platform module;
store the validation response in the secure memory device; and
send the validation response to the first virtual machine from the security device.

### Claim 8 (depends on 7)

The CHVS of claim 7, wherein:
the virtualization manager is further operable to:
receive a second validation request from the second virtual machine; and
send the validation response to the second virtual machine from the security device; and
the first validation request and the second validation request are requests to validate a resource.

### Claim 9 (depends on 8)

The CHVS of claim 8, wherein the resource is a hardware resource of the CHVS.

### Claim 10 (depends on 8)

The CHVS of claim 8, wherein the resource is a software resource of the CHVS.

### Claim 11

A method of pre-boot authentication in a client hosted virtualization system (CHVS), comprising:
storing, by a processor of the CHVS, first code in a non-volatile memory of the CHVS to implement a basic input/output system to initialize the CHVS;
storing, by the processor, second code in the non-volatile memory;
determining, by the processor, to execute the first code to the exclusion of the second code;
in response to determining to execute the first code, executing, by the processor, the first code;
determining, by the processor, to execute the second code to the exclusion of the first code; and
in response to determining to execute the second code, executing, by the processor, the second code, wherein executing the second code comprises:
initializing the CHVS;
authenticating a first virtual machine image associated with a first virtual machine;
launching a first portion of the first virtual machine on the CHVS based on the first virtual machine image;
initiating from the first portion of the first virtual machine a first authentication session with an authentication device of the CHVS;
receiving an authentication object from the authentication device in response to initiating the first authentication session;
sending the authentication object to the first portion of the first virtual machine; and
launching a second portion of the first virtual machine.

### Claim 12 (depends on 11)

The method of claim 11, wherein the first virtual machine image includes an operating system and an application.

### Claim 13 (depends on 11)

The method of claim 11, the second code being further operable to:
store the authentication object in a secure memory device of the CHVS;
wherein sending the authentication object to the first portion of the first virtual machine is in response to storing the authentication object in the secure memory device.

### Claim 14 (depends on 13)

The method of claim 13, the second code being further operable to:
authenticate a second virtual machine image associated with a second virtual machine;
launch a first portion of the second virtual machine on the CHVS based on the second virtual machine image;
initiate from the first portion of the second virtual machine a second authentication session with the authentication device;
send the authentication object to the first portion of the second virtual machine; and
launch a second portion of the second virtual machine.

### Claim 15 (depends on 11)

The method of claim 11, wherein:
the authentication device includes a keyboard; and
the authentication object includes a password.

### Claim 16

A method of validating a resource in a client hosted virtualization system (CHVS), comprising:
storing, by a processor of the CHVS, first code in a non-volatile memory of the CHVS to implement a basic input/output system for the CHVS;
storing, by the processor, second code in the non-volatile memory;
determining, by the processor, to execute the second code to the exclusion of the first code; and
in response to determining to execute the second code, executing, by the processor, the second code, wherein executing the second code comprises:
initializing the CHVS;
authenticating a first virtual machine image associated with a first virtual machine, wherein the first virtual machine includes an operating system and an application;
launching the first virtual machine on the CHVS based on the first virtual machine image;
receiving a first request to validate a resource from the first virtual machine;
sending the first request to a trusted platform module of the CHVS;
receiving a response from the trusted platform module in response to sending the first request to the trusted platform module; and
sending the response to the first virtual machine from the security device.

### Claim 17 (depends on 16)

The method of claim 16, the second code being further operable to:
store the response in a secure memory device of the CHVS;
wherein sending the response to the first virtual machine is in response to storing the authentication object in the secure memory device.

### Claim 18 (depends on 17)

The method of claim 17, the second code being further operable to:
authenticate a second virtual machine image associated with a second virtual machine;
launch the second virtual machine on the CHVS based on the second virtual machine image;
receive a second request to validate the resource from the second virtual machine; and
send the response to the second virtual machine from the security device.

### Claim 19 (depends on 18)

The method of claim 18, wherein the resource is a hardware resource of the CHVS.

### Claim 20 (depends on 18)

The method of claim 18, wherein the resource is a software resource of the CHVS.